Privacy Policy

This policy applies when you use the Brolic app, visit brolic.app, join the waitlist, contact support, or use an AI, import, or food search feature. Product questions go to support@brolic.app. Privacy requests go to privacy@brolic.app.

What we hold depends on the features you use:

• Account: the email address and sign-in method you use (Apple, Google, or email and password), and an internal account identifier.
• Your content: your goals and preferences, the food, workouts, Programs, Protocols, symptoms, measurements, and progress you record, progress photos and food photos, notes, and the prompts, files, media, and links you give to an AI or import feature.
• Apple Health: only the categories you choose to share, and only when you grant permission (see section 4).
• Subscription: whether you have an active subscription and its type. Apple handles payment; we never see your card.
• Device and usage: app and iOS version, device model, the delivery address for notifications if you allow them, crash reports, and a small set of usage events such as which screens and features are used. When you finish setup, one usage event also records the broad kinds of things you chose to track in Protocols, such as GLP-1, hormones, peptides, or supplements, so we can understand which kinds of people use Brolic. It never includes item names, amounts, schedules, injection sites, or notes. It is used only for product analytics, never for advertising, is not part of the profile described in section 6, and is never shared with AppsFlyer, Meta, or any other ad network. Apart from that, usage events never contain what you typed, your food, Protocol, symptom, or health values, or your photos.
• Ad attribution: in the App Store and TestFlight versions of the app, an install identifier, the identifier iOS gives Brolic for your device (IDFV), your internal account identifier, when the app is opened, your IP address, device and iOS details, Apple's Apple Ads attribution token, and, only if you allow tracking, your device's advertising identifier (IDFA), together with your trial, purchase, and renewal events. We use these only to measure and improve our own advertising (see section 6).
• Support conversations: the messages and screenshots you send us in the app or by email, our replies, and basic app and device details sent with each message.
• Waitlist and website: see section 11.

We use information to create and secure your account, keep your content in sync across your devices, provide the features you ask for, manage your subscription, produce editable AI and import drafts, send reminders you turn on, answer support and privacy requests, prevent abuse, find and fix problems, understand how Brolic is used in general, measure which of our ads lead to installs and subscriptions, and meet legal obligations.

We also use your account details, the training preferences you selected during setup, and your subscription status to tell you about Brolic features and offers. You can opt out of those messages at any time. We do not use Apple Health information, the health, food, protocol, measurement, photo, or note records you create, or your protocol and diet choices for marketing. We advertise Brolic in other companies' apps and websites and on the App Store, and measure which of those ads lead to installs, trials, and purchases. For that, AppsFlyer passes your install and subscription events to the ad networks we advertise on, such as Meta, whether or not you allow tracking when iOS asks; allowing it adds your device's advertising identifier (see section 6). We use this only to measure and improve our own ads. We never give ad networks your name, email address, or the records you create in Brolic, and we do not sell personal information.

Where the law requires a legal basis, we process information to provide Brolic and perform our agreement with you, with your consent, for our legitimate interests in operating, securing, supporting, and improving Brolic, or to meet a legal obligation. For health information we rely on your consent or another basis the law permits. You can withdraw consent, subject to legal or contractual limits, by changing the relevant permission or emailing privacy@brolic.app.

Apple Health access is optional and controlled by iOS permissions. With your permission Brolic can read body measurements, activity and energy, heart rate, and workouts to set up your plan, suggest an activity level, and show trends, and it can write the weight, workouts, and nutrition you log back to Apple Health. You choose exactly which categories to share in each direction.

Apple Health information is used only for the features you request, never for advertising or marketing profiles. You can change or revoke permissions in Apple Health or iOS Settings at any time. Apple Health records are not deleted when you delete your Brolic account; they stay under your Apple Health controls.

When you use an AI or import feature, the prompt, photo, file, media, text, or public link you chose is sent through Brolic's servers to an AI provider to produce a structured, editable draft. You review, change, save, or discard the draft yourself; nothing is applied to your saved content automatically. Drafts are not medical advice, diagnoses, prescriptions, or dosage recommendations.

A public-URL import makes a normal server request to the external site, through a service that fetches publicly available posts on our behalf. Brolic does not use your credentials or bypass private access, login gates, regional controls, or DRM. Provider handling follows applicable terms and Brolic's production configuration.

If you dictate a description instead of typing it, Brolic uses Apple's speech recognition to turn your voice into editable text. Depending on your device and language, Apple may process the audio on the device or on Apple's servers under Apple's privacy terms. Nothing is generated until you confirm the text.

We may use AI tools to help us read and reply to support messages. A reply sent by AI without a person reviewing it is labelled as AI.

Food search sends the words or barcode you search for to Brolic's own food search server so it can return matching foods. We may keep search terms to improve search results and to personalize what you see; they are never used for advertising.

We use a small number of service providers that help operate Brolic, for account services, hosting and storage, sign-in and subscriptions, AI and import processing, analytics and diagnostics, advertising measurement, and the website and network. Each may process information only to provide its service to us, under terms that restrict other uses:

• Account services, hosting and storage: the cloud platform that stores your account, your synced content, and your photos, runs Brolic's servers, delivers reminders and support reply notifications, and collects crash reports; and the separate server that answers food searches.
• Sign-in and subscriptions: Apple handles Sign in with Apple, App Store subscriptions, notification delivery, and dictation; Google handles Google sign-in if you choose it; a subscription service keeps track of your subscription status so the app knows what you have access to.
• AI and import processing: the AI providers that generate drafts from the content you provide and help us answer support conversations, and a service that fetches the public social-media post behind a link you import (it receives the link, not your account). We do not use your content to train AI models.
• Analytics and diagnostics: a product-analytics service for the app and website, an error-monitoring service for our servers, and crash reporting for the app.
• Advertising measurement: AppsFlyer, which tells us which of our ads lead to installs, trials, and purchases. It passes install and subscription events to the ad networks we advertise on, such as Meta, which handle them under their own privacy policies (see below).
• Website and network: the provider that serves the website and waitlist, protects forms from bots, and carries network traffic for food search and analytics.

The analytics and subscription providers above also hold a profile of your account, so we can understand how Brolic is used, support you, and tell you about Brolic features and offers: your account email and name, the sign-in method you used, the setup preferences you selected, how you found Brolic, your subscription status, and basic app and device details. It does not include Apple Health information or the records you create in the app. Deleting your Brolic account deletes this profile.

In the App Store and TestFlight versions of the app, Brolic sends AppsFlyer an install identifier, the IDFV, the advertising identifier (IDFA) if you allow tracking, your internal account identifier (a random one before you sign in), when the app is opened, your IP address (which AppsFlyer turns into an approximate location), and device and iOS details such as model, language, battery level, and user agent (a short technical description of your device and app version), which it also uses to detect fraudulent installs. If you installed Brolic from an Apple Ads ad, the app also sends Apple's attribution token, which is checked with Apple to learn which campaign the install came from. Our subscription provider sends AppsFlyer your trial, purchase, and renewal events, with their price and currency. AppsFlyer does not receive your email address, phone number, precise location, Apple Health information, or the records you create in the app.

When you tap Get Started on Brolic's welcome screens, before setup begins, iOS shows Apple's prompt asking whether Brolic may track you. You are not asked if you already answered on this device, if you choose “I already have an account” on those screens, or if you return to a setup you had already started. If you were already using Brolic before it started asking, you are asked only if the app takes you back to its welcome screens and you tap Get Started.

If you allow tracking, AppsFlyer receives your device's advertising identifier (IDFA) and shares it, with your install, trial, and subscription events, with the ad networks we advertise on, such as Meta, so they can tell us whether one of their ads brought you to Brolic and we can improve our campaigns. If you decline, or are never asked, Brolic does not use the advertising identifier, but AppsFlyer still sends those ad networks your install, your app opens, and your trial, purchase, and renewal events, together with your IP address, the IDFV, and your device's user agent, so each network can check whether one of its ads brought you to Brolic and report the results to us in aggregate. Either way, the ad networks handle this under their own privacy policies and never receive your name, email address, or the records you create in Brolic. They also receive Apple's aggregated install reports (SKAdNetwork and AdAttributionKit), which do not identify you. You can change your tracking choice at any time in iOS Settings, under Privacy & Security, then Tracking, or on Brolic's page in iOS Settings; it decides only whether the advertising identifier is shared.

AppsFlyer handles this information under its Services Privacy Policy. When you delete your Brolic account, we ask AppsFlyer to delete the records for your most recent install of the app and, if you allowed tracking, the records linked to your device's advertising identifier. AppsFlyer completes the deletion within 10 days. This does not reach what ad networks have already received, which they keep under their own privacy policies. For records from another device, or from an earlier install where you did not allow tracking, email privacy@brolic.app and we will ask AppsFlyer to delete them too.

We may also disclose information when the law requires it, to protect users or the service, or as part of a business transaction with appropriate safeguards.

• Your account and content: for as long as your account exists.
• Temporary AI and import files: the photos, files, and media uploaded to produce a draft are deleted within 7 days.
• Operational records: job status, AI usage counters, and subscription event records are deleted after 90 days.
• Support conversations and in-app feedback: up to one year after the last message, or sooner if you delete your account.
• Backups: database backups are kept for up to 30 days.
• Server logs, error reports, and crash reports: logs for 30 days; error and crash reports for 90 days.
• After account deletion: a record that deletion was requested and completed, containing an internal identifier and timestamps only, for up to one year.
• Ad attribution records: kept by AppsFlyer for as long as we need them to measure our advertising, within AppsFlyer's own retention limits, or until you delete your account or ask us to have them deleted (see section 6); AppsFlyer completes a deletion within 10 days.
• Search terms: only as long as they are useful for improving search results.
• Support emails and waitlist entries: until you ask us to remove them or we no longer need them.

We may keep information longer where a law requires it or to resolve a dispute.

Your content is stored in private, account-based storage that only your signed-in devices and Brolic's own servers can reach; other users cannot see it. No system can be guaranteed completely secure.

When something goes wrong in the app or on our servers, we collect technical error and crash reports so we can find and fix the problem. These reports include details about the error and the state of the app at that moment, and may occasionally include a snippet of the information you were entering or viewing when the error happened. We use them only to diagnose and fix problems, never for advertising or profiling. They are processed by our error-monitoring and crash- reporting providers on our behalf and deleted after 90 days. Crash reports are linked to a coded account identifier so we can match them to a support request.

Support messages can include diagnostics, such as app settings, permissions, and recent screens used, to help us find problems. They never include your health, food, Protocol, or symptom values. You can turn them off in Help & Feedback.

You can delete your account from Settings in the app (Account & Sync, then Delete Account) or by email if you cannot sign in. Your access ends immediately; deletion starts right away and is normally complete within a day. It removes your account, content, photos, drafts, support conversations and feedback, notification settings, and the subscription and sign-in records connected to Brolic. Section 7 lists the few things that remain for a short time. We also ask AppsFlyer to delete its ad attribution records for your most recent install and, if you allowed tracking, for your device's advertising identifier, which it completes within 10 days (see section 6). Deleting your account does not cancel an App Store subscription or remove records already saved in Apple Health. Details are on the Account Deletion page.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to certain processing, obtain a copy of your personal information, withdraw consent, or appeal our response. You may also have the right to complain to a privacy regulator.

To submit a request, email privacy@brolic.app and name the request type. We may verify your identity before completing a request and will respond as required by applicable law. Where permitted, an authorized agent may submit a request for you, and we may verify their authority. You can manage app permissions, including whether Brolic may track you (see section 6), through iOS Settings. Do not send a password, authentication token, or unnecessary sensitive content.

To stop messages about Brolic features and offers, use the unsubscribe link in the message or email privacy@brolic.app. You will still receive messages we must send about your account, such as security, billing, and support replies.

If you join the waitlist, we store your email address, the interests you selected, the page you signed up from and how you arrived (such as a referring link or campaign tag), and the time you consented. We use it to tell you about Brolic's launch and related updates, and you can ask us to remove it at any time. The sign-up form uses a bot check from our website provider, which sees your network address.

The website uses privacy-conscious analytics to understand which pages and buttons are used, including short replays of page interactions with everything you type masked. These analytics use browser storage rather than advertising cookies and are not shared with advertisers. To opt out, open brolic.app/?analytics=off once in your browser; to opt back in, open brolic.app/?analytics=on.

Brolic uses YouTube API Services to show videos on our website and to publish and measure videos on Brolic's own YouTube channel. We don't use them to collect information about you. YouTube's handling of information is covered by the Google Privacy Policy, and these features are subject to the YouTube Terms of Service. Access given to Brolic's YouTube tools can be revoked on the Google security settings page, and you can ask us to delete related data at privacy@brolic.app.

Your account, content, and photos are stored on cloud servers in the United States. The food search server is in Canada. The providers in section 6 process information in the United States and other locations where they operate. Information processed outside your country may be subject to the laws of that jurisdiction. Where required by applicable law, we take appropriate steps to protect information processed outside your country.

Brolic is intended for adults aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided information to Brolic, contact privacy@brolic.app so we can investigate and delete it.

We may update this policy as Brolic, its providers, or legal requirements change. Material changes will be communicated when required. For more information, visit Support, read the Terms of Use or Non-Medical Disclaimer, or email privacy@brolic.app.

PSG Labs Inc. is the controller responsible for Brolic. Its business mailing address is 112-970 Burrard St, Office #1374, Vancouver, BC V6Z 2R4, Canada.