Privacy Policy

The short version

BraveDay never asks for your email address, and there is nothing to sign in to. The app works from your phone, and it also keeps a backup of what you enter, so that reinstalling the app on the same iPhone brings your family's work back. That backup sits under an anonymous account: a random identifier your phone generates, with no name, no email, and no way for us to connect it to you as a person. Being anonymous has a cost, and we would rather say it plainly than imply otherwise: there is nothing attached to that identifier for you to sign in with, so it cannot yet follow you to a different phone. You can delete all of it, from your phone and from us, with one tap in Settings.

Voice memos are the exception, and they always will be: recordings stay on the phone that made them, are never uploaded, and have no path to our server under any setting.

Your account, without an account

The first time you open the app it generates a random identifier for itself and registers it with us. That is the whole of your account. We do not ask for an email address, a password, or a name, and we cannot email you, because we have no way to. Later, if you choose to, you will be able to attach an Apple sign-in or an email address to that identifier so you can recover it on a new phone; until you do, it is reachable only from the phone that made it.

What "only from the phone that made it" means depends on your phone, so here it is exactly. On an iPhone the identifier is kept in the system keychain, which outlives the app itself: delete BraveDay and reinstall it and your backup is picked up again. On Android it is removed along with the app, so uninstalling puts the backup permanently out of reach. On any new or replaced phone, on either platform, the identifier does not travel with you. A backup nobody can reach is one we then delete on the schedule below.

What the app keeps, and where

Everything you enter is stored on your phone, and a copy is kept on our server under your anonymous identifier: your children's first names or nicknames and their birth month and year, the name they give their worry voice, the answers you gave during setup, your Brave Goals, which cards you played, and the words of your child's you typed in. We keep that copy so it can be restored, and we use it in aggregate to understand which parts of the app help. We do not sell it, we do not advertise on it, and we do not share it with anyone except the infrastructure providers who host it for us.

Voice memos are never part of that copy. When a memo exists, the backup records only that one exists; the recording itself stays on your phone, which means it is also the one thing a restore cannot bring back.

If you back your phone up yourself, for example with iCloud or Google, that backup is yours and stays under your own account.

Children's data

The app is designed for parents, not children. Your child never uses it, and everything in it is entered by you, as their parent, about them. We ask for a first name or nickname and a birth month and year per child, which is what picks the right cards for each child's age, and for the answers you give during setup about what they are afraid of. That information is stored on your phone and in your backup, as described above.

We treat it as the most sensitive data we hold. It is never used for advertising or profiling, never sold, and never shared with a third party for their own purposes. The app contains no third-party advertising, no social features, and no way for anyone else to see your family. If you would rather we held nothing at all, deleting everything in Settings removes our copy, and you can keep using the app from your phone alone.

Personalization

With personalization on, the next cards can be written for your family by an AI model. To do that, the app sends our server only anonymous, structured signals: each child's age in years and age band (never a name; children are labeled "Child A", "Child B"; a parent is labeled "P1"), answers picked from closed, fixed lists (fears, struggles, when the worry shows up, where it lands in the body, the lines the worry voice says, what has worked, what you have tried, interests, and the chosen Brave Goal; there is no free-text field for any of them), whether the worry voice has been named (a yes or no, never the name itself), the bravery record as counts, and your anonymous account identifier. Every request also carries a second random identifier for the phone it came from, which we store only as a one-way hash and use only to tell one device from another when limiting abuse.

Typed catches and notes are separate. Only if you say yes to sharing, during setup or in Settings, does the app also send a few recent typed catches (your child's words) and notes (your own words, marked as yours), stripped of names on the phone and tagged only with the anonymous labels, and they are used solely to generate the next cards and to maintain a short, anonymous family memory that helps write them. This switch is off unless you turned it on, and turning it off stops the sharing immediately. Voice memos are never sent, never transcribed off the device, and have no path to our server. We pass these signals to OpenAI to generate the cards, with data retention disabled, and we do not store your requests on our server beyond a short technical cache.

Personalization is optional: switch it off in Settings and the app uses its built-in deck, fully offline. It is also off automatically whenever you are offline or not subscribed.

What we do collect

This website keeps standard, short-lived visit logs (your device's IP address and the page it requested) to keep the site secure and online. If you opt in to purchases, Apple or Google and our payment processor handle the transaction; we receive an anonymous receipt, never your card details. If we add optional, privacy-respecting crash reporting or analytics to the app, it will be disclosed here first and will never include captures, notes, or child data.

The launch waitlist

If you leave your email address on our website to hear when the app is out, we store that address and the time you gave it, and we use it for exactly one thing: telling you BraveDay has launched. It is never connected to any app account, never shared, and never used for anything else. To come off the list, reply to anything we send, or email hello@braveday.app and we will delete your address.

How long we keep it, and how to delete it

We keep your backup for as long as the account is in use, and delete an account that has not been opened for two years. You can delete everything at any time from Settings, under "Your data": it erases our copy first and then wipes the phone, and it is immediate and permanent. There is no undo, no grace period, and nothing retained afterwards beyond ordinary short-lived server logs.

Deleting the app without using that button removes everything from your phone but leaves our copy in place. On an iPhone that is what makes reinstalling restore your family; on Android, and on any phone that is not the one that made the account, nobody can reach that copy again and it is deleted once the account has gone two years without being opened.

If you want it gone sooner and the app is already deleted, email hello@braveday.app and we will delete it. Because your account has no name attached, please write from a phone that still has the app installed, or include the backup reference shown in Settings, or we will have no way to tell which account is yours.

Contact

Questions about this policy: hello@braveday.app.