Privacy Policy

• Your letters live on European servers and are only ever processed to give you a summary, the required action, and any deadlines.
• The AI that reads them runs inside the EU and is never allowed to train on your letters.
• We don't sell your data, we don't run ads, and we never attach your name or account to usage analytics.
• You can delete any single letter — or your entire account and everything in it — from inside the app, at any time.

The rest of this page is the detail behind those four promises.

The controller responsible for your personal data under the GDPR is:

• Brievly
• Privacy enquiries: support@brievly.app
• General contact: hi@brievly.app

We try to collect as little as possible. Here is everything, grouped by why we have it.

• Account basics — your email address, and your name and profile picture if your sign-in provider (Apple or Google) shares them. We use these to create and secure your account. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• Your letters — the photos you take and the text and structured details our AI extracts from them (sender, summary, amounts, references, deadlines). We use these only to produce your summary and reminders. Because a letter can reveal sensitive things — health, finances, legal matters — we treat this as special-category data and process it only on your explicit consent, given when you choose to scan a letter (Art. 6(1)(a) and Art. 9(2)(a) GDPR).
• Deadlines and reminders — dates we find in your letters, plus any calendar events you ask us to create. Legal basis: contract, and your consent for calendar/notification access.
• Subscription status — whether you have Brievly Premium, managed through the app stores and our payments provider. We do not see or store your card details. Legal basis: contract.
• Usage analytics — anonymous, content-free signals about how the app is used (e.g. a screen was opened, a scan succeeded or failed). These are never linked to your identity, your account, or the contents of your letters. Legal basis: our legitimate interest in improving the app (Art. 6(1)(f)), or your consent where required.
• Support messages — if you email us, we keep that conversation so we can help. Legal basis: legitimate interest.

When you scan a letter, the image is sent from your device to our own secure backend, which forwards it to Google's Vertex AI to be read. This processing happens in Google's europe-west3 region (Frankfurt, Germany) — your letter does not leave the EU to be analysed.

Under our agreement with Google, your prompts and letters are not used to train or improve any AI model. They are processed to return a result to you and nothing more.

To run Brievly we rely on a small number of carefully chosen service providers ("processors"). They may only handle your data on our instructions.

• Supabase — hosts our database and stores your letter images, on servers within the EU. They do not access or use your content.
• Google Cloud (Vertex AI) — reads your letters, in the EU (Frankfurt), without training on them.
• RevenueCat — manages your subscription status. It receives an anonymous user identifier and purchase events from the app stores, never your letters. RevenueCat is based in the United States; this transfer is covered by EU Standard Contractual Clauses.
• Apple & Google — handle sign-in and, when you subscribe, the actual payment. Their handling of your data is governed by their own privacy policies.
• Google Firebase / Google Analytics — provides the anonymous usage analytics described above. We have configured it not to collect a user identifier and not to be used for advertising. As a US provider, transfers are covered by EU Standard Contractual Clauses.

• Your letters and account data stay until you delete them. We don't automatically expire your letters, because you may want them later — but you are always in control.
• When you delete a letter or your account, the data is removed from our live systems right away and purged from encrypted backups within 30 days.
• Records we are legally required to keep — for example, billing and tax records tied to a subscription — are retained for the period the law requires, then deleted.

Because your data is protected by the GDPR, you can at any time:

• Access a copy of the data we hold about you.
• Correct anything that's wrong.
• Delete your data — in full, from inside the app (see our account-deletion guide).
• Export your data in a portable format.
• Restrict or object to certain processing.
• Withdraw any consent you've given, without affecting what happened before.

To exercise any of these, email support@brievly.app. You also have the right to complain to a data protection authority — for example the Saxon Commissioner for Data Protection and Transparency (our supervisory authority), or the authority where you live.

Your data is encrypted in transit and at rest. Every letter and file is locked to your account at the database level, so one user can never read another's mail. Access to production systems is limited and authenticated. No system is perfectly secure, but we treat your mail with the care it deserves.

Brievly is not directed at children and is intended for users aged 16 and over. We do not knowingly collect data from children. If you believe a child has used Brievly, contact us and we'll remove the data.

If we change how we handle your data, we'll update this page and, for anything significant, let you know in the app. The date below always reflects the current version.

Questions about your privacy, or anything in this policy? Write to support@brievly.app — a real person will read it.