Privacy Policy

This Privacy Policy explains what personal data we process when you use the Brainer application, the Brainer sync service and this website, and on what basis. Capitalised terms have the meaning given in our Terms of Service.

1. Controller

1.1 The controller within the meaning of Art. 4(7) GDPR is Lukas Pawliczek, Grabenstr. 16, 97816 Lohr a. Main, Germany, info@brainerapp.de. Full provider details are set out in the Imprint.

1.2 We have not appointed a data protection officer; the conditions of Art. 37 GDPR and § 38 BDSG are not met.

2. Use of the Site

2.1 Server logs. Each request is recorded with the requested address, the time, the HTTP status, the number of bytes transferred, the user agent and the IP address. Purpose is delivery of the Site, fault diagnosis and defence against attacks; legal basis Art. 6(1)(f) GDPR. Entries are deleted after seven days.

2.2 Measurement. Page views are counted on our own server. No external service is used and no cookie is set. Recorded per day are the page path, the referring domain (the domain only, never the full address) and clicks on a download link. To distinguish visitors from page views we derive a twelve-character hash from the IP address and a random value that is replaced every night; the IP address itself is not stored in these figures and the hash cannot be resolved the following day. Only daily totals are retained, for 120 days. Legal basis Art. 6(1)(f) GDPR; our legitimate interest is knowing whether the Site is used.

2.3 Storage on your device. Two things are written to your browser's local storage, and nothing else: that you dismissed the notice at the foot of the Site, so it does not reappear, and which roadmap or changelog entries you liked (see 2.5), so the button still shows your own likes when you come back. Both stay in your browser; neither is sent anywhere. No access requiring consent under § 25 TTDSG takes place, as both are strictly necessary for a function you asked for.

2.4 Downloads. Installation files are served from our own server. A request produces a server log entry under 2.1; no third party is involved.

2.5 Likes on the roadmap and changelog. Each entry has a button you can press to say that it matters to you. We store a counter per entry and nothing else — no account, no identifier, no record of who pressed what. To stop the same person counting twice on the same day, we derive a short hash from the IP address and a random value that is replaced each day; the address itself is never stored, and the hash cannot be resolved the following day. Pressing again takes your like back. Legal basis Art. 6(1)(f) GDPR; our legitimate interest is knowing which plans people actually want.

3. Account data

3.1 Creating an Account transmits your name, your email address and a salted cryptographic hash of your password to our server, together with the version of the Terms you accepted and the time of acceptance. We do not receive and do not store the password itself.

3.2 Legal basis is Art. 6(1)(b) GDPR; without this data an Account cannot be provided.

3.3 When the Software contacts the server it transmits a session token identifying your Account. The server records that the session was confirmed. No browsing behaviour is recorded.

3.4 The data is retained until you delete the Account, which you may do at any time under Profile in the Software. Deletion removes the Account from our server.

3.5 Brainer is not directed at children. Under our Terms of Service an Account may only be created by someone who has reached the age of majority where they live, and we do not knowingly collect personal data from anyone younger. If you believe a child has created an Account, write to info@brainerapp.de and we will delete it.

3.6 The test environment. We run a second, separate copy of Brainer at app.test.brainerapp.de for trying things out before they go live. It has its own database: an Account created there is not the Account you use at app.brainerapp.de, and nothing you write there appears here. The application shows a banner saying so on every screen.

3.7 Everything in this Policy applies to the test environment as well — the same encryption in transit, the same hashed passwords, the same rights under section 11. With one difference you should know about: we delete the test database whenever it suits us, without warning and without keeping a copy. Do not put anything there you would be sorry to lose, and do not reuse a password you use elsewhere.

4. Verification of your email address

4.1 To verify the address we generate a six-digit code and send it to you. For this purpose we store your email address, your name, the code, the time and a one-way hash derived from the requesting IP address, the latter to limit the number of messages that can be triggered.

4.2 The code is deleted once redeemed or expired. The record of a verified address is retained so that the same address is not asked to verify twice.

4.3 Legal basis Art. 6(1)(b) and (f) GDPR.

4.4 The message is dispatched from our own mailbox at info@brainerapp.de. Mail is signed with our own cryptographic key so that recipients can verify its origin.

5. Your Content

5.1 Your Content — your brainstorms, boards, tasks, events and the images you insert — is stored on your own device and, if you have an Account, a copy is kept on our server. The copy exists so that your work survives a lost device and so that you can continue on another one. Legal basis Art. 6(1)(b) GDPR.

5.2 Your personal space stays private. It is never shared and cannot be shared: it carries no invite link, and our server refuses any attempt to invite someone into it, to add a member to it or to join it. No other user can reach it. On what we ourselves can technically reach, see 5.4.

5.3 If you share a space, the contents of that space are also available to the users you invited, for as long as they are members. Legal basis Art. 6(1)(b) GDPR.

5.4 What we can and cannot see. Your Content is not end-to-end encrypted. It is stored on a server we operate, and we therefore have technical access to it. We do not look at it: our administration view shows counts, Accounts and the feedback you send us, and no part of it displays the contents of a space. When we measure how much storage is used, we read the size of the data, not the data. We would access Content only where we are legally obliged to or where you ask us to, for example to help recover something.

5.5 Deleting your Account deletes the copy on our server, including the spaces you own and the images you uploaded. Content you deleted in the app is removed from the server at the next synchronisation. Two things are not part of your Account and outlive it: feedback you chose to send us under your name (see 7.4), and backups made before the deletion, which expire on their own schedule (see 5.6). Write to info@brainerapp.de if you want the feedback gone too.

5.6 Backups. We take a backup of the database once a day. Each one is a complete copy of all Content stored on the server, held on the same machine, readable by the server administrator and not separately encrypted. Backups older than fourteen days are deleted, except that the most recent one is always kept — so a deleted item can remain in a backup beyond that period if no newer backup has been taken.

5.7 How we protect it. Traffic between the app and the server is encrypted in transit (HTTPS and WSS). Passwords are never stored, only a salted hash. Session and reset tokens are stored as hashes, so the database alone does not let anyone sign in. Access to the server is by SSH key only; password login is disabled. Content is not encrypted at rest, and we do not offer end-to-end encryption — see 5.4.

5.8 How long we keep it. As long as the Account exists. We do not currently delete the Content of inactive Accounts automatically; if we introduce such a rule, we will announce it here and by mail before it takes effect.

6. AI features

6.1 AI features are off until you enable them. By default processing runs locally on your device (Ollama) and no data leaves it.

6.2 If you select a cloud provider instead — Groq, Google Gemini, OpenRouter or Cloudflare — the text of the brainstorm concerned is transmitted to that provider using your key, and its own privacy terms apply to that processing. Legal basis Art. 6(1)(a) GDPR; you may withdraw by switching the feature off.

6.3 Generating images is different, and this is the one place where we send your input onwards ourselves. If you are signed in and have not entered a key of your own, image generation runs through our server, which passes your prompt and any reference images you attached to Google (Gemini API, Google Ireland Limited) under our own key. This is the default path — you do not choose it, and Google does not learn who you are, only what was asked for. We pass on the prompt and the images, nothing else: not your name, not your email address, not your other Content.

6.4 For 6.3 the legal basis is Art. 6(1)(b) GDPR, since generating the image is the service you asked for. Google processes the request in the United States; the transfer is covered by the EU Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework. If you would rather not use this path, either enter your own key under 6.2 or leave image generation alone — nothing is sent until you ask for an image.

7. Feedback you send us

7.1 Brainer has a form for telling us what you think. Nothing is sent unless you write something and press send.

7.2 We receive your text, the version of Brainer you are running and your operating system. The last two tell us nothing about you and make a bug report usable.

7.3 The form has a checkbox that lets us reply. If you leave it on, your name and email address are stored with your text and we may write back. If you switch it off, neither is stored — not hidden, not stored.

7.4 Legal basis Art. 6(1)(f) GDPR; our legitimate interest is improving the Software. We keep feedback until it is dealt with and delete it at the latest after 24 months. Write to info@brainerapp.de to have yours removed sooner.

8. Statistics about the Service

8.1 The Software counts how often each part of it is opened and how often a handful of actions are performed — for example “a card was created” or “the week view was opened”. Once every few hours, and when you close the application, these counts are sent to our server as a daily total and added to the running total for that day.

8.2 What is transmitted contains no identifier of any kind: no account, no device, no session, no installation ID, no IP address retained, and no time more precise than the calendar day. Two transmissions cannot be recognised as coming from the same person, by us or by anyone else. The names of the countable actions are fixed in the program; the server rejects anything else, so no content, file name or title can ever appear in these figures.

8.3 The counts are held in memory only and are not written to your device. The Software contains no third-party analytics library and no crash reporting.

8.4 Because the result cannot be related to an identified or identifiable person (Art. 4(1) GDPR, Recital 26), it is anonymous and outside the scope of the GDPR. No consent is required under § 25 TTDSG either, as nothing is stored on or read from your device for this purpose.

8.5 In an administration view, reachable only after signing in and only from our own server, we view the number of Accounts, Accounts created per day, the proportion of verified addresses, the number of signed-in devices, the number of Accounts active in the last week, the number of spaces, and how much storage is used — in total and per Account, with the name and email address of the Accounts using the most. The same view lists Accounts with name, email address, date of creation and number of signed-in devices, and the feedback sent to us. It displays no Content: for storage we read the size of the data, never the data itself.

8.6 Legal basis Art. 6(1)(f) GDPR. Deriving statistics from data already held for the performance of the contract constitutes compatible further processing under Art. 5(1)(b) GDPR. The figures are calculated on request and not stored separately.

9. Correspondence

9.1 If you write to the address given in the Imprint, we retain your message for as long as the matter requires. Legal basis Art. 6(1)(b) and (f) GDPR.

9.2 The creator application. The form at /creator-apply.php asks for your name, your email address, the platform you post on, a link to your profile, and what you would like to make. Sending it stores those details on our server, mails them to us, and sends you a confirmation. Nothing is sent until you tick the box and press send.

9.3 Legal basis Art. 6(1)(a) GDPR — the consent you give with that box. We keep an application for as long as the collaboration or its assessment requires; there is no automatic deletion, so write to info@brainerapp.de and we will remove yours. Withdrawing consent does not affect what was lawful before.

10. Processors and international transfers

10.1 Hosting of the Site, the sync service and our mailbox is provided by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, as a processor under Art. 28 GDPR.

10.2 Where you generate images without a key of your own (6.3), Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland acts as our processor under Art. 28 GDPR for that request.

10.3 Processing takes place within the European Union, with two exceptions. The cloud AI providers under 6.2 are ones you select yourself and reach with your own key. Image generation under 6.3 is the one transfer we make on your behalf: Google processes it in the United States, covered by the EU Standard Contractual Clauses and Google's certification under the EU–US Data Privacy Framework.

10.4 We do not sell personal data and do not pass it on for advertising purposes.

11. Your rights

11.1 You have the right to obtain access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20), and to withdraw any consent with effect for the future. An email to the address under 1.1 is sufficient and is free of charge.

11.2 Right to object (Art. 21 GDPR). Where we process your data on the basis of a legitimate interest — the measurement under 2.2, the server logs under 2.1, the likes under 2.5 and the statistics under 8.5 — you have the right to object at any time on grounds relating to your particular situation. We will then cease processing unless we can demonstrate compelling legitimate grounds which override your interests, rights and freedoms.

11.3 You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.

11.4 Providing the data described under 3 and 4 is necessary to create an Account. There is no obligation to provide it; without it, no Account can be created. No automated decision-making within the meaning of Art. 22 GDPR takes place.

12. Changes to this Policy

12.1 We may amend this Policy to reflect changes to the Service or to the law. The version and effective date appear at the top of this page.