Privacy Policy — Bravely Account

One Bravely Account signs you in everywhere we operate — our desktop, mobile, and web apps, the free tools at bravely.dev/tools, and client portals such as brands.bravely.dev. It holds your identity and the record of what you have bought, so a purchase made on one platform unlocks the app on the others. Sign-in is handled by our central authentication system; individual apps never see your password.

• Bravely Account identifier — a server-generated identifier (formatted ba_...) that is the key we use everywhere internally. We use this rather than your email address so your identity is not tied to a mailbox you might change. • Email address — used to identify you, send sign-in codes and receipts, and reach you about your account. • Sign-in method and provider identifiers — whether you use Sign in with Apple, Sign in with Google, or email and password, plus the identifier that provider returns. • Display name — where your sign-in method returns one. • Password — only if you choose email and password. We never store it in readable form; it is salted and hashed by our authentication system. • Email verification state — whether you have confirmed your address. We require verification before a trial, a purchase, or a restore. • Sessions and devices — session records, refresh tokens, approximate sign-in times, app and platform, and coarse device metadata, so you can stay signed in and we can show you and end sessions you do not recognize. • Consent records — whether you accepted our terms at signup, and your marketing choices, with the wording and timestamp of each.

When you buy a Bravely app or start a trial, we record your Bravely Account identifier, the product and plan, the store or checkout that billed you, transaction and subscription identifiers, entitlement status, start and renewal dates, and refund or cancellation events. We keep a per-account record of trials already used so a trial can be offered once per app. We never receive or store your card number, expiry, or security code; those go directly to the payment provider that billed you. Two companies help us keep this record. Our purchase-validation provider, RevenueCat, holds a purchase record for your Bravely Account identifier: it checks App Store and Google Play purchases for us, and we record your trials and your web and desktop purchases with it. The first time you sign in with Apple or Google, and on some other sign-ins, we also send it your email address, your name (when the sign-in provides one), your country and the app you signed in from. When you buy on the web or in a desktop app, our merchant of record, Paddle, takes the payment: if you are signed in, we give it your email address to open the checkout, and otherwise you enter it on Paddle's checkout page. The purchase carries the app it is for, any campaign tags on the link that brought you to checkout, and either your Bravely Account identifier or, for a purchase made before you had signed in, a temporary identifier that we link to your account when you claim the purchase.

We record authentication events (sign-in started, completed, or failed, along with method, app, platform, and timestamp) to operate the account, show you your sessions, detect credential stuffing and abuse, and debug sign-in problems. Some of these records also hold the network address and browser or app details of the request, either as they are or in a one-way scrambled form, and the country it came from. These records are tied to your account identifier when it is known. We also keep a short-lived record of password-reset and email-verification tokens so they can be used once and then expire.

Our account service records the steps it handles, such as signing in, sessions being issued and ended, trials starting and ending, checkouts, and purchases. Each record carries your Bravely Account identifier when it is known and, where available, the app and platform, your country, and the page address, referring page, and browser or app details of the request. We keep these records in our own analytics database and send them to our product analytics provider, PostHog. When our staff change your account for you, for example to grant access you paid for, the record of that change includes your email address. Our apps, and some of our websites and web apps, send usage events of their own, and our websites and web apps can also record how their pages are used, including recordings of what a page shows and the text of what you click. Each app's policy describes what it sends and how to turn it off. These events carry an identifier for the installation or browser they came from, usually a random one, though a few desktop apps derive it from the computer's own identifier, so it stays the same if you reinstall; in most of our apps, once you sign in, they also carry your Bravely Account identifier, and the installation's earlier events are linked to your account, and in some apps its later events stay linked after you sign out. On the web, that identifier is kept in a cookie shared by bravely.dev and our web apps, so once you have signed in to one of our web apps, later events from the same browser on our other sites can carry your account identifier too. On bravely.dev, a first-party cookie kept for up to a year identifies your visit with a random identifier and also holds the first page of that visit and the kind of site that sent you there (a search engine, an AI assistant, a software directory or another site, never its address), and we add these to our records of your downloads, checkouts and purchases so we can see which pages lead to them. A few apps also send your email address with these events, and a few older parts of our service identify you by your email address instead. We use these records to understand how our products are used, to measure trials and purchases, and to find and fix problems. We do not sell them. They are kept without a fixed end date, including after you delete your account, as described below.

We advertise some of our products with ads in ChatGPT, OpenAI's assistant. Those ads link to a page on bravely.dev, such as the Scry page at bravely.dev/scry or the Mac Utility Bundle page at bravely.dev/mac. This section applies only when you arrive from one of those ads. When you do, that page loads OpenAI's measurement pixel so we can tell whether our ads work. OpenAI adds an ad-click identifier to the link you followed. The pixel keeps it in a cookie on bravely.dev for 30 days, sets a second cookie holding a random identifier for your browser that it keeps for up to a year, and reports that you viewed the page. While the ad-click cookie is kept, the pixel also runs on that app's download page and on the page you see right after a checkout. It reports which download you click on these pages (such as the Mac installer, the App Store or Google Play), and, when you start a trial or complete a purchase, the product and plan, the amount and currency of a purchase, and the checkout's transaction reference. OpenAI also receives your network address and browser details with these reports. The pixel also looks for contact details shown or typed on these pages, such as an email address, and sends any it finds to OpenAI only as one-way hashes rather than readable text, to help match the report to the ad. We do not pass OpenAI any contact details ourselves, and the pixel does not load anywhere else on bravely.dev, in our apps, or for anyone who did not arrive from one of our ads. OpenAI uses this to report our ads' results to us and to measure and deliver ads, and it may also use it to improve its own products and services. It processes this data as an independent controller under its own privacy policy. You can stay out of this entirely: • We honor the Global Privacy Control signal automatically. If your browser sends it, the pixel never loads. • Our ads in ChatGPT are shown only in the United States. • You can email privacy@bravely.dev to opt out of sharing; the California section below describes that right.

We use account data to run your account and to understand how our products are used: • sign you in and keep you signed in across your devices • confirm what you have purchased and unlock it everywhere • verify your email before a trial, purchase, or restore • send transactional email such as sign-in codes, receipts, password resets, and account notices • protect the account against fraud, abuse, and unauthorized access • answer your support requests • understand how our products are used, measure trials and purchases, and find problems, as described under "Usage and Purchase Analytics" We do not sell your account data, and we do not build a profile of you for anyone else.

After you create a Bravely Account, Jeff Schiesser, our founder, may send you a short personal email about getting started, such as a welcome note, or a note if you signed up for Scry but have not yet set it up on the computer you want to connect to. These emails are about the account you already have, not marketing, so they are sent whatever you chose about marketing email. They come from jeff.schiesser@bravely.dev and are sent by our email delivery provider, named under "Sub-processors". Some of these emails, such as the welcome email, contain a small invisible image. When your email program loads it, we record that the email was opened, when, the browser or email-program details of the request and a scrambled form of the network address it came from, tied to that email and to you. We use this to count how many people open each version of a subject line, so we can learn which wording works better. Some email programs load images through their own servers, and some load them automatically, so a recorded open does not always mean the email was read. Links in these emails go straight to the page they name, with a tag added that tells us the visit came from that email. If you reply, your reply goes to our support team in our support tool, where the team can see it together with the email you are replying to, and it is kept like any other message to our support team. To stop these emails, reply and ask us to, or email privacy@bravely.dev.

Marketing email is separate from your account and always optional. We ask for it with a checkbox whose default depends on where you are: pre-ticked only where local law allows, and never pre-ticked in the EEA, UK, or Canada. Declining costs you nothing and changes nothing about your account. Transactional messages about a purchase or account you already have are not marketing and are not affected by unsubscribing. When you create an account, we copy your email address, your name (when the sign-in provides one), your country, the app you signed up from and details of the sign-up request into our own marketing and customer-messaging systems, whatever you choose, so that your choice is applied to the right address and we can see how new accounts get started; they send you marketing email only if you agreed to it. The full marketing-email policy is at bravely.dev/privacy/bravely-newsletter.

You can delete your Bravely Account from the settings of our iPhone and iPad apps, Todoing.ly for Mac, and Scry, Todoing.ly and Markd.ly for Android. From any other app or device, email privacy@bravely.dev from the address on the account, as bravely.dev/delete-account explains. Deletion runs on a 30-day grace period: you are signed out immediately and can restore the account by signing back in within those 30 days. When the grace period ends, we delete your email addresses and name from the account and delete from our live systems the sign-in identities linked to it (with the exception for email-and-password sign-ins described below), every session and device credential, your diagnostic reports, and any survey text you typed. We also cancel any subscription you bought on the web or in a desktop app, and delete the content of apps whose policies say it is deleted with your account (today, Markd.ly, PrintScreen.ly and the link pages of the free tools). Our data warehouse keeps its copies of the account's email address, sign-in, session and diagnostic report records with your details removed: each email address becomes the placeholder described below, and the network addresses, browser and device details, and sign-in codes, tokens and keys in them are cleared. What is left, such as when a session started and which app and version it used, stays under your account identifier, like the account record. The account cannot be used again, and a new sign-up with the same address creates a new account with a new identifier. We keep the account's record under its Bravely Account identifier, with a placeholder such as deleted_user_000123 in place of your email address and name, together with its usage events and analytics as they were recorded (including the page address, referring page, and browser or app details of each request), its setup records, its purchase, subscription, trial, and consent history, and its authentication audit records with their network details removed, so that our statistics stay accurate over time and we can meet tax, refund, fraud-prevention, and consent obligations. This record is not anonymous: it keeps your account identifier, and the companies described below still hold your email address with that same identifier. Some copies of your details are not yet removed when the deletion completes: • the contact records in our own marketing and customer-messaging systems, which hold your email address, name, country, and the app you signed up from; deleting your account does not by itself unsubscribe you from marketing email; • if you used an email address and password, that sign-in at our authentication provider, which holds your email address and the protected form of your password; • the email address, name, and country held by RevenueCat; • records of changes our staff made to your account for you, which include your email address. To have these removed as well, email privacy@bravely.dev from the address on the account. Content an app keeps for you, where that app's policy does not say it is deleted with your account, is covered by that app's policy. Copies made before the deletion also stay in our encrypted backups until those backups expire: about four months after each nightly copy is made, or about 13 months for the one copy we keep each month, as described under "Backups" below. After that they are deleted. If we restore data from a backup, we re-apply your deletion, so the restore does not bring your account back. Companies that handled your purchases keep their own records: • Paddle, our merchant of record, is the seller of the web and desktop purchases it handled. It keeps its customer record (your email address and the billing details you gave at checkout) and each transaction, which carries an identifier linked to your Bravely Account, to meet its own tax, accounting, fraud-prevention, and legal obligations. • RevenueCat keeps your purchase and trial history and any App Store and Google Play receipts under your Bravely Account identifier; we keep that history for refunds, accounting, and fraud prevention. • Apple and Google keep their own records of purchases made through the App Store and Google Play. Subscriptions bought through the App Store or Google Play are managed by that store and must be cancelled there; deleting your Bravely Account does not cancel them. We also keep any suppression record needed to honor a prior unsubscribe.

We keep account records for as long as your account exists, and then through the 30-day grace period described above. After deletion, the record described under "Deleting Your Account" stays under your account identifier without a fixed end date, including its usage events, analytics and setup records as they were recorded, its authentication audit records with their network details removed, and the copies our data warehouse keeps of its email address, sign-in, session and diagnostic report records, with your details removed. Purchase, refund, and tax records are kept for at least as long as tax and accounting law requires; we do not currently delete them after a fixed period. Consent and suppression records are kept so we can prove your choices and avoid re-adding you to a list by mistake. Our encrypted backups also keep copies of account records, including copies made before an account was deleted, for about four months, and one copy each month for about 13 months, as described under "Backups" below.

Bravely Account is intended for adults. We do not knowingly create accounts for anyone under 13, and in the EEA, UK, and other places where 16 is the relevant age for information-society services, we do not knowingly create accounts for anyone under 16. If you believe a child has created an account, email privacy@bravely.dev and we will delete it.

We keep backups so that we can recover our customers' data if it is ever lost. Each night we copy the databases that hold accounts, purchases and the content our apps and services keep for their users, including sign-in records and the protected form of passwords, and we copy the files stored with us, such as documents, screenshots and attachments. Unless a section above says otherwise, the account, purchase and content records this policy describes, and the files you store with us, are in these backups. Where backups are kept Backups are kept in two places, both in the United States: on storage equipment that we own, and in Amazon S3, a storage service run by Amazon Web Services. Every copy of a database or of sign-in records is encrypted, with a key that only we hold, before it is stored in either place. The copies of stored files that we keep in Amazon S3 are also encrypted with a key that only we hold, file names included; the copy of those files on our own equipment is not separately encrypted. Amazon does not have our keys, so it cannot read your data in the backups. How long backups are kept Each night's copy of our databases and sign-in records is deleted after 90 days and fully purged within 30 days after that, so it is kept for about four months at most. One copy each month is kept for up to 12 months instead, and fully purged within 30 days after that, so it is kept for about 13 months at most. The backup of stored files keeps each file for as long as it is stored with us; when a file is deleted or replaced, the backup keeps the earlier version for 90 days and then deletes it. Separately, Cloudflare, which runs most of our databases, keeps a recovery history of each of them for 30 days. How backups are used We use backups and that recovery history only to restore data after it has been lost, for example in an outage, through a mistake or in an attack, and we also use backups to test that restoring works. Deleting something, or deleting your account, does not remove it from backups made before the deletion or from the recovery history: those copies stay until they are deleted on the schedules above. If we restore data from a backup or from the recovery history, we re-apply the deletions made after the point we restore to, including account deletions, so that the restore does not bring back data that had been deleted.

Depending on where you live, you have rights over the personal data we hold about you. We honor these rights for everyone who asks, regardless of where you live. • Access — ask what personal data we hold about you and get a copy. • Correction — ask us to fix data that is wrong or incomplete. • Deletion — ask us to delete your personal data by emailing privacy@bravely.dev from the address on your account. Where a product has a built-in Delete Account control you can use that instead; bravely.dev/delete-account explains what applies to each product. • Portability — ask for your data in a portable, machine-readable format. • Objection and restriction — ask us to stop or limit certain processing. • Withdraw consent — where we rely on consent (for example, marketing email), you can withdraw it at any time without affecting processing that already happened. • Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights. EEA and UK residents also have the right to lodge a complaint with your local supervisory authority. California residents may use an authorized agent; we may verify the agent's authority and confirm the request with you first. Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have equivalent rights, including a right to appeal a denied request — reply to our decision email with "Appeal" and we will respond in writing within the period the law requires. Canadian residents have access, correction, and consent-withdrawal rights under PIPEDA; Australian residents have access and correction rights under the Australian Privacy Principles. To exercise any right, email privacy@bravely.dev. We respond within the timeframe the applicable law requires — generally 30 days under GDPR and 45 days under the CCPA, with an extension where the law permits one. We may need to verify your identity before acting, usually by confirming control of the email address on the account.

If you are in the EEA or UK, we rely on these lawful bases under the GDPR and UK GDPR: • Performance of a contract — creating and securing your account, delivering the features you paid for, syncing your content, processing purchases, and providing support. • Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, understanding how our products are used through usage events tied to an installation or to your account, and improving the product. We balance these against your rights and do not use them to justify intrusive tracking. Where an app lets you turn its usage analytics off, doing so is one way to object. • Consent — marketing email, and anything else we ask your permission for before we collect it. You can withdraw consent at any time. • Legal obligation — keeping tax, accounting, and consent records, and responding to lawful requests.

Bravely Studios LLC is a US company. We and our sub-processors process data in the United States and in other countries where they operate. For personal data originating in the EEA, UK, or Switzerland, we rely on appropriate transfer safeguards in our processor agreements — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — where those safeguards are required. Email privacy@bravely.dev if you want more detail about the safeguards that apply to you.

For California residents, the categories of personal information we collect for this product are: • Identifiers — your Bravely Account identifier, email address, and device or installation identifiers. • Commercial information — records of purchases, subscriptions, entitlements, trials, and refunds. • Internet or other electronic network activity — usage events, which carry an installation or browser identifier, your Bravely Account identifier, an identifier for a single request or purchase, or only a shared identifier for the app and platform; app version and platform; crash and error reports; and, if you arrive from one of our ads, ad-click identifiers and the measurement events described in the advertising section above. • Coarse geolocation — a country-level signal derived from your network connection, used for consent rules and tax. • Your content — only the content the product is built to store or sync for you, described in the sections above. We collect this from you, your device, and our own systems, and we use it to run the product, honor what you have bought, keep the service secure, and support you. We disclose it to the service providers listed under "Sub-processors," each for a business purpose under a written contract. We do not sell your personal information. When you arrive at one of our advertising landing pages from an ad, we share limited identifiers with the advertising platform that showed you the ad so we can measure whether our ads work, as described in the advertising section above; under the CCPA and CPRA that measurement may count as "sharing" for cross-context behavioral advertising. You have the right to opt out of that sharing, and you can exercise it at any time: we honor the Global Privacy Control browser signal automatically as an opt-out, and you can also email privacy@bravely.dev. Measurement for our ads in ChatGPT began on September 28, 2026. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit. Retention is described under "Data Retention" and "Backups" above and, for account-level data, in the Bravely Account privacy policy.

We use the following service providers to run this product. They receive only what they need to perform their service for us, and each is bound by the data-processing terms that apply to our use of their service. Where a provider is not yet covered by a written data-processing agreement with us, its entry below says so. If you need a data-processing agreement in place before you use this product, email privacy@bravely.dev: • Cloudflare, Inc.: hosting, the Workers runtime, D1 databases, R2 object storage, and bot protection for bravely.dev and our app subdomains. See cloudflare.com/privacypolicy. • Google LLC: Firebase Authentication, which backs Bravely Account sign-in (including Sign in with Google). See policies.google.com/privacy. • Apple Inc.: Sign in with Apple, and App Store purchase and receipt handling for our Apple platform apps. See apple.com/legal/privacy. • Paddle.com Market Ltd: our merchant of record for purchases made on the web or in our desktop apps. Paddle handles checkout, payment processing, invoicing, and sales tax/VAT. When you open a checkout while signed in, we give it your email address; otherwise you enter it on Paddle's checkout page. Each purchase carries the app it is for, any campaign tags on the link that brought you to checkout, and either your Bravely Account identifier or, for a purchase made before you had signed in, a temporary identifier that we link to your account when you claim the purchase. As the seller of record, Paddle keeps its own records of your purchases. See paddle.com/legal/privacy. • RevenueCat, Inc.: keeps the purchase record for each Bravely Account. It validates App Store and Google Play purchases and reports subscription changes, and we also record trials and web and desktop purchases with it, so we can unlock what you bought on every platform. We identify you to it by your Bravely Account identifier. The first time you sign in with Apple or Google, and on some other sign-ins, we also send it your email address, your name (when the sign-in provides one), your country and the app you signed in from. Some apps also record with it the name of the device you use, and a few older parts of our service identify you to it by your email address instead. See revenuecat.com/privacy. • PostHog Inc.: product analytics. Our apps, some of our websites and our account service send it usage events, such as which features are used and the steps of signing in, starting a trial and buying, and our websites and web apps also send it recordings of how their pages are used. An event carries an identifier for the installation or browser it came from, your Bravely Account identifier, or both (most apps add your account identifier once you have signed in); a few events, such as a failed sign-in or a purchase made before you had signed in, carry an identifier for that one request or purchase instead, and some copies of app events that reach it through our account service carry only a shared identifier for the app and platform. PostHog receives the network address each event was sent from. A few apps also send it your email address, and a few older parts of our service identify you to it by your email address instead. The Bravely Account policy describes this under "Usage and Purchase Analytics". See posthog.com/privacy. • Resend Inc.: sends our transactional email (sign-in codes, receipts, password resets, support replies). See resend.com/legal/privacy-policy. • Amazon Web Services, Inc.: Amazon S3, which stores our backups in the United States, as described under "Backups". The copies of your data that we keep there are encrypted, with a key that only we hold, before they leave our systems, so Amazon cannot read them. See aws.amazon.com/privacy. • Google LLC: Google Play, which distributes our Android apps and handles purchases and subscriptions made in them, including payment and refunds under Google's own terms, and confirms each purchase to RevenueCat, which tells us. See policies.google.com/privacy. • OpenAI OpCo, LLC: advertising measurement for visits that arrive from our ads in ChatGPT. Receives the ad-click and browser identifiers, the page-view, download, trial and purchase events, and any contact details the pixel finds on those pages as one-way hashes, as described in "When You Arrive From One of Our Ads in ChatGPT," only for visitors who came from one of those ads, and processes them as an independent controller under its own privacy policy. See openai.com/policies/privacy-policy. • Amazon Web Services, Inc.: Amazon Simple Email Service, which sends the emails described under "Emails From Jeff" from the United States. It receives your email address, your name when we have it, and the content of each email, and tells us whether it was delivered. See aws.amazon.com/privacy. If we add or change a sub-processor in a way that materially changes how your data is processed, we will update this policy and give additional notice where the law or our data-processing commitments require it.

We protect your data with authenticated accounts, encryption in transit, access controls on our backend systems, and a deliberately small number of people who can reach production. No system is perfectly secure, and we do not claim guarantees we have not built and verified. Where a product makes a specific security claim, that claim appears in the app-specific sections above and is limited to what we have actually shipped. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

We may update this Privacy Policy from time to time. If we make a material change — a new category of data, a new sub-processor, a new purpose, or a new legal basis — we will update the "Last updated" and "Effective" dates and give additional notice where the law requires it. Where a change requires fresh consent under the GDPR, UK GDPR, CASL, or a similar regime, we will ask for it before relying on the new purpose. Non-material changes (typos, clarifications, link fixes) are reflected by updating the "Last updated" date.

Bravely Studios LLC Privacy and data rights: privacy@bravely.dev Product support: support@bravely.dev Website: https://bravely.dev Postal address: available on request to privacy@bravely.dev.