Privacy Policy

This Policy explains how we collect, use, share, and protect your personal data when you use the Brogress mobile application and the brogress.app website. It is provided in accordance with Articles 12, 13, and 14 of the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

§ 01Who we are

The data controller responsible for processing your personal data is:

We have appointed an external Data Protection Officer (Art. 37 GDPR) to oversee our handling of personal data:

For any privacy question — including requests to access, correct, port, or delete your data, or to withdraw consent — please email hello@brogress.app or contact our DPO directly. We will respond within 30 days as required by Art. 12(3) GDPR.

§ 02Scope of this Policy

This Policy applies to personal data we process when you use the Brogress mobile application on iOS or macOS (the “App”) and when you visit brogress.app (together, the “Service”). Brogress is a self-development app that uses an AI-powered “coach” to help you set goals, reflect on yourself, and build daily habits.

§ 03Personal data we collect

We only collect what we need to operate the Service. Below is a complete list, grouped by category.

3.1 Account data

When you sign in with your Apple ID via Sign in with Apple, we receive and store:

• An opaque, app-specific Apple user identifier
• Your email address (this may be your real address or an Apple “private relay” address — your choice when signing in)
• Your given and family name (only on first sign-in; editable later)

In the App you may additionally provide:

• A display name and a public handle (username)
• Your birthday. We use it to check you meet our minimum age requirement, to work out your age for the calorie suggestion described in § 3.16, to estimate your maximum heart rate if you train with heart-rate targets (§ 3.18), and — on the day itself — to let the friends you have added know it is your birthday. The day and month, never the year, appear in your friends’ activity feed
• Your gender (optional; used to tailor self-reflection items where these differ)
• Your height and weight, used for the calorie and protein suggestion (§ 3.16), and your maximum and resting heart rate if you have measured them, used for the training zones in § 3.18. All optional, and each of them only because a number of your own makes a suggestion or a target yours rather than everyone’s
• Your time zone
• A push-notification device token, if you allow notifications, so we can send reminders

3.2 Self-reflection responses (sensitive)

Brogress includes self-reflection assessments — sets of multiple-choice and free-text questions that draw on established psychological frameworks (for example, the Schwartz Personal Values questionnaire and Big-Five-style personality items). Your responses are stored, mapped to internal “six pillar” scores (Heart, Iron, Edge, Flow, Vault, Brain), and used by the coach to personalize its conversations with you.

Because these responses can reveal information about your personality, values, and emotional patterns, we treat this data as sensitive and process it only on the basis of your explicit consent, which you give before completing each assessment.

3.3 Coach conversations and the “private notes” section (sensitive)

When you talk to the coach inside the App, we store:

• Every message you send (including text transcribed from voice — see § 3.8)
• Every reply the coach generates
• Internal “state” updates the coach makes — points awarded, missions completed, achievements unlocked, edits to the coach’s notes about you

We also maintain a coach profile file about you with six sections: persona, hard rules, your stated preferences, coaching style, durable life-context notes (e.g. your job, where you live), and an internal “private notes” section.

3.4 Goals (WOOP)

For each goal you set, we store the four WOOP components — your Wish, the imagined Outcome, the Obstacle (often something internal, e.g. “I procrastinate when I’m anxious”), and your Plan — together with the goal’s status, history, and the conversational elicitation that produced it.

3.5 Missions, achievements, points, breathing sessions

We store the missions you take on (daily and one-off), the achievements you unlock, every point allocation event with the coach’s reasoning attached, and basic metadata for each breathing exercise you complete (technique, length, score, time of day).

3.6 Knowledge graph (sensitive)

As you talk with the coach, it builds a structured knowledge graph of the people, places, employers, hobbies and goals you mention, so that it can refer back to them in later conversations. This graph is stored in Microsoft Azure (Sweden) and partitioned by user — it is not shared between users.

3.7 Social data

If you use friend, challenge, or leaderboard features, we store:

• Your friends list and pending friend requests
• Blocks you set, and reports you submit (and reports submitted about you)
• Challenges you set up with friends and their state
• Activity-feed entries (achievements, milestones, streaks) that are visible to your friends
• Comments you post on photo posts in the feed (see § 3.15), and the “Respect” reactions (likes) you give to posts and to comments

What becomes visible to a friend. When you add a friend, your handle, level, total points, current streak, your six pillar scores, and your profile picture (if you have uploaded one — see § 3.13) become visible to that friend in the in-app leaderboard and friend list. If you don’t want a friend to see this information, remove them or block them.

The photo feed is not friends-only. Unlike the activity-feed entries above, photo posts in the feed can come from any Brogress user — what you see is governed by the visibility the poster chose for each photo (see § 3.15). Your own photo posts are likewise shown to other users according to your per-photo visibility choice, and the Respects and comments you leave on a post are visible to everyone who can see that post.

3.8 Voice

If you record a voice debrief, the audio is transcribed on your device using Apple’s on-device speech recognition. Only the resulting text leaves your phone; the audio itself is never sent to our servers or to any third party.

3.9 Technical / log data

When you use the Service, our servers record:

• The IP address you connect from
• Your device and operating-system type
• Date, time, and details of each request
• Truncated content (first 500 characters) of coach messages, for debugging and quality monitoring

These logs live in Microsoft Azure Application Insights (Sweden Central) and are retained for approximately 90 days, after which they are deleted automatically.

When an error occurs while processing your request, the resulting log line may include your account ID so we can reproduce and fix the problem. We do not enrich logs with your account ID for routine (non-error) requests, and we do not attach it as a structured telemetry dimension — it appears only as text in the body of error messages emitted by our backend code.

3.10 Crash and error reports

If the App crashes or hits an unexpected error, we send a description of the error to Sentry GmbH (de.sentry.io, hosted in Germany). We have configured Sentry not to send your user ID; however, an error message can occasionally include short fragments of text from a server response if our backend ever returns user content inside an error.

3.11 Subscription data

Brogress uses Adapty (Adapty Tech Inc.) as its subscription-management platform. The Adapty SDK is initialized at app launch and, once you sign in, is linked to your Brogress account ID so entitlement checks can route correctly. Through Adapty we and Adapty process:

• The Apple identifierForVendor (IDFV) — a per-vendor identifier scoped to apps from us; it is not the cross-app advertising identifier (IDFA), which we do not access
• Apple App Store and (in future) Stripe purchase events — product, price, country, transaction state, renewal status
• Paywall interactions — which paywall variant you saw, whether you started or completed a purchase, restores
• The Adapty profile ID, mapped to your Brogress user ID

Free-plan usage counter. Independently of Adapty, we count how many AI-coach debriefs you have started (the debriefs_used_lifetime counter on your account) so the app can enforce the lifetime free-plan limit before a paid subscription unlocks unlimited usage. This counter is processed on the contractual basis (Art. 6(1)(b) GDPR) and is purged with everything else when you delete your account.

3.12 What we do NOT collect

For the avoidance of doubt, the App does not access:

• Your contacts, calendar, or motion data; nor your photo library at large — when you choose a profile picture, iOS’ system PhotosPicker hands us only the single image you select, and the App never receives photo-library permission. See § 3.13. (Apple Health access is opt-in — what we read, what we can write with your permission, and where it goes, is described in § 3.16.)
• Your location. This needs a precise statement rather than a place on this list, because the App does ask for location — and we do not receive it. If you start an outdoor run or ride in the App's workout player, iOS asks your permission and the App then reads your position while that workout is running, to draw your route on the map, measure your distance and pace, and speak your split times. That is the only feature that uses it, and it stops when the workout does. Your route never leaves your iPhone. It is drawn on your screen and, if you have allowed it, written into Apple Health — and what reaches our servers when you finish is the summary only: distance, duration, average pace or speed, and per-kilometre split times. No coordinates, no route, no map. You can decline the permission and still use the player; it then measures nothing but time.
• Any data through advertising, attribution or cross-app tracking SDKs in the mobile App (Firebase, Adjust, AppsFlyer, Branch, Segment, Google Analytics, etc. — we use none of these inside the App). Three analytics tools are used, each for a stated purpose and each described here: PostHog records how you move through the App (§ 3.19); Adapty processes IDFV and product-interaction events for subscription analytics (§ 3.11 and § 5); and the brogress.app website uses Google Analytics 4 with opt-in consent only (§ 16). None of the three receives advertising identifiers, and none is used to track you across other apps or websites
• Any data through advertising SDKs — we serve no ads and use no ad SDKs
• The Apple advertising identifier (IDFA) — we have not implemented App Tracking Transparency and do not request it

3.13 Profile picture (optional)

In Profile › Settings › Edit Profile › Profile picture you may upload an image that will be displayed next to your handle on the profile screen, the leaderboard, the friends list, and friend-request cards inside the App. Uploading a picture is entirely optional — without one, we render a coloured circle containing the first letter of your display name.

What happens when you upload:

• iOS’ system PhotosPicker presents your photo library out-of-process and hands the App the bytes of the single image you selected. The App is never granted general photo-library permission and cannot read any other photo.
• Our backend re-encodes the image as a centred, square-cropped, 512×512 JPEG. The re-encode intentionally discards every EXIF metadata field, including any GPS coordinates that your phone may have embedded when the photo was taken.
• The processed image is stored in a separate, private Azure Blob Storage container named brogress-avatars in Sweden Central. Anonymous public access is disabled at the storage-account level. When the App needs to display your picture next to your handle, our backend serves a URL that includes a long-lived, read-only Shared Access Signature (SAS) scoped to that single container — the same pattern we use for the App’s static character and achievement artwork. The SAS lets the iOS image cache fetch your picture without each individual request being authenticated by your account, while keeping the underlying blob storage closed to the public internet.
• You can replace the picture at any time, or remove it via Profile picture › Remove photo. Removal deletes the blob and reverts the in-app rendering to the initial fallback.
• To deter abuse, profile-picture changes are limited to ten per account per day.
• On account deletion, the avatar blob is purged together with the rest of your data — see § 8.

3.14 Feedback you send us

If you choose to send us suggestions, ideas, feature requests, bug reports, or other feedback about the Service — for example by emailing hello@brogress.app — we store the message you sent and the email address it was sent from. We use feedback to improve the Service and may quote anonymised excerpts internally or in product communications. We do not publish your name, email address, or any other identifier alongside feedback without your separate consent. The same retention and security commitments described in § 8 and § 11 apply. The Terms of Service grant us a perpetual, royalty-free licence to use Feedback for any purpose (see § 17 of the Terms); this Policy governs how any personal data contained in Feedback is processed.

3.15 Mission proof photos and the photo feed

Daily missions can be completed with a proof photo taken with the camera inside the App. If you use this feature, we store for each photo:

• The photo itself, re-encoded as a JPEG. As with profile pictures (§ 3.13), the re-encode intentionally discards every EXIF metadata field — including any GPS coordinates your phone may have embedded — before the image is stored.
• The time the photo was taken and the mission and day it belongs to
• The visibility you chose for the photo, and the per-mission feed setting described below

Proof photos are stored in a private Azure Blob Storage container in Sweden Central, with anonymous public access disabled at the storage-account level. They are served via read-only Shared Access Signature (SAS) URLs — the same pattern described in § 3.13 — while the underlying blob storage stays closed to the public internet.

Who can see a proof photo. You choose each photo’s audience at the moment you take it — Everyone, Friends, or Only me. The default is Everyone: unless you choose otherwise, the photo appears in the App’s photo feed, where it can be seen by any Brogress user together with your display name, handle, profile picture, and the mission’s title. Photos set to Friends are visible only to your accepted friends; photos set to Only me never appear in the feed. You can additionally exclude an entire mission from the feed (per-mission feed opt-out); this setting overrides the per-photo choice and removes that mission’s photos from the feed for everyone.

Automated safety scanning. Before a proof photo is stored, it is scanned automatically by Azure AI Content Safety (Microsoft — see § 5) for sexual, violent, and self-harm imagery. Photos the scan classifies above our severity threshold are rejected and never stored — you can simply retake the photo. No human reviews your photos unless another user reports the related post; see § 10 for the automated-decision disclosure.

Interactions and controls. Other users can react to a feed post with a “Respect” (like) and write comments — in each case only within the visibility you chose (see § 3.7). You can block any user — blocking hides your posts from them and their posts from you — and you can report any post or comment. When a post or comment is reported, we preserve a server-side snapshot of the reported content (the photo, the mission title and day, the upload timestamps, and the reported comment, if any) as evidence, so that we can review the report even if the content is later removed.

Deletion. A proof photo is deleted when you remove the day’s completion for that mission, when you delete the mission, or when you delete your account (see § 8).

3.16 Apple Health data (optional)

You can link a daily mission to Apple Health so the App ticks it off automatically when your Health data shows you’ve hit it — for example a “Steps” mission completing once you reach 10,000 steps. This is entirely optional: it only happens for missions you explicitly link, after you grant permission in the iOS Health permission sheet, and you can turn it off at any time per mission or in iOS Settings › Health › Data Access & Devices.

What we read. The specific Health data types tied to the missions and training sessions you link, drawn from four groups:

• Activity — steps, walking/running, cycling and swimming distance, flights climbed, active energy, exercise minutes, time in daylight, water, and mindful minutes; plus the dietary energy (calories) recorded in Apple Health, read back to show your daily nutrition summary on your device.
• Body measurements & vitals — body weight, lean body mass, body-fat percentage, height, blood glucose, and blood pressure.
• Workouts — the workout type (for example run, strength, or cycling) and its start time and duration, used to match and confirm the training sessions you plan in Brogress.
• Sleep & recovery — nightly sleep analysis (how long you slept and how long you were in bed), resting heart rate, and heart-rate variability (SDNN). Read only if you turn on the separate sleep & recovery sharing described below, which is off by default.

If you allow it in the iOS Health permission sheet, the App can also write to Apple Health: the workouts you finish in the App, the meals you log and — if you enter them — your height and weight, so your data stays in one place. You control each direction per data type in iOS Settings › Health.

Where your Health data goes depends on the type.

• Activity metrics (steps, energy, distance, exercise minutes and similar cumulative measures) are compared against your goal on your iPhone. Only the resulting completion — the same “done” checkmark you would tap yourself — syncs to our servers; the underlying readings stay on your device.
• Body measurements & vitals (body weight, lean body mass, body-fat percentage, height, blood glucose, blood pressure) sync to our servers as dated readings when you link a measurement mission, so your goal can chart the trend over time. These numeric values leave your device, are stored against your account, and are purged when you delete it.
• Workouts. When you connect workout capture, the type and completion status of a workout that matches a session you planned (for example “easy run — done”) sync to our servers to tick that session off, and this type-and-status summary may be shared with our AI provider (see § 6) to tailor the coach’s guidance. Its duration is stored with the session too, so the App can show what you actually did. Every other numeric detail of the workout — heart rate, pace, distance, cadence and the like — never leaves your device, and your heart rate is never sent to the coach.
• Sleep & recovery (separate opt-in, off by default). If you turn on sleep & recovery sharing in the App, four daily values — how long you slept, how long you were in bed, your resting heart rate, and your heart-rate variability — sync to our servers once a day so Brogress can propose adjustments to your training plan (for example “rough night — move today’s session?”). Every such proposal is confirm-only: the App never changes your plan without your explicit approval. We receive daily totals only — never the underlying samples or intraday curves — and these values go to Brogress alone: they are never shared with our AI provider, and the coach never sees the numbers. Turning the toggle off stops the stream and deletes the sleep and recovery values already stored on our servers.

We process Health data (special-category data) solely on your explicit consent (Art. 9(2)(a) GDPR): you give it in the iOS Health permission sheet and, for the workout-to-coach sharing and the sleep & recovery sharing, in the App’s own consent screens. You can withdraw at any time in the App’s privacy settings or by turning off Brogress’s access in iOS Settings › Health › Data Access & Devices — which stops all further capture — or by deleting your account. Withdrawing sleep & recovery sharing additionally deletes the daily values already stored on our servers. Otherwise withdrawal is forward-looking: it does not retroactively remove context already shared in past coach conversations.

3.17 Community poll ballots

From time to time we put a product decision to the Brogress community and ask you to vote in the App. Voting is entirely voluntary and nothing in the App is withheld from you if you do not.

What we store. While a poll is open we store which option you chose, linked to your account, so that you can change your mind or withdraw your vote. When the poll closes we save only the totals — how much weight and how many people each option received — and delete every record of who voted for what. The totals that remain cannot be traced back to any individual.

How your vote is weighted. Votes are weighted by the points you have earned in the past year. We use the square root of that figure, so a much larger point total does not translate into a proportionally larger say, and everyone who votes counts for at least one. We do not read any other data about you to work this out.

Please note that while a poll is open your ballot is linked to your account in our database and is therefore visible to us. It stops being so when the poll closes. We do not describe this as a secret ballot, because until the poll closes it is not one.

3.18 Training numbers you enter yourself

Some numbers only make sense if they are yours. Alongside your height and weight (§ 3.1), the App lets you enter your maximum heart rate and your resting heart rate if you have measured them, and it stores the current 5 km run time you tell it or measure with it.

What we do with them. They are used to show you personal targets — heart-rate zones and pace ranges on your own screen, derived from your number each time a screen is drawn rather than stored again. Each zone is worked out from the range between the two heart-rate numbers, so both matter: if you have not entered a maximum, we estimate one from your birthday (§ 3.1) using a standard age-based formula, and if you have not entered a resting rate we assume a typical one. You can replace either estimate with your own figure, or clear yours to go back to the estimate, at any time in the App’s profile settings.

What we do not do with them. Neither heart-rate number is ever shared with our AI provider — the coach does not see them, your zones, or any heart-rate reading at all (§ 6). Your 5 km time is different, and we say so plainly: if you have a running goal and no time on file, the coach may ask you for it once in conversation, so that question and your answer pass through our AI provider like the rest of the chat (§ 6). None of these numbers is ever derived from a sensor on its own — we only store a figure you entered, or one measured by a workout you started in the App. A reading from a chest strap or a watch never becomes your stored maximum or resting rate by itself.

Filling the resting rate from Apple Health. If you have turned on sleep & recovery sharing (§ 3.16), which is off by default, the App offers a button beside the resting-heart-rate field that copies the most recent resting heart rate Apple Health already holds for you. This reads nothing new: it is the same value, from the same permission, that the sleep & recovery feature already reads each day. Nothing is copied unless you tap the button; the number then sits in the field where you can see it, change it, or clear it; and if a figure is already stored there, we ask you before replacing it. Without that sharing turned on the button is not offered at all, and the field is filled in by hand as before. What we store is still only ever a number you put there.

3.19 How you use the App (usage analytics)

To understand how the App is actually used — where people get stuck in the initial setup, which screens are never found, and which features go unused — we record how you move through the App using PostHog, hosted in Frankfurt, Germany (see § 5). This covers which screens you open, which buttons you tap, how far you get through a multi-step flow, and which version of a screen you were shown when we are testing two designs against each other.

Each record carries your Brogress account identifier, so that we can tell one person’s path through the App from another’s. It does not carry your name, your handle or your e-mail address.

The following are never sent to PostHog, by design and not merely by policy:

• anything you or the coach write — coach messages, goal descriptions, support messages, and the free-text you type anywhere in the App. One narrow exception, and only this one: if you mark a coach answer as unhelpful, we may afterwards show you a short optional box asking why. Answering it is entirely voluntary — you can close it, and nothing happens either way — and what you type there is sent to PostHog, which is told to you on the box itself. It is never shown automatically, never attached to the conversation it came from, and it is the only free text that ever reaches PostHog;
• health values of any kind — sleep, heart rate, weight, height, calories, macronutrients, wellbeing scores;
• your self-reflection and workshop answers (§ 3.2), and any result derived from them;
• voice recordings or transcripts, and location or route data — these never leave your iPhone at all (§§ 3.8, 3.12);
• photos, and anything about a meal you logged;
• any use of the crisis-support screens. Opening them produces no analytics record of any kind, and the App is built so that the absence of a record cannot itself reveal that you opened them;
• any safety limit the App applied to you — for example, if the App declines to set a nutrition or body-weight target because it falls below a safety threshold, that fact is not recorded anywhere outside our own systems.

You can object to this processing at any time, in Settings → Privacy & Data in the App. Your objection is stored on your account, so it survives signing out, reinstalling the App and switching to a new iPhone — and it is applied again automatically every time you sign in. See § 4 and § 9.

An objection also deletes what is already there. We do not merely stop collecting: when you object, we ask PostHog to erase your analytics profile and every event recorded under it, and we keep asking until it is done. Nothing else about your account changes — your plan, your coach and your own data are untouched. This is Art. 17(1)(c) GDPR: once you object to processing based on our legitimate interest and we have no overriding grounds — and for usage analytics we have none — the data has to go, not just the future collection.

3.20 Meals you log (FUEL)

If you use the App’s nutrition features, we store for each meal you log: the name of the food, the amount, the time and day you ate it, the calories and macronutrients (protein, carbohydrate, fat) and, where the source provides them, further nutrient values. We also store how the entry was created — typed by hand, repeated from a previous entry, recognised from a photo, scanned from a barcode, taken from a recipe, or captured during a conversation with the coach.

If you photograph a meal. The photo is sent to our AI provider (Microsoft Azure AI Foundry, EU Data Zone — see § 5) so that the food in it can be identified and the entry pre-filled, and it passes the same automated safety scan described in § 3.15. We ask for your explicit consent before this happens, and we record that consent.

If you scan a barcode. Your iPhone looks the product up directly with Open Food Facts, an open food database run by a non-profit association in France. The request is made by your device, not by our servers, which means Open Food Facts receives your IP address along with the barcode and an identification of the App. We send them nothing else — no account identifier, no name, nothing about your other meals — and the lookup only happens when you scan something. Their data stays in the EU. If you would rather not use it, enter the food by hand instead.

We also look foods up in the USDA FoodData Central database. That lookup is made by our servers, not by your phone, so no information about you reaches it — it never sees your IP address and never learns who asked.

If you share a meal to the community feed. With your explicit consent, the photo, the food’s name and — unless you hide them — its calories and macronutrients are published to the feed together with your display name, handle and profile picture, exactly as described for proof photos in § 3.15. The recipient is other Brogress users, not our AI provider. Deleting the post is how you take it back; a shared post has already left your device.

Meals you log can also be written into Apple Health if you allow it — see § 3.16. Nothing about a meal is ever sent to PostHog (§ 3.19).

3.21 E-mails we send you

If you switch on the weekly progress summary, we send it to the e-mail address associated with your Apple ID (or to your Apple Private Relay alias, if that is what you chose at sign-in). It is delivered through Microsoft Azure Communication Services — the same sub-processor that hosts the rest of our backend (§ 5) — and it contains a summary of your own activity for the week.

Every one of these e-mails carries an unsubscribe link, and you can also switch the summary off in the App’s settings. We do not send marketing e-mails, newsletters or product announcements; if that ever changes, this Policy will say so before the first one is sent.

§ 04How we use your data & legal bases

We process your personal data only on the legal bases set out in Art. 6 (and where applicable Art. 9) of the GDPR.

Where we rely on legitimate interests (Art. 6(1)(f)), you have the right to object to that processing — see § 9.

§ 05Sub-processors and recipients

We use the following carefully selected sub-processors. We do not sell your personal data, and we do not share it with anyone for marketing purposes.

We will update this list before adding any new sub-processor that processes personal data on our behalf. If you would like a copy of any of the data-processing agreements above, please email hello@brogress.app.

In addition to the sub-processors above, we may share your personal data with public authorities (e.g., the German tax office, courts, or police) where we are required to do so by law (Art. 6(1)(c) GDPR).

§ 06What we send to our AI provider

Because this is the data flow most likely to surprise you, we describe it explicitly. Every time the coach replies to you, we send the following to Microsoft’s Azure AI Foundry service (deployed with the EU Data Zone, meaning inference is restricted to Microsoft regions within the European Union):

• Your full coach profile, including the “private notes” described in § 3.3
• Your knowledge graph (people, places, hobbies, goals you have mentioned)
• Your active missions, friends list, and active goals (titles, status, brief previews)
• The type and status of today’s planned or completed training sessions, and — for sessions you logged in the App itself — one summary line each: movements, sets and weight moved for a workout; distance, duration and average pace or speed for a run or ride. Where a workout was matched from Apple Health, its duration is part of that line. We do not send your heart rate, and we do not send any other numeric value read from Apple Health (see § 3.16). The line may also cover a session from yesterday, a count of past sessions you have not confirmed yet, and whether a plan suggestion is waiting for you
• Up to the last 10 messages in your conversation
• Your current message
• Internal protocol rules (what tools the coach may use, etc.)

We do not send: your email address, your IP address, your device token, your account UUID, or any other user’s data.

§ 07International transfers

The vast majority of your personal data is processed and stored within the European Union. Backend storage (PostgreSQL, Blob Storage, Cosmos DB Gremlin, Application Insights) is deployed to Microsoft Azure’s Sweden Central region; the AI coach is deployed with Microsoft’s EU Data Zone, restricting inference to Microsoft regions within the EU; crash reports are processed by Sentry GmbH in Frankfurt. Microsoft may replicate operational backups to other Microsoft data centres within the EU for redundancy.

Three of our sub-processors are based in the United States:

• Apple handles your Apple-ID authentication and routes push notifications. Apple is certified under the EU–U.S. Data Privacy Framework, which the European Commission has determined provides an adequate level of protection (Art. 45 GDPR adequacy decision).
• Adapty Tech Inc. processes subscription and paywall data on our behalf. Adapty is certified under the EU–U.S. Data Privacy Framework, the UK Extension, and the Swiss–U.S. DPF.
• PostHog, Inc. processes App usage analytics on our behalf. Your data is stored in Frankfurt, Germany (PostHog Cloud EU) and is not transferred to the United States for storage; however, because PostHog, Inc. is established in the United States, its staff may access the data from there for support and maintenance. PostHog is certified under the EU–U.S. Data Privacy Framework, and our agreement with them also incorporates the EU Standard Contractual Clauses.

Where any other transfer outside the EEA may incidentally occur (for example, if Microsoft replicates standard backups to a paired region), we rely on the European Commission’s Standard Contractual Clauses (SCCs) (Art. 46(2)(c) GDPR) together with our sub-processors’ supplementary technical and organisational measures.

§ 08How long we keep your data

Account deletion. When you delete your account in Profile › Settings › Delete Account, we purge all of the categories above from our active systems: the relevant rows in our PostgreSQL database, every blob under your user prefix in Azure Blob Storage, your profile picture in the brogress-avatars container, your partition in our Cosmos DB knowledge graph, your Adapty profile (via Adapty’s GDPR delete-profile-and-data API), and we revoke your Apple refresh token. Anything we are legally required to retain is segregated and deleted as soon as the legal retention period expires.

When deletion takes effect. Your account is deactivated immediately — you are signed out and no longer appear to other users — and the purge described above runs automatically about 72 hours later. During that window, signing back in with Apple restores your account intact; after it, the purge is irreversible. The delay exists so that an accidental or regretted deletion can be undone, and it is well within the “without undue delay” standard of Art. 17 GDPR. If you would like your data purged sooner, email hello@brogress.app from the address on your account and we will action it manually.

What survives a deletion, and why. There is one narrow exception to the above. If another user has blocked or reported you, deleting your account does not remove their block or that report — those records exist to protect somebody else, and letting a deletion erase them would mean anyone could clear a block simply by deleting their account and signing up again. So that such a block keeps working if you do return, we attach to it — at the moment your account is purged, and only then — a keyed, irreversible cryptographic hash of your Apple sign-in identifier. Nothing of the kind is stored while your account exists. This hash cannot be reversed into your Apple ID, cannot be used to contact or identify you, is meaningless outside Brogress, and is read only once — at the moment an account is created — to re-apply a block that already existed.

A report someone filed about you is kept the same way, and at the same moment any evidence attached to it is stripped of your data: the account identifier, photo links, mission and food names, and the text of anything of yours that was reported are all removed, leaving only the date and the fact that the report concerned a photo or a comment. Everything else about your account is deleted exactly as described above.

The legal basis is our legitimate interest in protecting our users from harassment and in meeting our platform-safety obligations (Art. 6(1)(f) GDPR), which we consider to override the limited interest in erasing a value that identifies nobody. We keep it for no more than 12 months, and it is deleted sooner in any of three cases: the moment you register again (the block re-applies and the hash is no longer needed, so it is removed), if the person who blocked you deletes their own account, or if they remove the block once you have returned. You can object to this processing under Art. 21 GDPR by writing to hello@brogress.app.

§ 09Your rights under the GDPR

Under the GDPR you have the rights set out below. To exercise any of them, email hello@brogress.app from the address associated with your account; we will respond within 30 days (Art. 12(3) GDPR). Exercising your rights is free of charge.

• Right of access (Art. 15) — receive a copy of your personal data and information about how we process it. We currently provide this on email request; an in-app self-service export is on our roadmap.
• Right to rectification (Art. 16) — correct inaccurate data. Most account fields are editable in the App in Profile Settings; you can also email us for anything else.
• Right to erasure / “right to be forgotten” (Art. 17) — delete your account at any time inside the App in Profile › Settings › Delete Account. This wipes your data from our systems as described in § 8.
• Right to restriction (Art. 18) — ask us to stop using (but keep) certain data while a question about it is being resolved. Email us.
• Right to data portability (Art. 20) — receive your data in a structured, commonly used, machine-readable format. Email us.
• Right to object (Art. 21) — object to processing based on our legitimate interests (Art. 6(1)(f)). The simplest way to fully exercise this right is to delete your account.
• Right to withdraw consent (Art. 7(3)) — where we rely on your consent (assessments, push notifications), you can withdraw it at any time without affecting the lawfulness of processing before the withdrawal. Withdraw consent for assessments by deleting your account; for push notifications, by disabling notifications in iOS Settings or by removing your device token in the App.

Right to lodge a complaint (Art. 77). If you believe we have mishandled your personal data, you can complain to a supervisory authority. The competent authority for our company is:

You may also lodge a complaint with the supervisory authority in the EU Member State of your habitual residence or place of work.

§ 10Automated decisions and profiling

The App computes derived metrics about you — your six pillar scores, your overall level, your point total, suggested challenges, and which achievements to surface — based on your activity. These are automated, but they have no legal effects or similarly significant effects on you, and so Art. 22 GDPR does not apply: they only determine what you see inside the App.

The coach also generates and updates the “private notes” described in § 3.3, which is a form of profiling within the meaning of Art. 4(4) GDPR. The notes are used solely to make the coach’s replies more consistent and personal to you; they are not shared with any third party other than our AI provider, and they have no effects outside the App. You can request a copy of the notes by emailing us.

Automated image rejection. When you take a mission proof photo (see § 3.15), an automated system (Azure AI Content Safety) scans it for sexual, violent, and self-harm imagery before it is stored. If the scan classifies the image above our severity threshold, the upload is rejected automatically, without human involvement. The only consequence is that the photo is not stored and not posted — you can immediately retake the photo. The scan result is not attached to your account and is not used to build any profile of you, and the rejection has no legal or similarly significant effect on you, so Art. 22 GDPR does not apply. No human reviews your photos unless another user reports the related post.

§ 11Security

We protect your personal data with appropriate technical and organisational measures (Art. 32 GDPR), including:

• TLS / HTTPS for all network traffic between your device, our backend, and our sub-processors
• AES-256 at-rest encryption (Microsoft-managed keys) for the databases and blob storage that hold your data on Microsoft Azure
• iOS Keychain for the auth token stored on your device
• Strict access controls on our backend — only authorized personnel and Microsoft sub-processor staff with operational access

We will notify you and the competent supervisory authority of a personal data breach in line with Articles 33 and 34 GDPR.

§ 12Minors

Brogress is intended exclusively for adults. You must be at least 18 years of age to create an account or otherwise use the Service. By creating an account, you confirm that you are at least 18. If we become aware that we have collected personal data from a person under 18, we will delete that data as soon as possible. If you believe a person under 18 is using the Service, please email hello@brogress.app.

§ 13Aggregated and de-identified data

We may aggregate and irreversibly de-identify usage data from across our user base — for example, the distribution of pillar scores, achievement unlock frequencies, completed-debrief counts per cohort, paywall conversion rates, and retention curves — in order to understand how the Service is used, to evaluate features, and to make product decisions. Aggregated and de-identified data is not personal data within the meaning of Recital 26 of the GDPR (or § 1798.140(m) of the California Consumer Privacy Act). We do not attempt to re-identify aggregated data, we do not combine it with personal data after de-identification, and we may retain it indefinitely for the purposes above. We do not sell or share aggregated data for advertising purposes.

§ 14Business transfers

In the event of a merger, acquisition, reorganisation, financing, asset sale, insolvency, or similar transaction, your personal data may be transferred to a successor or affiliated entity. Any such transfer will remain subject to this Privacy Policy, or to a privacy policy that is at least as protective. Where the transfer would materially change how your personal data is processed, we will notify you in the App or by email at least 30 days in advance, and you may delete your account before the transfer takes effect — see § 8 on what happens when you delete.

§ 15US Residents and US state consumer rights

15.1 Who this section applies to

This section provides additional disclosures and rights for residents of the United States, in particular under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) and its 2026 implementing regulations. Parallel rights apply to residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), and Texas (TDPSA); where those laws grant rights that go beyond the CCPA, we honour them. For residents of the European Union, the United Kingdom, and Switzerland, the rights described in § 9 apply instead and are usually broader than those listed below.

15.2 Categories of personal information we collect

Below is the same data described in § 3, mapped onto the categories defined in CCPA § 1798.140(v). For each category we identify the source, the purpose, and the recipients — named sub-processors are listed in § 5.

We retain each category for the periods described in § 8. You have the right to access this data including data older than 12 months, by emailing hello@brogress.app.

15.3 We do not sell or share personal information

We do not sell personal information for monetary or other valuable consideration, and we do not share personal information for cross-context behavioural advertising, as those terms are defined in CCPA §§ 1798.140(ad) and (ah). Brogress runs no advertising, embeds no advertising or analytics SDKs, and does not have advertising or data-broker partners. No “Do Not Sell or Share My Personal Information” opt-out mechanism is therefore required, but if you would like written confirmation of this for your records, email hello@brogress.app with the subject line Do Not Sell or Share.

15.4 We do not use automated decision-making technology for significant decisions

The automated processing described in § 10 (computing your six-pillar scores, awarding points, surfacing achievements, generating coach replies and the “private notes”) determines only what you see inside the App. It does not make decisions that affect your employment, housing, credit, education, healthcare, insurance, or access to essential goods and services, and it does not have any legal or similarly significant effect on you. The CCPA right to opt out of ADMT for significant decisions therefore does not apply; you may nonetheless stop all automated processing at any time by deleting your account.

15.5 We do not run a financial-incentive programme

Brogress charges a flat subscription price (see § 3.11). We do not offer rewards, discounts, free service, or other financial incentives in exchange for the collection, retention, sale, or sharing of personal information. There is therefore no financial-incentive notice to make under CCPA § 1798.125(b).

15.6 Use of sensitive personal information

We use the sensitive personal information listed in § 15.2 only to provide and personalise the contracted Service as described in § 3, § 4, and § 6. We do not use sensitive personal information to infer characteristics about you that fall outside the Service, to target advertising, or for any of the secondary purposes that would trigger the CCPA right to limit (CCPA § 1798.121). The 2026 CCPA regulations classify the contents of messages as sensitive personal information unless the recipient is the intended recipient; the AI coach you converse with is the intended recipient of your messages within the meaning of the regulation, and the contents of those messages are not disclosed to any human at Microsoft except under the limited 30-day abuse-monitoring process described in § 6.

15.7 Your rights as a US resident

• Right to know (CCPA § 1798.110) — what categories of personal information we collect, the sources, the purposes, and the categories of recipients. This information is in §§ 3, 4, 5 and 15.2.
• Right to access (CCPA § 1798.110(a)(5)) — receive a copy of the specific personal information we hold about you, including data older than 12 months (per the 2026 CCPA regulations). Email hello@brogress.app.
• Right to delete (CCPA § 1798.105) — delete your account from Profile › Settings › Delete Account, or by emailing us. The purge is described in § 8.
• Right to correct (CCPA § 1798.106) — most account fields are editable in-app under Profile › Settings; for anything else, email us.
• Right to opt out of sale or sharing (CCPA § 1798.120) — not applicable; we do not sell or share (see § 15.3).
• Right to limit use of sensitive personal information (CCPA § 1798.121) — already limited to the contracted Service (see § 15.6); no further opt-out mechanism is required.
• Right to opt out of ADMT for significant decisions — not applicable; we do not use ADMT for significant decisions (see § 15.4).
• Right to non-discrimination (CCPA § 1798.125) — exercising any of the rights above does not change the price you pay, the features available to you, or the quality of the Service.
• Right to appeal a denied request — email hello@brogress.app with the subject line Privacy Appeal within 30 days of our response.

15.8 Authorised agents

You may designate an authorised agent to submit a request on your behalf. The agent must provide written authorisation signed by you, and we may verify the authorisation directly with you before fulfilling the request. We may deny a request from an unverified agent.

15.9 Verification

We verify your identity by matching the email address you contact us from against the email address associated with your Brogress account. For requests involving sensitive personal information or deletion, we may ask additional questions tied to your account activity (for example, the approximate date of your first debrief, the topic of a recent conversation, or your subscription start date) before fulfilling the request. We will not request more information than necessary to verify identity.

15.10 Response timeline

We respond to verifiable consumer requests within 45 days of receipt, extendable by up to 45 additional days where reasonably necessary, with notice to you, in line with CCPA § 1798.130(a)(2). For requests under the GDPR (EU/UK residents), our response window is one month per Art. 12(3) GDPR (see § 9).

15.11 Annual disclosure metrics

For the preceding 12 months: number of personal-information sales: zero (we do not sell). Number of personal- information sharing transactions for cross-context behavioural advertising: zero (we do not share). We will publish access-, deletion-, and correction-request volumes annually in this section starting with our first full operating year after launch.

15.12 Notice at collection

This Privacy Policy serves as our notice at collection under CCPA § 1798.100(b). We provide the same notice in-App on the Welcome screen before you sign in, and a link to this Policy is available from the App’s settings menu.

15.13 Children’s information

Per § 12, Brogress is for adults aged 18 and over only. We do not knowingly collect personal information from anyone under 18, which exceeds the CCPA threshold of 16 (consent required for sale or sharing) and the COPPA threshold of 13. We do not sell or share personal information regardless of age.

§ 16Cookies and analytics on the website

The brogress.app website uses two categories of storage:

1. Strictly necessary — a single localStorage key (brogress.consent.v1) that remembers your cookie-banner choice, and short-lived cookies the page sets for its own operation (session keep-alive, CSRF). These are exempt from § 25 (1) TDDDG and rest on Art. 6 (1)(f) GDPR (legitimate interest in a functional website).
2. Google Analytics 4 (only after you click “Accept” on the cookie banner) — we use Google Analytics 4 to count visits to brogress.app and identify which marketing channel referred them (the utm_source parameter on your inbound URL). Lawful basis: your consent (Art. 6 (1)(a) GDPR + § 25 (1) TDDDG). You can withdraw your consent at any time via the Manage cookies link in the page footer.

When you have given consent, Google Analytics 4 collects: the page URL, the referring URL, an anonymised IP address (Google truncates the IP before storage and we have IP-anonymisation enabled), browser, OS, and device class, a pseudonymous client identifier stored in a first-party _ga* cookie, and the standard utm_* parameters on your inbound link. We have switched off Google Signals data collection, granular location/device data collection, and ad personalisation signals; data redaction is enabled to strip query parameters that look like personal data. Data retention inside the GA4 property is set to 2 months, the shortest retention period Google permits.

Google LLC (United States) is our processor for the analytics service; the processor relationship and EU–U.S. transfer safeguards (Standard Contractual Clauses + EU–U.S. Data Privacy Framework) are summarised in § 5. The mobile App does not use web cookies and is not covered by this section.

§ 17Changes to this Policy

We will post a new version of this Policy here whenever we make a material change. The “Effective” date at the top reflects the version currently in force. For changes that affect how we use your personal data in a substantial way, we will additionally notify you in the App or by email. For US residents, we will provide notice of material changes to § 15 at least 30 days before they take effect.

§ 18Contact

For any privacy question, request, or complaint: