Privacy Policy

Brain Worms. Effective 6 October 2026 (previous version: 4 October 2026). Data controller: Levent Yenilmez (i-shim), contact [email protected].

1. What this covers

This policy applies to the Brain Worms mobile application for iOS and Android (the "App"), which lets you capture and organize your personal ideas, notes, events and thoughts. The backend runs on Google Firebase.

2. Data we process

• Account. An account identifier (Firebase Authentication). If you use the App without an account, we create an anonymous identifier, and your content and attachments are stored under it in Firebase just as for a signed-in account. If you sign in with Google, we receive your e-mail address, name and profile-photo link from Google. With Apple (on iPhone and iPad) we receive your e-mail address, which can be a private relay address. With e-mail sign-in, Firebase Authentication stores your address and a securely hashed password.
• Your content. The ideas ("brain worms"), notes, events, thoughts, categories, urgency levels and progress you save, with their creation and completion times. They are private to your account.
• Attachments. Photos, documents and audio files that you choose to attach to an event or thought — for example images, PDFs, office documents, text files and sound recordings, up to 25 MB each. Video files are not uploaded to our servers. They are kept on your device and, so that they stay with your account, uploaded to Google Cloud Storage through Firebase. We also store each file's name, type and size so the App can list it. Only your account can access them through the App; they are never public. We only receive the files you pick or share into the App from another app, never the rest of your photo library or files.
• Voice notes and their text. When you tap the microphone button while writing an event or thought, the App records a voice note through your device's microphone; the microphone is used only while that recording runs, and the note is saved as an audio attachment as described above. With Brain Worms Premium, what you say is also turned into text while you record, by your phone's own speech-recognition service (Apple's on iPhone and iPad; on Android, the recognition service your phone provides, such as Google's). Depending on the device and language, that service may process the audio on the device or on its provider's servers, under the provider's own privacy terms; we do not send your voice to any other company for this. The text, the second at which each word was said and any corrections you make are saved with the voice note in your account, like the rest of your content, and you can delete a voice note, its text or a correction note at any time.
• Purchases. To offer and restore Brain Worms Premium, the App connects to our subscription processor RevenueCat every time it starts, whether or not you subscribe. RevenueCat receives an app user identifier (your account's ID once you sign in, otherwise a random anonymous ID) and, if you buy or restore, the purchase record (product, dates, status). We use it to unlock and restore Premium and to see aggregate subscription statistics such as trial conversions and renewals. Apple or Google handles the payment; we never see your card or bank details, and we do not use purchase records for advertising.
• Technical data. As part of every request, Firebase and RevenueCat receive your IP address and basic technical information such as the app version, device model, operating-system version and language/region, so the service can work. We do not store this in your profile or use it for analytics.

When you use "Add to my calendar" or set a reminder, the entry is written to your device's calendar or scheduled on your device; it is not sent to us. We never read your contacts, location or camera, and we use the microphone only while you are recording a voice note. On some iPhone versions the system calendar editor shown inside the App may ask for contacts access to suggest a location; that stays on your device. We do not show third-party ads.

3. What we do NOT do

We do not sell your data. We do not use your content to train AI models. We do not require your name, e-mail or phone number to use the App.

4. Sharing and transfers

Data is shared only with the processors needed to run the service: Google Firebase (authentication, database on servers in the EU, attachment storage on servers in the US, cloud functions — Google LLC), RevenueCat, Inc. (subscription status — USA), Apple / Google (app distribution, sign-in, payments) and, only when you use the Premium text-while-recording feature, your phone's speech-recognition provider (Apple, or the provider of your Android phone's recognition service). Attachments, sign-in data and subscription data are therefore processed in the United States, under the safeguards these providers offer for international transfers (such as the EU Standard Contractual Clauses).

5. Retention & deletion

Your data is kept while your account is active. You can delete everything at any time from inside the App: Profile → Delete account (or Delete My Data if you use the App without an account). This permanently deletes your account, your ideas, notes, events, thoughts and categories, and your attachments from our database and cloud storage, and removes this account's attachment files from this device. You can also delete a single idea, event, thought or attachment at any time from its page in the App, without deleting your account; this also removes the cloud copy of that item's attachments.

Deleting your account does not cancel a Premium subscription — cancel it first in App Store › Settings › Subscriptions or in Google Play › Payments & subscriptions. Purchase records (product, dates, status and the account identifier) are kept by Apple or Google and by RevenueCat for accounting, tax and fraud-prevention purposes. Entries you added to your device calendar and reminders scheduled on your device are not removed. If you started without an account and then signed in to an existing account, your guest entries were copied into that account and the temporary guest copy may remain on our servers until it is cleaned up. To have any of this removed, or to delete your data without the App, write to [email protected]; we respond within 30 days.

6. Your rights

Depending on where you live (GDPR, KVKK, CCPA and similar) you may request access, correction, deletion, restriction, portability and object to processing. Write to [email protected]. Premium subscribers can also export their ideas from inside the App as CSV and JSON files.

7. Children

The App is not directed at children under 13 and we do not knowingly collect their data.

8. Changes

We post any changes on this page and update the effective date above.