Brainjuice Privacy Policy
This Policy explains how Aether Technologies UG (haftungsbeschränkt) processes personal data when you use Brainjuice, our websites at brainjuice.app and related app services.
Last updated: 22 July 2026
Privacy at a glance. This summary highlights the key points. The full policy below gives the complete details.
1. Controller and contact
The controller responsible for your personal data is:
Aether Technologies UG (haftungsbeschränkt)
c/o CODE Education GmbH
Donaustraße 44
12043 Berlin
Germany
Represented by its CEO Victor Bellu.
Privacy contact: support@brainjuice.app.
We have not appointed a data protection officer because we are currently not legally required to do so. Please use the privacy contact above for any privacy questions or requests.
2. What data we process
We process different data depending on which app features you use.
| Category | Examples | Why we use it |
|---|---|---|
| Account and login | Email address, name, phone number if provided, profile picture, authentication provider user ID, anonymous auth ID, sign-in provider data, app-integrity tokens. | Create and secure your account; provide login and app-integrity protection. |
| Learning and app use | Viewed content, quiz/progress data, likes, watch events, preferences, skill signals, app settings and session/device identifiers. | Provide the app, save progress, personalize recommendations and improve the product. |
| Device and technical data | Device model, OS/app version, language/locale, time zone, calendar/time format, push tokens, IP address and approximate location. | Operate the app, send optional notifications, diagnose issues and protect the service. |
| Voice input | Microphone audio and transcript when you use voice features. | Transcribe your voice request. Audio may be sent directly from your device to a third-party speech-to-text provider. |
| Uploads and user content | Profile photos, camera/gallery images, uploaded PDFs and extracted text, prompts, searches, URLs, YouTube links, chat messages, profile text, ratings and votes. | Use your materials as learning sources, generate AI content and operate chat/tutor features. |
| Subscriptions and purchases | App user ID, subscription/purchase status, product and transaction IDs, platform receipts, entitlement/wallet data, IDFA/IDFV after ATT consent. | Manage subscriptions, entitlements, refunds, trials, conversion logic and accounting. We do not receive card details. |
| Analytics, crash and quality | Pseudonymous IDs, events, behavior data, device/app metadata, crash/error data, stack traces, AI traces and session-replay recordings. | Understand usage, fix bugs, monitor AI quality, secure the app and improve performance. |
| Marketing attribution | Attribution provider ID, device/install data, IDFA after ATT opt-in and SKAdNetwork postbacks. | Measure campaign performance and install attribution. |
| Website and web checkout | Onboarding answers and progress on our website, cookie/localStorage identifiers, ad click IDs (e.g. ttclid, rdt_cid), IP address and browser data, email address at sign-in or checkout, and purchase/subscription details from web checkout. | Provide the web onboarding, process web subscriptions, connect your web purchase to your Brainjuice account and measure ad performance. See section 8. |
3. Purposes and legal bases
Under the GDPR, each processing purpose needs a legal basis. The main bases are:
| Processing purpose | Legal basis |
|---|---|
| Account, login, core app functions, learning progress, subscriptions, uploads, chat/tutor and AI generation | Performance of contract — Art. 6(1)(b) GDPR |
| Product analytics, crash diagnostics, observability, security, abuse prevention and product improvement | Legitimate interests — Art. 6(1)(f) GDPR |
| Push notifications, App Tracking Transparency, IDFA-based attribution and consent-based tracking | Consent — Art. 6(1)(a) GDPR |
| Website advertising measurement and conversion tracking with advertising partners | Consent where legally required — Art. 6(1)(a) GDPR and § 25 TDDDG; otherwise legitimate interests — Art. 6(1)(f) GDPR |
| Tax/accounting retention for transaction records | Legal obligation — Art. 6(1)(c) GDPR |
4. Service providers and recipients
We use service providers and platform providers to operate, secure and improve the app. These recipients process personal data only for the purposes described in this Policy, unless they act as independent platform controllers for their own services, such as app-store payment processing.
We disclose personal data to the following categories of recipients:
| Purpose | Categories of recipients | Location | Transfer safeguards |
|---|---|---|---|
| Account, login, app integrity and push | Authentication, app-integrity and push-notification providers | USA/global | DPF and/or SCC where applicable |
| Backend, database and app infrastructure | Cloud hosting and managed-database providers | Mainly EU-hosted | Where access or subprocessing from outside the EEA occurs, appropriate transfer safeguards apply |
| Media storage and video rendering | Cloud media-storage and rendering providers | USA/global | DPF and/or SCC where applicable |
| Analytics, session replay, crash reporting and observability | Product-analytics, session-replay, crash-reporting and observability providers | Mainly EU-hosted | Where access or subprocessing from outside the EEA occurs, appropriate transfer safeguards apply |
| Subscriptions and payments | Subscription-management and app-store payment providers | USA/global | DPF and/or SCC where applicable; app stores may act as independent controllers for platform/payment processing |
| Marketing attribution | Mobile-attribution and ad-measurement providers | EU/EEA, countries with adequacy decisions, and USA/global | Adequacy decisions, DPF and/or SCC where applicable |
| Website advertising and conversion measurement | Advertising platforms: TikTok (TikTok Technology Limited, Ireland) and Reddit (Reddit, Inc., USA). See section 8. | EU and USA/global; TikTok group companies may access data from other countries, including China | Standard Contractual Clauses (SCC) |
| Web checkout and payments | Stripe (payment processing; a Stripe affiliate acts as merchant of record for web purchases). See section 8. | USA/global | DPF and/or SCC where applicable |
| Speech, OCR and AI features | Speech-to-text, OCR and AI content-generation providers | EU and USA/global | DPF and/or SCC where applicable |
You may contact us if you would like more information about the recipients or transfer safeguards relevant to your data.
5. International transfers
Core structured user and content data, backend compute and the main databases are processed mainly in the EU. Some services, including media rendering/storage, speech-to-text, subscription infrastructure, push delivery, marketing attribution and several AI providers, may process data in the USA or globally.
Where personal data is transferred outside the European Economic Area, we rely on safeguards such as the EU-US Data Privacy Framework for certified providers and/or Standard Contractual Clauses, together with additional safeguards where required.
Our website advertising partners TikTok and Reddit process data in the USA and globally on the basis of Standard Contractual Clauses. TikTok group companies may have access to data from other countries, including China.
6. Storage periods
| Data | Typical retention |
|---|---|
| Account, profile, learning progress, chat and user content | Usually until account deletion or until the data is no longer needed for the app. |
| Payment and transaction records | As required for accounting and tax retention, generally up to 10 years. |
| Crash and error reporting | Provider default: about 90 days. |
| Session replays | Provider/default configuration: about 30 days. |
| Push and device tokens | Until opt-out, stale-token cleanup or account deletion. |
| Provider logs and AI/API processing | According to provider defaults and commercial API settings, unless a shorter period is configured. |
| Ad click IDs stored on our website | Up to 28 days in your browser. |
| Event data shared with advertising platforms | According to the platform's policy; for TikTok event data, a maximum of 18 months. |
We may keep data longer where required to establish, exercise or defend legal claims, comply with legal obligations, prevent abuse or resolve security incidents.
7. Your privacy rights
Subject to the conditions under the GDPR, you may have the following rights:
- Access to your personal data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure/deletion where the legal requirements are met (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Objection to processing based on legitimate interests (Art. 21 GDPR)
- Withdrawal of consent at any time with effect for the future (Art. 7 GDPR)
- Complaint with a data protection supervisory authority (Art. 77 GDPR)
To exercise your rights or request account/data deletion, contact us at support@brainjuice.app. If the app provides an account deletion function, you may also use that function. Some data may remain where we must keep it for legal reasons, such as tax and accounting records.
8. Tracking, cookies and advertising
On our website
Our website at brainjuice.app, including the web onboarding at brainjuice.app/start, uses cookies and similar technologies (including localStorage) to run the onboarding and to measure how our ads and the onboarding perform. When you arrive through an ad, we store the ad click ID (for example ttclid for TikTok or rdt_cid for Reddit) in your browser for up to 28 days and attach it to conversion events.
We work with the advertising platforms TikTok (TikTok Technology Limited, Ireland) and Reddit (Reddit, Inc., USA). We share website events (for example starting the onboarding, viewing checkout or completing a purchase, including the purchase value) together with a hashed (pseudonymized) version of your email address and user ID, your IP address, browser information and the ad click ID. This sharing happens both through on-page tools (pixels) and directly from our servers (conversion APIs). The platforms use this data to measure ad performance and to improve and target advertising, including for their own purposes as described in their privacy policies.
For the collection and transmission of this data and for measurement reporting, we and TikTok are joint controllers under Art. 26 GDPR. TikTok's Joint Controller Terms allocate responsibilities between us: we provide this notice, and TikTok handles requests concerning data it holds, so you can also exercise your privacy rights directly against TikTok. Reddit processes the event data it receives as an independent controller. For details, see the TikTok Privacy Policy and the Reddit Privacy Policy.
You can limit or object to this tracking: block or delete cookies and site data in your browser settings, use your browser's tracking protection, and manage ad personalization in your TikTok and Reddit account settings. You can also object to this processing or exercise your privacy rights with us at any time via support@brainjuice.app.
Web checkout
Purchases on our website are processed by our payment provider Stripe; a Stripe affiliate acts as merchant of record and processes your payment and billing data. We do not receive your full card details. Stripe also processes payment data for its own purposes, such as fraud prevention, security and legal compliance; see the Stripe Privacy Policy. We use the email address from checkout to link your purchase to your Brainjuice account so that your subscription is available in the app.
In the app
For iOS App Tracking Transparency, IDFA-based tracking and marketing attribution, we ask for consent where required. This includes attribution through a mobile-attribution provider and Apple SKAdNetwork, including SKAN postbacks involving third-party ad networks. You can change tracking permissions in your device settings.
Push notifications are optional. You can disable them in your device settings or in the app where available.
9. AI features and automated decisions
The app uses AI services to generate or prepare learning/content materials, transcribe or synthesize audio, process PDFs and other inputs, support chat/tutor features and personalize recommendations. Inputs may include prompts, search queries, uploaded PDFs, URLs, YouTube links, chat messages and preference or learning signals.
We do not use the app to make solely automated decisions that produce legal effects or similarly significant effects for you within the meaning of Article 22 GDPR. AI-generated content may be identified or labelled as AI-generated where applicable.
10. Children and minimum age
The app is intended for users who meet the minimum age stated in the relevant app-store listing, in the app or under applicable law. If you are under 16, use the app only with parental consent where required by law. If we learn that a child has used the app without required consent, we will take appropriate steps, which may include deletion of the relevant data.
11. Changes to this Policy
We may update this Policy when our services, providers or legal requirements change. If changes are material, we will take reasonable steps to notify you, for example in the app or by another appropriate method.