Privacy Policy

This Privacy Policy (“Policy”) describes how Flynn McConneloug (“NoBrainer,” “we,” “us,” or “our”) collects, uses, stores, and protects information obtained from users (“you” or “your”) of the NoBrainer mobile application and website (collectively, the “Service”). By accessing or using the Service, you consent to the data practices described in this Policy.

1. Information We Collect

We collect the following categories of information:

1.1 Account Information. When you create an account using Sign in with Apple, we receive your name and email address (or an Apple-generated relay address, if you choose to hide your email). We store a unique user identifier, display name, and authentication credentials.

1.2 Calendar and Scheduling Data. With your explicit permission, NoBrainer accesses calendar events from Apple Calendar (via EventKit), Google Calendar (via Google OAuth2), and/or Microsoft Outlook (via Microsoft OAuth2). This includes event titles, dates, times, locations, and associated notes. Calendar data from Apple Calendar is read locally on your device and transmitted to our server only when you initiate a chat request, except that if you turn on sharing with friends (Section 1.9), your device also uploads your busy and free times, without event titles, locations, or notes.

1.3 Email Data. With your explicit permission, NoBrainer accesses email metadata from Apple Mail (iCloud, via IMAP) and/or Microsoft Outlook (via Microsoft OAuth2). This includes sender names, subject lines, dates, and message snippets. We access email content solely to provide you with summaries and to facilitate email-related actions you request. NoBrainer does not request access to Gmail.

1.4 Reminders and Tasks. With your explicit permission, NoBrainer accesses incomplete reminders from Apple Reminders (via EventKit), tasks from Google Tasks (via Google OAuth2), and/or Microsoft To Do (via Microsoft OAuth2). This includes task titles, due dates, and notes.

1.5 Chat Data. We store messages you send to and receive from the NoBrainer AI assistant, including any text, images, or attachments you provide. Chat history is associated with your user account. NoBrainer may also save short facts you tell it (“memory”) to personalize later answers, and a nightly summary of the day’s conversation so the next day’s thread has context; you can view and delete saved memories in Settings.

1.6 Device and Usage Information. We collect device push notification tokens for the sole purpose of delivering notifications you have configured. We also collect basic product-interaction analytics: events such as app opens and session ends, along with the token counts and AI model used for each request, and the steps of first-time setup (which setup screens you reach; whether you connect a school calendar, and how many items it holds; whether you allow calendar access, notifications, and AI processing; how you sign in; whether you claim a username, start a trial, restore a purchase, invite friends, or share your semester summary; how long setup takes; and which first-week checklist tasks you complete), all tied to your account identifier. Setup steps from before you sign in are kept on your device with a random setup ID, which is not a device identifier, and are sent only after you sign in. We use this data solely to understand how NoBrainer is used and to improve the product. We do not sell it, we do not use it for advertising or ad tracking, and the app contains no third-party advertising SDKs. Analytics data is erased when you delete your account. We do not collect device identifiers.

1.7 Website Signups. If you join the waitlist or sign up as a tester via our website, we collect your name and mobile phone number, and optionally an email address if you choose to give us one. We use them for the sole purpose of contacting you about NoBrainer availability and sending TestFlight beta invitations.

1.8 Text Messages. By giving us your phone number on our website you consent to receive text messages from NoBrainer about the launch and the TestFlight beta. These are one-off, manually sent messages — not a recurring campaign. Message and data rates may apply. Reply STOP to any message to stop receiving them, and we will remove your number. We do not sell, rent, or share phone numbers with anyone, and we never use them for advertising. Your consent to be texted is not a condition of using the app.

1.9 Friends and Free/Busy Sharing. NoBrainer lets you show friends when you are busy or free. Sharing is off until you turn it on, either during first-time setup or in the Friends tab.

• Username and profile photo. To be added as a friend, you choose a username; anyone who types it exactly can send you a friend request. You may also add a profile photo, from which the app removes location and camera information before it is uploaded. Your display name and profile photo are shown to your accepted friends and to people you send a friend request to. If you share an invite link, anyone who opens it while signed in to NoBrainer sees your display name, username, and profile photo, and can send you a friend request for you to accept or decline.
• Busy and free times. If you turn sharing on, the app works out on your device when you are busy, from your calendars (Apple Calendar, Google Calendar, Outlook) and your school calendar feed, leaving out any calendar you switch off in the Friends tab’s sharing settings. It uploads only the start and end times of busy periods for the next 7 days, limited to the sharing hours you choose (8 AM to 10 PM unless you change them), each with an optional general label such as class, work, or gym. Event titles, locations, attendees, and notes are never uploaded for this feature. Nothing is uploaded until you have at least one accepted friend you share with.
• Who sees it. Only friends you have accepted (or who accepted your request), and only while both of you are sharing. You can pause sharing, change your hours, hide the labels, stop sharing with any one friend (they are not told), remove or block a friend, or turn sharing off at any time in the Friends tab.
• This information is not sent to OpenAI or Anthropic.

1.10 Setup Questions. When you first set up NoBrainer, it asks your school year (such as 9th or 10th grade, or college), what trips you up most, your goal for the semester, and when you want your morning brief. Your answers are saved to your account along with the usage information in Section 1.6, and are erased when you delete your account. Answers you give before you sign in stay on your device until you sign in. For a new account, the brief time also sets when your morning brief arrives.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Service Delivery. To display your schedule, reminders, emails, and tasks within the app, and to respond to your queries through the AI assistant.
• AI Processing. Your messages, along with contextual data from your connected accounts, are transmitted to OpenAI, L.L.C. (“OpenAI”) for processing by OpenAI’s models, and to Anthropic, PBC (“Anthropic”) for processing by the Claude model only when OpenAI is unavailable. Specifically, the following may be sent: your chat messages, recent chat history, and photos you attach; calendar events (titles, times, locations) from the calendars you connect; reminders and tasks; assignments from your school calendar feed; previews of recent emails if you connect an email account; saved memory facts; and the nightly chat summary. This processing is necessary to generate relevant, context-aware responses, briefs, and reminders. OpenAI’s handling of API data is governed by its Privacy Policy and API data usage policies; Anthropic’s by its Privacy Policy and Usage Policy. Neither uses API inputs to train their models.
• Your Consent to AI Processing. Before any of this data is sent to OpenAI or Anthropic, the app asks for your explicit permission on a dedicated screen that names them and lists what is shared. Our server records your answer on your account and refuses to send anything until you have allowed it, including for scheduled features such as the morning brief and deadline reminders. You can withdraw that permission at any time in Settings under “AI & your data”; NoBrainer then stops sending your data to them, and chat, automations, and AI reminders stop until you allow it again.
• Friends. If you turn on sharing, to show your busy and free times, display name, and profile photo to the friends you choose, as described in Section 1.9, and theirs to you.
• Automated Tasks. To execute automations you configure, such as morning briefings, deadline alerts, and email digests.
• Notifications. To deliver push notifications for reminders, automation results, and alerts you have enabled.
• Action Execution. To create, modify, or delete calendar events, reminders, and tasks on your behalf when you explicitly request such actions through the AI assistant.
• Product Improvement. To understand how NoBrainer is used, using the product-interaction analytics described in Section 1.6, so we can fix problems and improve the app. This data is never used for advertising and is never sold.

3. Data Storage and Security

3.1 Server-Side Storage. Your account data, chat history, integration credentials, and automation configurations are stored in a PostgreSQL database hosted by Supabase, Inc. (“Supabase”). Supabase provides:

• Encryption in transit via TLS 1.2+
• Encryption at rest via AES-256
• Row Level Security (RLS) policies ensuring each user can only access their own data
• SOC 2 Type II compliance

3.2 Device-Side Storage. Authentication tokens and sensitive credentials are stored in the iOS Keychain, Apple’s encrypted on-device credential storage. Non-sensitive preferences are stored in UserDefaults.

3.3 OAuth Token Security. Google OAuth2 tokens and Apple Mail credentials are stored in the Supabase database, accessible only through authenticated API requests scoped to your user account. Tokens are never exposed in client-side code or transmitted to any party other than the respective service provider (Google, Apple).

3.4 Backend Infrastructure. Our application server is hosted on a Virtual Private Server (VPS) secured with SSH key authentication, firewall rules, and HTTPS via automated TLS certificates.

4. Data Sharing and Disclosure

We do not sell, rent, lease, or trade your personal information. We share your data only with the following parties, solely as necessary to provide the Service:

• OpenAI, L.L.C. — AI processing (primary). Receives your chat messages and the connected-account context described in Section 2, only after you allow it in the app. OpenAI does not use API inputs to train models.
• Anthropic, PBC — AI processing (fallback, only when OpenAI is unavailable). Receives the same data under the same permission. Anthropic does not use API inputs to train models.
• Supabase, Inc. — Hosts our database and authentication infrastructure. Acts as a data processor on our behalf.
• Google LLC — Receives OAuth2 token requests to access your Google Calendar and Google Tasks data on your behalf.
• Microsoft Corporation — Receives OAuth2 token requests to access your Outlook calendar, mail, and Microsoft To Do data on your behalf, if you connect Outlook.
• Apple Inc. — Processes Sign in with Apple authentication and provides access to Apple Calendar and Reminders via on-device frameworks.

Each of these parties provides the same or equal protection of your data as described in this Policy.

If you use Friends, we also show other NoBrainer users you choose the limited information described in Section 1.9. We never show them your event titles, locations, or notes.

We may disclose your information if required by law, regulation, legal process, or governmental request, or to protect the rights, property, or safety of NoBrainer, our users, or the public.

5. Google API Services Compliance

NoBrainer’s use and transfer to any other app of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• We only request access to Google data that is necessary for the features you use.
• We do not use Google data for advertising purposes.
• We do not transfer Google data to third parties except as necessary to provide the Service (i.e., OpenAI, or Anthropic as its fallback, for AI processing), with your consent, for security purposes, or to comply with applicable law.
• If you turn on Friends sharing, the busy and free times the app derives from your Google Calendar, never event details, are shown to the friends you choose, as described in Section 1.9.
• We do not use Google data to train machine learning or AI models.

6. Data Retention

We retain your data for the following periods:

• Account data: Retained while your account is active. Deleted within 30 days of account deletion request.
• Chat history: Conversations older than 90 days are automatically deleted. You may manually delete individual conversations at any time.
• Integration tokens: Deleted immediately when you disconnect an integration or delete your account.
• Automation results: Retained while associated automation is active.
• Analytics events: Retained while your account is active. Erased when your account is deleted.
• Friends: Busy and free times for days more than 14 days in the past are deleted automatically. Your friend connections, sharing settings, busy and free times, and profile photo are deleted when you delete your account.

7. Your Rights and Choices

You have the following rights regarding your personal information:

• Access. You may request a copy of the personal information we hold about you.
• Deletion. You may request deletion of your account and all associated data. We will process deletion requests within 30 days.
• Disconnection. You may disconnect any third-party integration at any time through the app’s Settings screen. Disconnection immediately revokes our access to that service’s data.
• Portability. You may request your data in a machine-readable format.
• Correction. You may request correction of inaccurate personal information.

To exercise any of these rights, contact us at johnflynn850@gmail.com.

8. Children’s Privacy

The Service is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe a child under 13 has provided us with personal information, please contact us at johnflynn850@gmail.com.

9. State Privacy Rights

California Residents (CCPA/CPRA). California residents have additional rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. You have the right to know what personal information we collect, request deletion, and opt out of the sale of personal information. We do not sell personal information. To exercise your rights, contact us at johnflynn850@gmail.com.

Other U.S. States. Residents of states with applicable privacy laws (including Virginia, Colorado, Connecticut, and Utah) may have similar rights. Contact us to exercise any applicable rights.

10. International Data Transfers

Your data may be processed in the United States regardless of your location. By using the Service, you consent to the transfer of your information to the United States, where data protection laws may differ from those in your jurisdiction.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the app or via email at least 7 days before the changes take effect. The “Effective” date at the top of this Policy indicates when it was last revised. Your continued use of the Service after changes become effective constitutes acceptance of the revised Policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact:

Flynn McConneloug
Email: johnflynn850@gmail.com
Salt Lake City, Utah, United States