bramblr

Privacy Policy

Effective date: · Operator: Brighten Wellness, LLC · 2800 N 6th St Unit 1 PMB 953, Saint Augustine, FL 32084, USA

This policy explains what information Bramblr collects when you use the Bramblr mobile app and the bramblr.app website, and what we do with it. We wrote it to match what the app actually does — no more, no less.

1. The short version

  • You log sensitive things — periods, symptoms, mood, notes. That content is stored under your account, and our access rules only allow your signed-in account to read it.
  • We never sell your data. No advertising, no data brokers, no sharing your information to market anything to you, no tracking you across other apps or websites. That's also why Bramblr doesn't show the Apple "tracking" prompt — there's nothing to opt into.
  • Analytics see usage, not health details. Our product analytics record things like which screens you open and which features you use. They never receive your symptom names, your notes, your period dates, your flow levels, or your assessment or checkpoint answers.
  • You can erase everything, any time. Account deletion is built into the app, takes a few taps, and wipes your content.
  • Your data lives in the EU. Our databases and analytics processors are hosted in the European Union.

The rest of this policy explains each of those points in detail.

2. Who we are

Bramblr is operated by Brighten Wellness, LLC, a Florida limited liability company based in Saint Augustine, Florida. When this policy says "we" or "us," it means that company. You can reach us at the address and email in Section 12.

The bramblr.app website itself doesn't use cookies or analytics — it's a static site. This policy is really about the app.

3. What we collect

There are five kinds of information involved in running Bramblr. Being specific here matters, because some of it is sensitive.

Your account

When you create an account, you sign in with an email address and password, or with your Apple ID or Google account. Depending on the method you choose and your own privacy settings, we receive:

  • your name;
  • your email address (if you use Sign in with Apple with the email-hiding option, we receive Apple's private relay address instead of your real one);
  • a Firebase account identifier (UID) — a random string that identifies your account internally.

If you sign up with an email and password, your password is handled by Firebase Authentication and is stored only as a secure hash. We can't see it, and we never ask you for it.

Health content you choose to log

This is the important part. Bramblr lets you record sensitive, health-related information about your body and how you feel, and you should know exactly what that includes:

  • Daily check-ins: your mood, focus, and energy ratings, symptom tags you select, and any free-text notes you write.
  • Period and cycle logs: period start and end dates, daily flow intensity, and spotting.
  • Your profile: answers you give during onboarding and setup (like life stage and cycle settings).
  • Assessment results: your answers and results from the ADHD-Hormone Profile assessment.
  • Checkpoint responses: your answers to the Baseline and monthly Checkpoint tracker.
  • Saved insights and history: insights you've received and saved.

All of this is stored in your account under our database access rules, which are designed so that a request for your data is only honored when it comes from your signed-in account. No other user can read it, and it is never shown or distributed to other users.

Push notification information

If you turn on notifications, we store a push notification token so Apple's or Google's push service can deliver the reminders you asked for (like your daily check-in reminder or period-approaching heads-up). This token identifies your device to the push service — that's all it does. If you turn notifications off, no reminders are sent.

Product analytics

We use two analytics services — Firebase Analytics and PostHog (hosted in the EU, at eu.posthog.com) — to understand how the app is used so we can improve it. Analytics events record things like which screens are opened, which features are used, and coarse usage patterns.

To be concrete about what analytics never receives: no symptom names, no note text (only the character count of a note), no dates — period or otherwise, no flow levels, no cycle lengths, no assessment letters or answers or profile results, and no checkpoint answers. Where a number is useful (for example, how long a logged period was), analytics only ever receives a coarse bucket like "3–5 days," never the exact value.

Analytics events are tied to a device or account identifier so we can see usage patterns — but they are not advertising identifiers, they are never used for advertising, and they are never combined with data from other apps or companies to profile you.

Configuration

We use Firebase Remote Config to manage the app remotely — turning features on or off, adjusting settings, and updating content lists without waiting for an app update. These are configuration values (like "is this feature enabled?"), not personal information about you.

What we deliberately don't collect

Bramblr does not collect: your location, payment or financial information, your photos or videos, your contacts, your browsing or search history, advertising identifiers, or crash-diagnostic data from third-party SDKs. And we don't run ads anywhere in the app.

4. How we use your information

We use your information to:

  • create and operate your account;
  • store, display, and sync the content you log, on your devices;
  • generate your personalized insights — Bramblr's insights are produced by rules-based matching against your own logged data, not by an AI model, and we do not train machine-learning models on your content;
  • deliver the reminders you enable;
  • understand, in aggregate, how the app is used so we can improve it;
  • keep the service secure and operating.

We do not use your information for advertising (we run none), to profile you for marketing, to sell or rent to anyone, or to share with data brokers. Ever.

5. Legal bases (if you're in the EU/EEA or UK)

If data-protection law like the GDPR applies to you, here's the honest mapping:

  • Your health-related content is processed on the basis of your explicit consent. Bramblr asks for that consent in the app before saving any health data, and you can withdraw it at any time. Withdrawing consent stops future collection, but it doesn't erase what's already saved — use account deletion for that.
  • Account and service operations (running your account, storing your logs, delivering your reminders) are based on performance of our contract with you.
  • Coarse product analytics are based on our legitimate interest in understanding how the app is used, balanced against your rights — you can object by contacting us (see Section 8).

6. Where your data lives, and how long we keep it

Your account data and your logged content are stored with Google Firebase, in the europe-west (EU) region. Our PostHog analytics are hosted in the EU. This was a deliberate choice for a sensitive-data app.

We keep your content only while your account exists. When you delete your account, the content under it is erased from our active systems; residual copies in routine encrypted backups age out within a short period as those backups cycle.

Analytics events are not linked to your health data. On account deletion we disassociate them from your account where our tools allow.

7. Who we share it with

We don't share your information with anyone for commercial purposes — no sales, no rentals, no advertising partnerships, no data brokers.

We do use service providers that process data on our instructions, under contract, to operate the app: Google (Firebase) for authentication, database, notifications, configuration, and analytics, and PostHog for product analytics. That's the list.

We may disclose information if we're legally required to (for example, a valid court order) — we don't do this voluntarily, and we've never had a reason to.

8. Your controls and your rights

You're in charge of your data, and the controls are in the app:

  • Consent: you can withdraw your health-data consent and stop future logging.
  • Notifications: every reminder type can be turned off in Settings.
  • App lock: an optional PIN or biometric lock keeps your data private on your device. It never leaves your device.
  • Account deletion: a few taps in Settings erase your account and all content under it.

If data-protection law gives you rights — under the GDPR (access, correction, deletion, portability, objection) or the CCPA (know, delete, opt out of sale) — you can exercise them by using in-app deletion or by contacting us at the email in Section 12. We'll respond within 30 days. Two notes: (1) we don't sell or share personal information for money, so there's nothing to opt out of; (2) the app doesn't yet have a self-serve data-export feature — if you ask, we'll prepare a manual export of your account's data.

9. How we protect your data

No system is perfect, and we won't pretend otherwise — but here's our posture:

  • Data travels over encrypted connections; your content sits in Firebase infrastructure with access rules that reject any request for your data that isn't from your signed-in account.
  • Each user's data is stored in separate per-user records — there is no shared pool of user content.
  • We don't embed plaintext secrets in the app, and we don't run third-party ad or tracking SDKs.
  • On your device, an optional app lock (PIN or biometric) adds a layer you control.

If we ever become aware of a breach that affects your information, we'll tell you.

10. Children

Bramblr is not directed to children under 13, and we don't knowingly collect their data. The app carries a 12+ store rating, but it is written for adults — our content assumes an adult audience navigating hormonal changes. If you believe a child under 13 has created an account, contact us and we'll delete the account and its data.

11. Changes to this policy

If we make material changes to this policy, we'll notify you in the app (or by email) before the new version takes effect, and we'll re-ask for consent where a change materially affects how your health data is processed. The effective date at the top always shows the current version; we can provide prior versions on request.

12. Contact

Questions, requests, or complaints — reach us:

Brighten Wellness, LLC
2800 N 6th St Unit 1 PMB 953
Saint Augustine, FL 32084, USA
Email: [email protected]