Privacy Policy

What stays on your phone

Braintoll asks for two sensitive Android permissions. Both work entirely on your device:

• Usage access. Reads Android’s app-usage records to notice when a blocked app is open, meter it against your balance, and show you your own history. Processed on your phone and never transmitted — our servers have no place to receive or store it.
• Display over other apps. Only draws the block screen when your balance runs out. Nothing is collected.

Also only on your phone: your blocked-app list, balance, earned-time history, streak, and the list of installed apps (read so you can pick which to block — never uploaded). Uninstalling Braintoll deletes all of it, including unspent credits.

Your account

You need an account to read and take quizzes.

• Email & password: we store your email. Your password is held only as a hash by our auth provider (Supabase).
• Google sign-in: we receive only your email. Your Google name and photo are not imported.
• Display name: you choose it in the app during setup.
• Profile photo (optional): resized on your device, stored in our database.
• Interests: the topics you pick, used to shape suggestions.

Your learning activity

• Quiz attempts: your answers, score and time earned. Grading happens on our server; the answer key never reaches your phone.
• Articles: the ones you open and the ones you save.
• Generation records: which articles triggered AI generation for you, and the computing cost — for accounting.
• Social: follows, completions shared to your followers, and your comments.

What other people can see

• Your display name and photo are effectively public: any signed-in user can find you by name, and your photo is served from a link that needs no sign-in.
• Followers see your completions: article, chapter, score and time earned.
• Comments are visible to anyone who can see the event they’re on.

Services we rely on

• Supabase hosts our database, auth and API. Its infrastructure keeps standard server logs, including IP addresses — Supabase privacy policy.
• Google sign-in, if you use it — Google privacy policy.
• Google’s Gemini API generates the chapters and quizzes. It receives Wikipedia article text only — never anything about you.
• Wikimedia supplies the articles. Images load onto your phone directly from Wikimedia’s servers, which see your IP address like any image host — Wikimedia privacy policy.

That’s the whole list — no ads, analytics, crash-reporting or tracking SDKs, and we never sell or share data for advertising.

Search

Search queries go to our server to find matches. Results are cached up to 24 hours by query text alone — not linked to you.

Keeping and deleting your data

We keep your account data for as long as your account exists.

• In the app: Settings → Delete account — permanently removes everything above.
• By email: robertkusz.dev@gmail.com, honored within 30 days.

Everything on your phone is deleted by uninstalling the app. Deletion also has its own page: Delete your account.

Security

All traffic is encrypted in transit, the database is sealed behind deny-all row-level security and reachable only through our API, and quiz answer keys never leave the server.

Children

Braintoll is not directed at children under 13 and we do not knowingly collect their data. If a child has created an account, contact us and we will delete it.

Your rights

Laws like the GDPR and CCPA give you rights to access, correct, delete or export your data. We honor these requests for everyone — email us.

Changes to this policy

If our practices change, this page changes with them — the date at the top says when.