Privacy Policy

This policy applies when you use the Brolic app, visit brolic.app, join the waitlist, contact support, or use an AI, import, or food search feature. Product questions go to [email protected]. Privacy requests go to [email protected].

What we hold depends on the features you use:

• Account: the email address and sign-in method you use (Apple, Google, or email and password), and an internal account identifier.
• Your content: your goals and preferences, the food, workouts, Programs, Protocols, symptoms, measurements, and progress you record, progress photos and food photos, notes, and the prompts, files, media, and links you give to an AI or import feature.
• Apple Health: only the categories you choose to share, and only when you grant permission (see section 4).
• Subscription: whether you have an active subscription and its type. Apple handles payment; we never see your card.
• Device and usage: app and iOS version, device model, the delivery address for notifications if you allow them, crash reports, and a small set of usage events such as which screens and features are used. Usage events never contain what you typed, your food, Protocol, symptom, or health values, or your photos.
• Support conversations: the messages and screenshots you send us in the app or by email, our replies, and basic app and device details sent with each message.
• Waitlist and website: see section 11.

We use information to create and secure your account, keep your content in sync across your devices, provide the features you ask for, manage your subscription, produce editable AI and import drafts, send reminders you turn on, answer support and privacy requests, prevent abuse, find and fix problems, understand how Brolic is used in general, and meet legal obligations.

We also use your account details, the training preferences you selected during setup, and your subscription status to tell you about Brolic features and offers. You can opt out of those messages at any time. We do not use Apple Health information, the health, food, protocol, measurement, photo, or note records you create, or your protocol and diet choices for marketing. We do not advertise Brolic inside other companies' apps or websites using your information, we do not track you across them, and we do not sell personal information.

Where the law requires a legal basis, we process information to provide Brolic and perform our agreement with you, with your consent, for our legitimate interests in operating, securing, supporting, and improving Brolic, or to meet a legal obligation. For health information we rely on your consent or another basis the law permits. You can withdraw consent, subject to legal or contractual limits, by changing the relevant permission or emailing [email protected].

Apple Health access is optional and controlled by iOS permissions. With your permission Brolic can read body measurements, activity and energy, heart rate, and workouts to set up your plan, suggest an activity level, and show trends, and it can write the weight, workouts, and nutrition you log back to Apple Health. You choose exactly which categories to share in each direction.

Apple Health information is used only for the features you request, never for advertising or marketing profiles. You can change or revoke permissions in Apple Health or iOS Settings at any time. Apple Health records are not deleted when you delete your Brolic account; they stay under your Apple Health controls.

When you use an AI or import feature, the prompt, photo, file, media, text, or public link you chose is sent through Brolic's servers to an AI provider to produce a structured, editable draft. You review, change, save, or discard the draft yourself; nothing is applied to your saved content automatically. Drafts are not medical advice, diagnoses, prescriptions, or dosage recommendations.

A public-URL import makes a normal server request to the external site, through a service that fetches publicly available posts on our behalf. Brolic does not use your credentials or bypass private access, login gates, regional controls, or DRM. Provider handling follows applicable terms and Brolic's production configuration.

If you dictate a description instead of typing it, Brolic uses Apple's speech recognition to turn your voice into editable text. Depending on your device and language, Apple may process the audio on the device or on Apple's servers under Apple's privacy terms. Nothing is generated until you confirm the text.

We may use AI tools to help us read and reply to support messages. A reply sent by AI without a person reviewing it is labelled as AI.

Food search sends the words or barcode you search for to Brolic's own food search server so it can return matching foods. We may keep search terms to improve search results and to personalize what you see; they are never used for advertising.

We use a small number of service providers that help operate Brolic, for account services, hosting and storage, sign-in and subscriptions, AI and import processing, analytics and diagnostics, and the website and network. Each may process information only to provide its service to us, under terms that restrict other uses:

• Account services, hosting and storage: the cloud platform that stores your account, your synced content, and your photos, runs Brolic's servers, delivers reminders and support reply notifications, and collects crash reports; and the separate server that answers food searches.
• Sign-in and subscriptions: Apple handles Sign in with Apple, App Store subscriptions, notification delivery, and dictation; Google handles Google sign-in if you choose it; a subscription service keeps track of your subscription status so the app knows what you have access to.
• AI and import processing: the AI providers that generate drafts from the content you provide and help us answer support conversations, and a service that fetches the public social-media post behind a link you import (it receives the link, not your account). We do not use your content to train AI models.
• Analytics and diagnostics: a product-analytics service for the app and website, an error-monitoring service for our servers, and crash reporting for the app.
• Website and network: the provider that serves the website and waitlist, protects forms from bots, and carries network traffic for food search and analytics.

The analytics and subscription providers above also hold a profile of your account, so we can understand how Brolic is used, support you, and tell you about Brolic features and offers: your account email and name, the sign-in method you used, the setup preferences you selected, how you found Brolic, your subscription status, and basic app and device details. It does not include Apple Health information or the records you create in the app. Deleting your Brolic account deletes this profile.

We may also disclose information when the law requires it, to protect users or the service, or as part of a business transaction with appropriate safeguards.

• Your account and content: for as long as your account exists.
• Temporary AI and import files: the photos, files, and media uploaded to produce a draft are deleted within 7 days.
• Operational records: job status, AI usage counters, and subscription event records are deleted after 90 days.
• Support conversations and in-app feedback: up to one year after the last message, or sooner if you delete your account.
• Backups: database backups are kept for up to 30 days.
• Server logs, error reports, and crash reports: logs for 30 days; error and crash reports for 90 days.
• After account deletion: a record that deletion was requested and completed, containing an internal identifier and timestamps only, for up to one year.
• Search terms: only as long as they are useful for improving search results.
• Support emails and waitlist entries: until you ask us to remove them or we no longer need them.

We may keep information longer where a law requires it or to resolve a dispute.

Your content is stored in private, account-based storage that only your signed-in devices and Brolic's own servers can reach; other users cannot see it. No system can be guaranteed completely secure.

When something goes wrong in the app or on our servers, we collect technical error and crash reports so we can find and fix the problem. These reports include details about the error and the state of the app at that moment, and may occasionally include a snippet of the information you were entering or viewing when the error happened. We use them only to diagnose and fix problems, never for advertising or profiling. They are processed by our error-monitoring and crash- reporting providers on our behalf and deleted after 90 days. Crash reports are linked to a coded account identifier so we can match them to a support request.

Support messages can include diagnostics, such as app settings, permissions, and recent screens used, to help us find problems. They never include your health, food, Protocol, or symptom values. You can turn them off in Help & Feedback.

You can delete your account from Settings in the app (Account & Sync, then Delete Account) or by email if you cannot sign in. Your access ends immediately; deletion starts right away and is normally complete within a day. It removes your account, content, photos, drafts, support conversations and feedback, notification settings, and the subscription and sign-in records connected to Brolic. Section 7 lists the few things that remain for a short time. Deleting your account does not cancel an App Store subscription or remove records already saved in Apple Health. Details are on the Account Deletion page.

Depending on where you live, you may have rights to access, correct, delete, restrict or object to certain processing, obtain a copy of your personal information, withdraw consent, or appeal our response. You may also have the right to complain to a privacy regulator.

To submit a request, email [email protected] and name the request type. We may verify your identity before completing a request and will respond as required by applicable law. Where permitted, an authorized agent may submit a request for you, and we may verify their authority. You can manage app permissions through iOS Settings. Do not send a password, authentication token, or unnecessary sensitive content.

To stop messages about Brolic features and offers, use the unsubscribe link in the message or email [email protected]. You will still receive messages we must send about your account, such as security, billing, and support replies.

If you join the waitlist, we store your email address, the interests you selected, the page you signed up from and how you arrived (such as a referring link or campaign tag), and the time you consented. We use it to tell you about Brolic's launch and related updates, and you can ask us to remove it at any time. The sign-up form uses a bot check from our website provider, which sees your network address.

The website uses privacy-conscious analytics to understand which pages and buttons are used, including short replays of page interactions with everything you type masked. These analytics use browser storage rather than advertising cookies and are not shared with advertisers. To opt out, open brolic.app/?analytics=off once in your browser; to opt back in, open brolic.app/?analytics=on.

Your account, content, and photos are stored on cloud servers in the United States. The food search server is in Canada. The providers in section 6 process information in the United States and other locations where they operate. Information processed outside your country may be subject to the laws of that jurisdiction. Where required by applicable law, we take appropriate steps to protect information processed outside your country.

Brolic is intended for adults aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided information to Brolic, contact [email protected] so we can investigate and delete it.

We may update this policy as Brolic, its providers, or legal requirements change. Material changes will be communicated when required. For more information, visit Support, read the Terms of Use or Non-Medical Disclaimer, or email [email protected].

PSG Labs Inc. is the controller responsible for Brolic. Its business mailing address is 112-970 Burrard St, Office #1374, Vancouver, BC V6Z 2R4, Canada.