BrainList Privacy Policy

Effective date: May 3, 2026 Last updated: May 3, 2026

This page explains what information BrainList (“BrainList”, “we”, “us”, “our”) collects when you use the BrainList mobile app and the related BrainList website at app.brainlist.io (together, the “Service”), how we use it, who we share it with, and the rights you have over it.

If you have questions, email privacy@brainlist.io.

1. Who we are

BrainList is operated by Haidar Al-Aubiydy, based in Ottawa, Ontario, Canada. The data controller for European users is the same entity.

For postal correspondence, contact privacy@brainlist.io to request a mailing address.

2. What we collect

We collect only what we need to run the Service. Categories:

2.1 Account data

When you sign up — by email + password, Google, or Apple — we store: - email address - a display name (optional, defaults to your email handle) - a hashed password (only for email/password sign-ups; we never see the plaintext) - the platform you signed in with (Google / Apple / email) and the unique account ID that platform gives us

2.2 Usage data

While you use the Service we record: - which episodes you play, your playback position, and completion state (so the “Continue listening” shelf works and your progress syncs across devices) - which playlists you create and which episodes you save - quiz answers, contest results, points earned, league standings - friend / follow relationships - ratings you give to series

2.3 Subscription data

If you subscribe through Apple’s App Store or Google Play, the store sends us: - your subscription tier (Solo / Family) and status (active, in trial, cancelled, etc.) - the anonymous purchase token the store assigns - the price you paid (in summarized form for accounting)

We do not receive your credit card number or billing address — those stay with Apple / Google. Subscription billing is processed by RevenueCat on our behalf.

2.4 Diagnostics & analytics

We collect crash reports and product-usage analytics so we can fix bugs and understand which features are useful: - Sentry receives crash stack traces, the app version, the device model + OS version, and a randomly-generated install ID. No personal content is included. - PostHog receives product-usage events (e.g. “episode played”, “contest joined”), the app version, and the same install ID. We tag events with your account ID once you sign in so we can answer questions like “do paying users finish more episodes than free users”.

2.5 Push notification tokens

If you allow notifications, we store the push token issued by Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) so we can deliver new-episode alerts, contest invites, and friend-activity pings (each toggle is opt-out under Settings → Notifications).

2.6 Information we do not collect

• We do not collect your contacts, calendar, photos, microphone, location, or any other device sensor.
• We do not access your social-network friends list.
• We do not buy data about you from third-party brokers.

3. How we use what we collect

We use your data to: 1. Provide the Service — sign you in, sync your progress, run live trivia rooms, deliver notifications you’ve opted into, process subscriptions, and protect your account. 2. Improve the Service — diagnose crashes, prioritize features by which screens see use, and run aggregated experiments (e.g. comparing two onboarding flows). 3. Communicate with you — respond to support emails, send transactional notifications about your account or subscription, and (if you opt in) occasional product updates. We do not sell your email to third parties or send marketing without your opt-in. 4. Comply with the law — respond to lawful legal requests and enforce our Terms.

We do not: - sell or rent your personal data to anyone - use your data to target advertising on other apps or websites - train AI models on your private content (your listening history, your messages, your ratings)

4. Who we share it with

We share data only with vendors who help us run the Service, under contracts that limit them to that purpose:

We may also share data when required by law (subpoena, court order, lawful government request) or when necessary to protect the rights, property, or safety of BrainList, our users, or the public.

If BrainList is acquired or merges with another company, your data may transfer to the successor — we’ll notify you in-app and via email at least 30 days before that takes effect, so you have time to delete your account if you’d rather not move with us.

5. How long we keep it

• Account data — for as long as your account is open. When you delete your account (Settings → Delete my account), we hard-delete it within 30 days. Some backups may retain copies for up to 90 days before they’re rotated out.
• Subscription receipts — kept for 7 years to satisfy tax and accounting law.
• Diagnostics — Sentry rolls off events older than 90 days. PostHog retains aggregated event counts indefinitely; individual events are retained for 12 months.
• Logs on our servers — retained for 30 days, then rotated.

6. Your rights

Wherever you live, you can: - See what we have about you — email privacy@brainlist.io and we’ll send you an export within 30 days. - Correct information that’s wrong — most of it you can edit yourself in Settings; for the rest, email us. - Delete your account — Settings → Delete my account (in-app), or email us. We’ll confirm in writing within 30 days. - Opt out of analytics — coming soon as an in-app toggle; until then, email privacy@brainlist.io and we’ll suppress your account ID from PostHog. - Opt out of marketing — every marketing email has an unsubscribe link; transactional emails (subscription receipts, account-security alerts) cannot be opted out of as long as you have an account.

If you live in the European Economic Area, the United Kingdom, or Switzerland, you also have the right to lodge a complaint with your local data protection authority. The legal basis we rely on for processing is: (a) contract — to provide the Service you signed up for, (b) legitimate interest — to improve the Service and prevent abuse, and (c) consent — for optional things like marketing emails.

If you live in California, you have the rights granted by the CCPA / CPRA, including the right to know, delete, correct, and opt out of “sale” or “sharing” of personal information. We do not sell or share your personal information for cross-context behavioral advertising.

7. Children

The Service is intended for ages 13 and up (16+ in the European Economic Area). We do not knowingly collect personal data from children under those ages. If you believe a child has signed up, email privacy@brainlist.io and we’ll delete the account.

8. Security

We protect your data with: - HTTPS/TLS for everything in transit (the app refuses cleartext HTTP at the OS level) - Encrypted database storage at rest (Postgres on Railway with managed encryption) - Hashed passwords (Django’s PBKDF2 + per-user salt) - Two-factor authentication available on all admin accounts that touch user data

No service is 100% secure. If we discover a breach affecting your data, we’ll notify you within 72 hours of confirming it.

9. International transfers

We’re a US-based service. If you use BrainList from outside the US, your data will be transferred to and processed in the United States. We rely on Standard Contractual Clauses (for EEA/UK transfers) and the equivalent contractual safeguards for transfers from other jurisdictions.

10. Changes to this policy

We may update this policy as the Service evolves. When we make a material change, we’ll: - update the “Last updated” date at the top - notify you in-app on next launch - email account holders at least 14 days before the change takes effect

The current version always lives at https://app.brainlist.io/privacy/ (or wherever the app’s Settings → About → Privacy Policy link points).

11. Contact

Questions, requests, or complaints:

Email: privacy@brainlist.io Postal: Email us first at the address above to request a mailing address.

We respond to every privacy request within 30 days.