Brasstacks Privacy Policy

Effective: July 30, 2026 | Last Updated: July 30, 2026

Brasstacks ("App") is provided by Visible AI ("Company", "we", "us"). This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our App.

1. Our Core Commitment

Your personal data never leaves our controlled systems. We do not sell, share, rent, or trade your personal data with third parties. We do not use your data to train AI models. We do not use third-party advertising or behavioral tracking services.

2. Information We Collect

2.1 Account Information

Data	Purpose
Email address	Account authentication and password recovery
Display name	Personalization within the App
Password	Stored as a bcrypt hash — we never store or see your plain text password
User profile type	Context-specific defaults (executive, professional, student)

2.2 User Content

Data	Purpose
Tasks, notes, and micro-steps	Core App functionality
Goals	Long-term progress tracking
Context breadcrumbs	Helping you resume tasks after interruptions
Life domains and weights	Task categorization and prioritization

2.3 Behavioral Data (Collected Automatically)

Data	Purpose
Task completion timestamps	Learning your productive hours to improve prioritization
Energy level (optional, user-provided)	Refining time-of-day recommendations
Focus session durations	Tracking your focus patterns
Skip and snooze counts	Adjusting task priority scoring

2.4 AI Configuration (Optional)

Data	Purpose
AI provider preference	Routing requests to your chosen AI provider (Claude, OpenAI, or Gemini)
AI API key	Authenticating with your chosen AI provider. Encrypted using your password — we cannot read your key. See Section 4 for details.
AI chat history	Sent to your AI provider during your session for conversational context. Not stored on our server.

2.5 Technical Data

Data	Purpose
Device push token	Delivering push notifications
Device name and platform	Stored with push token for device identification

3. How We Use Your Information

We use your information solely to:

Provide and operate the App's features
Authenticate your identity and secure your account
Prioritize your tasks using our scoring algorithm
Learn your productive patterns to improve recommendations (on our server only)
Send push notifications (nudges, reminders, weekly reviews)
Improve the App based on aggregated, anonymized usage patterns

4. AI Features and Data Transparency

Brasstacks includes optional AI features that you can enable in Settings. Here is exactly how they work:

4.1 Bring Your Own Key

Brasstacks does not provide its own AI. You connect your own account from one of three supported providers: Claude (Anthropic), OpenAI, or Google Gemini. You control the provider, the costs, and can revoke access at any time by deleting your key.

4.2 API Key Security

Your API key is encrypted using your password before it is stored on our server
The encryption key is derived from your login credentials — only your login can decrypt it
We cannot read, access, or recover your API key
If you reset your password, the encrypted key becomes unreadable and you will need to re-enter it

4.3 What Data is Sent to AI Providers

When you use the AI assistant or auto-generate micro-steps, the following data is sent to your chosen provider:

Your message or question
Recent chat history (for conversational context)
A summary of your current tasks, goals, and life domains (to give the assistant context)

Before any data is sent, personal details are automatically anonymized: email addresses, phone numbers, URLs, dates, and monetary amounts are replaced with placeholders (e.g., [email], [phone]).

4.4 Data Training

Your data is NOT used to train any third-party AI models
Your data is NOT used to train our own AI models
Each AI provider has its own data policies — we encourage you to review them. The models used (Claude Haiku, GPT-4o mini, Gemini Flash) are lightweight models designed for fast responses, not training
Task prioritization uses a deterministic scoring algorithm, not AI/ML

5. Rescue Mode Privacy

Data from rescue mode (the "I'm overwhelmed" feature) receives the highest privacy protection:

Never shared with any external service
Never used for analytics or product improvement
Never included in any data export except at your explicit request
You can delete rescue mode data at any time

6. Data Sharing

6.1 Third-Party Services

We use the following third-party services:

Service	Purpose	Data Shared
Expo Push Notifications	Delivering push notifications via Apple APNs	Device push token + generic notification text (never personal content)

We do not use any third-party analytics, advertising, or crash reporting services that receive your personal data.

6.2 Push Notification Content

Push notification messages are deliberately generic (e.g., "Your priorities today", "Time for a check-in"). We never include your actual task titles, notes, goals, or any personal content in notification payloads. Task details are loaded on-device when you open the App.

7. Data Storage and Security

Data is stored on our managed server infrastructure
All connections use HTTPS/TLS encryption in transit
Passwords are hashed with bcrypt (12 rounds) — never stored in plain text
Authentication uses short-lived JWT access tokens with refresh token rotation
AI API keys are encrypted at rest using AES-256-GCM, with the encryption key derived from your password — not stored on our server
Database access is restricted to the application service only

8. Data Retention

Data	Retention
Active account data	Retained while account is active
Deleted tasks	Soft-deleted, permanently purged after 30 days
Deleted account	All personal data removed within 30 days
Server logs	Retained for 90 days, then deleted

9. Your Rights

You have the right to:

Access: Request a copy of all data we hold about you
Correction: Update your personal information
Deletion: Delete individual tasks or your entire account
Portability: Request your data in a machine-readable format
Opt-out of notifications: Disable all nudges via quiet hours, frequency settings, or device settings

To exercise any of these rights, contact brasstacks@visibleai.com.

10. Children's Privacy

Brasstacks is designed for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we learn that we have collected data from a child under 13, we will delete it promptly. If you believe a child under 13 has provided us with personal information, please contact us.

11. California Residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the CCPA/CPRA:

Right to know what personal information we collect and how it is used
Right to delete your personal information
Right to opt-out of the sale of personal information — we do not sell your data
Right to non-discrimination for exercising your privacy rights

12. International Users

Your data is stored and processed in the United States. By using the App, you consent to the transfer of your data to the United States. We apply the same privacy protections regardless of your location.

13. Cookies and Tracking

The Brasstacks mobile App does not use cookies, web beacons, or third-party tracking technologies. We do not track you across other apps or websites.

14. Changes to This Policy

If we make material changes to this Privacy Policy, we will notify you through the App before the changes take effect. We encourage you to review this policy periodically.

15. Contact Us

For privacy-related questions or requests:

Email: brasstacks@visibleai.com
Company: Visible AI