Brooo Privacy Policy

1. Who runs Brooo, and how to reach us

Brooo is operated by Meterstone Studio (“we”, “us”). We run the Brooo app and the server it talks to. If you have a question about this policy, want to know what we hold about you, or want your account removed, write to brooo@meterstone.studio. A parent or guardian can write to the same address.

2. What we collect and keep on our server

Everything below is stored against one account, in a database on the server that runs Brooo. Brooo has no advertising identifiers, no device fingerprinting and no cross-app tracking, so the list really is this short.

2.1 Your account

• The account ID you choose and an optional display name.
• A password hash. Your password must be at least 8 characters. We store it only as a scrypt hash with a random per-account salt — never the password itself — so nobody here can read it back.
• A random sign-in token per sign-in, so the app can stay signed in without sending your password again.
• The date the account was created, and a flag saying whether the account is a developer “debug” account.
• How many AI replies and check-ins the account used each day — a count, nothing else — so we can apply a daily limit (see the Terms of Use).

If you use Sign in with Apple instead of a password:

• Brooo gives the account an account ID of its own (it starts with apple-), and the account has no password.
• We keep the identifier Apple gives Brooo for your Apple ID. It is a random string that Apple issues to Brooo alone — not your Apple ID, your email address or your phone number — and it is how we recognise you the next time you sign in.
• The first time only, Apple’s sign-in screen offers to share your name. You can edit it or leave it out there. If you share it, it becomes the account’s display name, exactly like the optional display name on the sign-up form.
• We keep a token from Apple whose only use is to tell Apple, when you delete your account, to stop Brooo’s access to your Apple ID (section 8).
• We do not ask Apple for your email address, and Apple does not send us your Apple ID password.

We do not collect an email address, a phone number, a date of birth, a home address or a payment method. When you sign up, Brooo asks you to confirm you are 13 or older; we do not ask you for your birthday.

2.2 Your chats with Brooo

The messages you send and the replies Brooo sends are stored as the conversation for your account, so the chat is still there when you come back or open Brooo on another device.

2.3 What Brooo remembers

Brooo writes short notes to itself — “memories” — from things you say, so it can bring them up later instead of asking you the same thing every week. These are stored with your account and are only ever used for your own conversation.

2.4 Apple Health data

If you grant Apple Health (HealthKit) permission, the app reads your health data on the phone and builds a once-a-day summary. That summary is a set of numbers, with a timestamp, in these categories:

• Sleep — the length of your main overnight sleep and related sleep figures.
• Activity — for example steps, distance and energy burned.
• Heart — for example heart rate, resting heart rate and heart rate variability.
• Respiratory — for example breathing rate and blood oxygen.
• Metabolic, Body, Mobility and Nutrition — other everyday measurements Apple Health already holds, where you have authorized them.

Plus the UTC offset of your phone’s time zone, so the server files each summary against the right local day. Summaries from the same day are merged into one row. The server keeps roughly the last 400 days of daily summaries.

The raw HealthKit samples — every individual reading, with its source device and exact times — never leave your phone.

2.5 Reminders, daily moments and check-ins

Brooo can check in with you at times you choose. We store your reminder schedule (the wall-clock times of your “daily moments”, your phone’s UTC offset, and whether reminders should arrive on iPhone, on Discord or both), the reminder messages Brooo has written for you, and a small record of which health check-ins have already been sent so you are not pinged twice about the same thing.

While notifications are on in the app, we also store your iPhone’s push token: the address Apple issues so that our server can deliver a reminder to that phone through Apple’s push service (section 5.3), together with whether it belongs to a test or a public build. It identifies only an installation of Brooo on one phone for delivering notifications, and it is not used for anything else. It is deleted when you turn notifications off in the app, sign out, or delete your account, and Apple tells us when it stops working, at which point we delete it too.

If you allow Brooo’s Live Activity — the “Brooo is waiting for you to check in” card on your lock screen — we also store the Live Activity push tokens Apple issues for it: one that lets our server show the card when a reminder goes out, and one for each card currently showing, so the server can remove it once you reply. Like the push token, they identify only an installation of Brooo for delivering that card. A card’s token is deleted when the card ends; the others are deleted when the app withdraws them, when you delete your account, or when Apple reports they no longer work.

2.6 Your profile and app settings

A small profile record holds your display name, the feature toggles shown in the app, and Brooo’s own status information (for example whether the last AI call succeeded). Brooo does not read your calendar, your location, your contacts, your photos or your screen time.

2.7 If you link Discord

Linking Discord is optional and off unless you do it. If you choose to link, we store the Discord user ID of the account you linked and when you linked it, so reminders and replies can reach you there. Generating a link code stores a six-character code that expires after ten minutes and can be used once. You can unlink at any time in Settings, which deletes that stored Discord user ID.

2.8 Server activity log

The server keeps a technical log of what it did for your account: proactive runs, chat turns, AI tool calls and their inputs and outputs, Discord deliveries, Apple Health uploads and failed requests. Entries include previews of message text (up to about 200 characters) and tool data (up to about 2,048 characters). The log is capped — by default the newest 500 entries per account, with older ones deleted automatically. It is account-scoped: an account can only ever read its own log, and only developer “debug” accounts can read it from the app at all. We use it to work out what went wrong when Brooo misbehaves.

2.9 Reports you send us

If you use the Report action on a message, we store that message and the reason you gave, so a person on our side can review it. Reports are kept while we review them, and are deleted when you delete your account. Please do not add anything to the report you would not want a human to read.

2.10 Whether reminders get opened (usage statistics)

We want to know whether Brooo’s reminders are useful or just noise, so we keep a small record, per account, of what happened to each one:

• on the server: that a reminder was written, and what triggered it (for example your bedtime moment, or noticing you woke up); that Apple’s push service accepted it for your iPhone; and, if you linked Discord, that it was delivered to you there and the time of your next message to Brooo in Discord;
• from the app: that a reminder was shown as a notification, whether you tapped it, and the times the app was opened.

Each entry is an event name, a time, and the ID of the reminder it belongs to. It never includes what the reminder or your messages said, your health data, your location, or any advertising or device identifier. We look at it only as totals across everyone — “how many bedtime reminders were opened within two hours” — to decide when and how often Brooo should reach out. It is ours alone: no analytics company receives it, and it is not used for advertising or tracking.

It is on by default. You can turn it off at any time in Settings › Privacy › Share usage statistics. Turning it off stops the recording and deletes everything already recorded for your account; turning it back on starts again from nothing.

2.11 Voice mode

Voice mode is optional and Brooo works the same without it. When you talk to Brooo, the words ElevenLabs heard (section 5.5) become your message and are stored like any typed message (section 2.2); Brooo’s reply is stored as text, as always. We do not store recordings of your voice or of Brooo’s spoken replies — your voice never reaches our server, and Brooo’s audio only passes through it on the way to your phone.

So that voice stays affordable, we count, per account and per day, how many characters of reply Brooo has spoken and how many voice conversations you started. These are numbers only, never what was said, and are deleted after about a week.

3. What stays on your iPhone and never reaches us

• Your raw Apple Health / HealthKit samples. Only the daily summary described in section 2.4 is uploaded.
• The app’s diagnostic log. The app keeps a rolling on-device log of what it did, for troubleshooting. It stays in the app’s own storage unless you deliberately export and send it to us; the export never includes your sign-in token.
• Your voice. In voice mode the microphone audio goes from your phone directly to ElevenLabs (section 5.5). Our server never receives or stores it.
• Your other notifications. Brooo’s reminders reach your phone through Apple’s push service (section 5.3) or are raised by the app itself. Nothing about any other app’s notifications is ever read; for Brooo’s own, only the usage statistics in section 2.10 are reported, and only while they are switched on.

4. Apple Health data: our specific promises

Because Brooo uses HealthKit, Apple requires us to say this plainly, and we mean it:

• We do not use your Apple Health data, or anything derived from it, for advertising, marketing, or any use-based data mining other than improving health, fitness or wellbeing for you inside Brooo.
• We do not sell your Apple Health data to anyone, ever, including data brokers, advertisers, insurers, employers and schools.
• We do not share your Apple Health data with third parties for their own purposes. The only places it goes outside our own server are the ones in section 5, and they act for us so that Brooo can answer you: the model gateway, under the zero-data-retention rule in section 5.1; the reminder notification and check-in Live Activity Apple delivers to your iPhone (section 5.3), whose text can mention a figure from your summary, such as how long you slept; — only if you use voice mode — ElevenLabs, which turns Brooo’s reply, which can mention such a figure in the same way, into speech (section 5.5); and — only if you linked Discord — the Discord message that carries Brooo’s reply to you.
• The app does not store your Apple Health data in iCloud.
• The app asks for read-only HealthKit access. Brooo never writes anything into Apple Health.
• You can withdraw HealthKit access at any time in iOS Settings › Privacy & Security › Health › Brooo, or in the Health app. Brooo then stops reading and stops uploading summaries.

5. Who else processes your data

5.1 The AI that writes the replies

Brooo’s replies are written by a large language model, which is not something we run ourselves. To produce a reply, our server sends the text of your message and the context Brooo needs for that turn — recent messages from your conversation, memories relevant to it, and the health summary numbers Brooo is using — to a model gateway, which hands the request to the model provider that answers it. Your password, your password hash and your sign-in token are never sent, and nor is any advertising identifier, because Brooo has none.

The app asks for your permission before anything is sent to the AI provider, and you can withdraw it at any time in Settings › Privacy; our server then stops sending your data to the provider too, including for scheduled check-ins and Discord messages. Voice mode also needs that permission, given for the version of it that names ElevenLabs (section 5.5); our server refuses voice requests from an account that has not agreed to it.

The gateway is a single endpoint we configure on the server (LLM_BASE_URL); at the time of writing it is OpenRouter. Every request we send is restricted, in the request itself, to providers operating under Zero Data Retention — OpenRouter’s term for a provider that will not store your data for any period of time. Such a provider processes the request to produce the reply and does not keep your prompt or the reply afterwards, and cannot train a model on what it has not kept. We also tell the gateway, on the same request, to refuse any provider that collects user data.

We ask for this on every single request, rather than relying on a checkbox in an account dashboard, so it is part of what our server sends and lives in our code. If no zero-data-retention provider is available for a request, the request is not answered at all. There is no quiet fallback to a provider that would keep your text: Brooo replies instead from simple, fixed logic that runs on our own machine and sends nothing outside — the same thing it does when the AI service is down. Brooo gets more basic for a while; your message does not go somewhere that stores it.

Two honest details about what that rule does and does not cover. First, some providers hold a repeated part of a prompt in memory for a short time so they do not have to process it twice; the gateway does not count that in-memory cache as storing data, and nor do we. Second, the rule governs which provider the request is routed to. It is not a statement about the gateway’s own systems, which the request passes through: OpenRouter states that it does not retain prompts unless an account turns on prompt logging, and we do not turn it on. If we change the gateway or the model provider, we will update this page.

5.2 Discord, if you link it

If you link a Discord account, reminders and chat replies are delivered to you as Discord direct messages, and anything you type to Brooo on Discord passes through Discord. That means Discord, Inc. handles that text under its own privacy policy. If you do not link Discord, nothing about you goes to Discord.

5.3 Apple Push Notification service

To put a reminder on your iPhone’s lock screen when the app is not open, our server hands the reminder’s title and text, its ID and your phone’s push token to Apple’s push service, which delivers it to that phone. Apple handles it under its own privacy policy, only to deliver the notification. If you turn notifications off in the app, sign out, or turn off iPhone reminders in Settings, nothing is sent to Apple’s push service for your account.

The check-in Live Activity (section 2.5) is started and ended through the same service. To show it, our server sends Apple a short headline, the name of the daily moment, the first line of the reminder (at most 90 characters), the reminder’s ID and time, and the Live Activity push token; to end it, a thank-you line and the same ID and time. If you turn off iPhone reminders in Settings, or withdraw your permission for the AI provider (section 5.1), the card is not started.

5.4 Sign in with Apple, if you use it

When you choose Sign in with Apple, Apple confirms who you are on your iPhone and gives the app a signed, short-lived proof of it, which our server checks against Apple’s published keys. Our server contacts Apple to fetch those keys, to exchange a one-time code for the token described in section 2.1, and, when you delete your account, to revoke Brooo’s access. Nothing about your chats or your health data is sent to Apple for any of this. Apple handles your Apple ID under its own privacy policy.

5.5 ElevenLabs, only if you use voice mode

Brooo’s voice is provided by ElevenLabs. If you never use voice mode, nothing about you goes to ElevenLabs. When you do, two things go to it:

• Your voice audio, to transcribe it. Your iPhone streams the microphone audio for that conversation directly to ElevenLabs, which sends back the words it heard. Our server only hands the phone a single-use pass for that one conversation, which expires after 15 minutes. Because the phone connects to ElevenLabs directly, ElevenLabs also sees your phone’s internet (IP) address, as any website you visit does.
• The text of Brooo’s reply, to speak it. Our server sends the reply text — and, so a long reply sounds natural, a little of the text just before and after the part being spoken — to ElevenLabs, which returns the audio and the timing of each character so Brooo’s mouth can move with the words.

ElevenLabs does not receive your account ID, password or sign-in token, and our server does not send it your conversation history, your memories or your health summary — only the text being spoken, which can mention a figure from your health summary when Brooo’s written reply does. ElevenLabs processes this as our service provider, under its own privacy policy and terms. Unlike the AI model requests in section 5.1, voice mode does not use zero data retention: ElevenLabs may keep a history of these requests — the audio, the transcript and the generated speech — including in its backups, for the periods its own policy sets. We have turned off ElevenLabs’ use of our account’s data to train its models, so what you say in voice mode and what Brooo says back is not used for training.

5.6 Hosting

The Brooo server and its database run on a virtual server we rent from a hosting provider. The provider stores the machine’s disk but does not use your data for its own purposes.

6. What we do not do

• No advertising, anywhere in Brooo. We work with no ad network and Brooo holds no advertising identifier.
• No tracking of you across other apps or websites, and no request to track.
• No third-party analytics, attribution or crash-reporting SDKs in the app. The app is built entirely from our own code and Apple’s. The only usage statistics are our own, described in section 2.10, and they never leave our server.
• No selling, renting or trading of your data, ever — to anyone, including data brokers, advertisers, insurers, employers and schools.
• No sharing of your data with anyone for their own purposes. What you send us is stored only on the Brooo server we operate. The only outside companies that touch it at all are the ones in section 5, and each of them is doing a job for us so that Brooo works: writing the reply under the zero-data-retention rule, delivering a reminder to your iPhone through Apple’s push service, confirming a Sign in with Apple if you use it, delivering a message to Discord if you linked it, turning speech into text and replies into speech if you use voice mode, and renting us the machine.
• No sharing of your conversation with your school, your parents or anyone else — beyond the processors in section 5 acting on our behalf — unless you ask us to, or the law requires it.

7. How long we keep things

• Your account, chats, memories, health summaries, reminder schedule, check-in record and linked identities are kept until you delete your account. Daily health summaries older than roughly 400 days are dropped automatically.
• The server activity log is capped at the newest 500 entries per account by default; older entries are deleted as new ones arrive.
• Usage statistics (section 2.10) are kept for up to 180 days, then deleted automatically; turning them off in Settings › Privacy deletes them straight away.
• Your iPhone’s push token is kept until you turn notifications off in the app, sign out or delete your account, or until Apple reports it no longer works. Live Activity push tokens are kept until the app withdraws them, you delete your account or Apple reports they no longer work, and a showing card’s token only until the card ends.
• Daily voice usage counts (section 2.11) are deleted after about a week. Recordings of your voice are never kept on our server; what ElevenLabs keeps is described in section 5.5.
• Discord link codes expire ten minutes after they are created.
• Daily counts of AI replies are kept for 7 days.
• If you use Sign in with Apple, the identifier and token from Apple (section 2.1) are kept until you delete your account.
• Reports you file are kept while we review them, and are deleted when you delete your account.
• Backups of the server database may hold a copy for a short period after deletion before they are rotated out.

8. How to delete everything

In the app: Settings › Sessions › Delete Account. This is immediate and permanent. It erases the account and everything listed in section 2 for that account — profile, conversation, memories, Apple Health summaries, reminders and schedule, check-in record, sign-in tokens, push and Live Activity tokens, any linked Discord identity, your Sign in with Apple link (and our server asks Apple to revoke Brooo’s access to your Apple ID), the server activity log, usage statistics, voice usage counts, and reports you filed. Deleted records are overwritten in the database file, not just unlinked. It cannot be undone, and we cannot bring a deleted account back.

If you cannot reach the app, write to brooo@meterstone.studio with your account ID and we will delete it for you. You can also just remove HealthKit permission (section 4) if you want to keep chatting but stop sharing health data.

9. How we protect your data

• All traffic between the app and the server uses HTTPS.
• Passwords are stored only as salted scrypt hashes, compared in constant time.
• Repeated wrong passwords are slowed down: after too many failed sign-ins for one account, or from one network address, the server refuses further attempts for a few minutes.
• The app authenticates with a random bearer token, not your password. Requests are scoped to your account, so one account cannot read another’s chats, health summaries or activity log.
• The AI provider and voice provider keys live on the server only and are never shipped in the app. For voice, the phone gets a single-use pass that expires after 15 minutes.

No system is perfectly secure. Please use a password you do not use anywhere else, and do not put things in the chat you would be hurt by if they leaked.

10. Teens, children and parents

Brooo is built for people aged 13 and over. It is not for children under 13, and we ask you to confirm your age when you sign up. We do not knowingly collect anything from a child under 13. If we learn that an account belongs to someone under 13, we delete that account and its data. If you are a parent or guardian and believe your child under 13 has an account, write to brooo@meterstone.studio and we will remove it. Parents and guardians can contact us at the same address with any question about a teen’s account.

If you are under 18, please use Brooo with a parent’s or guardian’s permission.

11. Brooo is not a doctor

Brooo is not a medical device. It does not diagnose, treat, cure or prevent anything, and nothing it says is medical advice. The Apple Health numbers it shows you are the ones already on your phone; Brooo does not check them for accuracy. Talk to a doctor, a nurse or another qualified adult about anything to do with your health. In an emergency, call your local emergency number. In the United States you can call or text 988 (Suicide & Crisis Lifeline) at any time.

12. Changes to this policy

If we change how Brooo handles your data, we will update this page and change the effective date at the top. For a significant change we will also say so in the app. Brooo is in beta and changes often, so it is worth re-reading this page now and then.

13. Contact

Questions, data requests, parent or guardian enquiries: brooo@meterstone.studio. Operator: Meterstone Studio.