Privacy Policy

2. Hypothetically Speaking

Hypothetically Speaking is available for iPhone, iPad, and Android. Everything in the app works without an account. Where a practice applies only to some versions of the app, the version is noted, so people using an older version can see what applies to them.

Installation ID

The first time the app runs, it creates a random installation ID with no name, email address, or other contact details attached. Your ordinary votes, your answers in But There’s a Catch and What’s Your Price?, any questions you suggest, and an app-open counter are linked to that ID, so the app can count one vote per question and show you your own results.

On iPhone and iPad, the ID is kept in the device’s keychain, so deleting and reinstalling the app on the same device usually keeps the same ID, and an encrypted or iCloud backup restored to a new device can bring it along. On Android (version 2.4 and later), the app’s data is not included in Android backups, and deleting the app removes the ID, so a reinstalled, new, or restored phone starts with a new ID and without your progress or open challenges.

Records linked to an installation ID, or to an account, are not anonymous to us: they are pseudonymous. Other players never see them individually.

Installation key (version 2.4 and later)

The app also creates a random secret key for each installation and keeps it only in your device’s secure storage (the iOS keychain or Android’s keystore). It is sent only to our server, over an encrypted connection, when the app registers your installation ID or uploads something for it; our server stores only a one-way fingerprint of the key. The first key registered for an installation ID becomes that ID’s key. From then on, our server accepts votes, suggestions, mode answers, usage events, and app-open counts for that ID, and shows its suggestions, only to a device that holds the registered key. This shows that a request comes from whoever holds the key; it does not prove who originally created the ID. Installations that have not registered a key, including copies of the app older than 2.4 and 2.4 installations whose registration has not finished, do not have this protection. The key carries no name or contact details and is not used for advertising or tracking. If the app cannot confirm its key, it pauses uploading and keeps your answers on your device.

If another copy of the app has already registered your installation ID with a different key, Settings shows Online sync: Paused. You can then choose Start a new online identity, which gives this device a new installation ID and key after you confirm. Everything on the device is kept. Records already sent under the old ID stay on our server, counted in community results, and are not moved to the new ID.

What other people can see

In the app, other players see only combined totals. Our public interface returns only those totals and, for ordinary votes, the question and option of each vote, with no installation ID, account, or time. Questions people suggest, answers in But There’s a Catch and What’s Your Price?, usage events, challenge choices, and app-open counts cannot be read by other players.

But There’s a Catch and What’s Your Price? (version 2.3 and later)

When you finish a scenario in these modes, the app stores your choices the same way it stores ordinary votes: for But There’s a Catch, your choice before the catch and your choice after it; for What’s Your Price?, the offer you picked or that you refused every offer. Only your first finished answer to each version of a scenario is kept. The dollar amounts are hypothetical: nothing is bought, sold, or paid. Hypothetically Speaking has no in-app purchases.

Favorites and playlists

Without an account, the favorites and playlists you make are saved only on your device; their names and contents are not sent to us, and deleting the app deletes them. If you sign in (version 2.5 and later), your favorites and playlists are kept with your account so they are available on your other devices. The first time you sign in on a device, the favorites and playlists already on it are added to your account; later, the app asks before combining them.

Challenge a Friend (version 2.1 and later)

Challenge a Friend lets you send one friend a private link so you both answer the same questions and then compare your choices. It works without an account, and it does not ask for your name, email address, phone number, or contacts. To run a challenge, we store:

• a copy of the questions and answer options in the challenge;
• your choices, and your friend’s choices as they answer;
• three random codes that control access (the code in the invitation link and one private code for each person), stored only as one-way hashes; the codes themselves are kept in the link and on your devices;
• dates and a status (created, accepted, completed, cancelled, expired), so a link can expire and be cleaned up;
• if you turn on alerts, your device’s push notification token; and
• short-lived anti-abuse counters, described below.

Choices made in a challenge are kept separately from ordinary votes, and your friend’s challenge answers are not added to community results. If you made your own choices by playing a normal round first, those were recorded as ordinary votes when you played; creating a challenge does not record them again.

Who can see challenge choices

Until your friend has finished the whole challenge, each of you can see only your own choices. After your friend submits their answers, the app shows both of you every question with both sets of choices side by side. The web page that opens when someone taps the link without the app does not show the questions or anyone’s choices and does not contact our database.

Challenge information is sent between the app and our servers over encrypted (HTTPS) connections, but it is stored in readable form with our database provider and is not end-to-end encrypted, so people with administrative access to that database could technically read it. Challenge data is not tied to your name or email address, but it is linked to your devices through the private codes and, if you enable alerts, your push token, so we do not describe it as anonymous.

The invitation link

The link works for one friend: the first person who opens it and taps Accept becomes the person who answers, so send it only to the person you mean to challenge. The link’s secret code is part of the web address, so it may appear in logs kept by our hosting provider and by the apps you share it through. These codes are not passwords and we cannot recover them. If you delete the app or switch phones before a challenge is finished, you cannot get back into that challenge. Because the link works like a key, we will never ask you to send it to us.

Optional challenge alerts

Only the person who created a challenge can receive an alert. If you agree, first in the app’s own explanation and then in your device’s permission prompt, the app gives our server your device’s push notification token for that challenge. We use it only to send you one alert when your friend finishes, through Apple Push Notification service on iPhone and iPad or Firebase Cloud Messaging on Android. The alert says only that your friend finished; it contains no choices, scores, or link. Your friend is never sent alerts, and we do not ask for their token.

On Android (version 2.4 and later), Firebase Cloud Messaging is a Google service. To deliver an alert, we send Google only your device’s push token and the alert itself: its fixed text and the challenge’s internal ID, which lets the app open the right comparison and is not the invitation link or any of its codes. The app uses Firebase only to deliver notifications; it does not include Firebase Analytics or any other Google analytics or advertising service, and it does not use the Android advertising ID.

We erase the token if you turn alerts off while the challenge is open, if you cancel the challenge, when the link expires, or if Apple or Google tells us the token is no longer valid. Once a challenge is completed, the token stays with the completed challenge until it is deleted (30 days after completion), and we send no further alerts for it. You can turn alerts off in the app’s Settings, in iOS Settings under Notifications, or on Android in the app’s notification settings.

Anti-abuse counters

To limit abuse, our servers keep short-lived counters tied to a one-way hash of the network (IP) address a request came from. A hashed address is still derived from your address, so we treat it as personal information. These counters are deleted after about two days.

When challenge data is deleted

Cleanup runs automatically once a day, so each deletion below can happen up to about a day after the time stated.

• Link not finished: a challenge link lasts 14 days from when it was created. After that it stops working, the choices and any push token are erased, and the remaining record (hashed codes, dates, and status) is deleted 30 days after the link expired.
• Completed: the whole challenge, including both people’s choices and any push token, is deleted 30 days after your friend finished.
• Cancelled by you: the choices and any push token are erased right away, and the remaining record is deleted 30 days later.
• On your phone: the app keeps your private codes and a copy of the comparison so you can reopen it, and removes them on about the same schedule.

Usage statistics (version 2.2 and later)

To learn whether features are useful, the app sends us a small number of usage events linked to your installation ID, for example: when a play session starts; that a question was answered (not which question or which answer); when a weekly set, a mode round, or a playlist is started or finished; that a catch was shown and whether it changed your choice (not which choices); that a price was picked (not which one); whether the share sheet was opened, completed, or cancelled and roughly where (for example “Messages” or “other”); challenge steps such as created or completed; changes to notification settings; and which kind of notification was tapped. These events never include question text, your answers, playlist names, challenge links or codes, notification text, or anything you type. They are not used for advertising, are not shared with data brokers, and are not combined with data from other companies’ apps or websites.

Usage statistics are on unless you turn them off. You can turn them off at any time in the app under Settings ▸ Privacy ▸ Share usage statistics; doing so also deletes any events not yet sent. Events we have received are deleted after 13 months.

Installation and version information (version 2.5 and later). While usage statistics are on, each installation also tells us its app version and build, platform, operating system version, and whether notifications are allowed, so we can see which versions are in use. This is tied to the installation, not to your account, and uses no advertising identifier.

Reminders and notifications

The daily challenge reminder and the optional playful reminders (four a day) are scheduled on your device by the app. They are off unless you turn them on, and turning them on sends nothing to our servers apart from the usage events described above. iOS or Android may delay or silence any notification according to your settings, and on Android 13 and later, Android asks for your permission before the app can show notifications.

Weekly set and shared questions

The app downloads the current weekly set of questions from our servers. Anyone can read it, and downloading it does not identify you. If you share a question, the link contains only the question’s public catalog number, not your answer.

Optional accounts (version 2.5 and later)

Before version 2.5, Hypothetically Speaking has no accounts. From version 2.5 you can choose to create one. If you do, we store an account ID, the sign-in method you used, and your email address. You can sign in with:

• an emailed one-time code: we email you a six-digit code that expires after one hour. These emails come from accounts@brightgrain.net, an address that only sends mail, and are delivered by our email provider, Resend. Accounts have no passwords;
• Sign in with Apple (iPhone and iPad): if you choose Hide My Email, we receive Apple’s private relay address instead of your real address, and Apple may provide no email address at all; or
• Google.

If you sign in with Apple or Google and an account with the same email address already exists, that sign-in method is added to the existing account; the app tells you before this happens. If you choose Hide My Email, you get a separate account.

What an account keeps

Signed in, your account keeps your optional name and avatar (private, used for your greeting and never shown to other players), your answer history (so a new device knows what you have already answered), your favorites and playlists, and dated records of finished rounds, Daily Challenge days, and challenges you sent (dates and types only, used for the Activity calendar and streaks). Rounds in progress, settings (including the usage statistics choice), notification choices, and challenge links stay on each device. We also record on your account that the app has asked you for a store rating, so it does not ask again; the record contains no rating or review content.

While you are signed in, your votes and mode answers are linked to your account so they count once per person across your devices. They are never shown with your name or email address.

Together (version 2.6 and later)

Together connects you with one person you choose. It needs a free account, so the information in “Optional accounts” above applies. When you invite someone, the app creates a one-time link that expires after 7 days. The link’s web page runs in your browser and does not send the link to us. The person you invite sees your display name and avatar before they accept, and nothing is shared until they confirm.

While you are connected, each of you answers a shared question each day, and Play Together games, on your own. We store your answers, and your partner can see yours only after you have both answered. Your display name and avatar are visible to your partner. If you turn on notifications inside Together, we store a device notification token for reminders; notifications never include anyone’s answer. We also keep counts of Together activity (for example invited, accepted, answered, revealed, and the platform) for operations; they never include answers.

Ending it: either of you can disconnect at any time. Answers that have not yet been revealed are deleted when you disconnect, and already revealed results stay in that pair’s history. In the app, Together ▸ Delete my Together data removes your Together answers, history, reminders and link. Deleting your account (Profile ▸ Delete account) also removes your Together data, including the shared history with that partner.

Together Premium (version 2.6 and later)

Together Premium is an optional auto-renewing subscription sold by Apple or Google. The store handles payment; we do not receive your card or Apple ID details. To provide Premium, the app sends us a reference to your purchase and our server confirms it directly with Apple or Google. We store, linked to your account: the plan (monthly or annual), the subscription state and dates, the price and currency the store reports, the store’s transaction reference, and a refund or cancellation reason category if the store reports one. A pseudonymous billing token, which is not your account ID or email address, is given to the store so it can tie the purchase to the paying account. We use this to provide and restore Premium, to support you, and for accounting. We do not use it for advertising or tracking, and we share it only with Apple or Google as the payment processors.

One subscription covers you and your partner while you are connected. Your partner sees that Premium comes through you; they do not see your payment or purchase details. If you disconnect, Premium stays with the person who bought it. Test purchases made through the stores’ sandbox are stored as test records and are excluded from all revenue figures.

Deleting your account removes the link between you and your purchase record; we keep the record without that link for accounting. Deleting your account does not cancel your subscription: manage or cancel it in your App Store or Google Play subscription settings.

Staff access and operations

A small number of accounts hold staff roles used to review suggested questions and view aggregate reports. Changes to staff roles are logged. We monitor how much unseen question content is left for each kind of question; per-player figures for this monitoring are produced only for players who have usage statistics turned on, and everyone else is counted only in aggregate. Alerts about this go to staff devices as push notifications that contain no player data.

Service providers for Hypothetically Speaking

Supabase hosts the database, sign-in, and server functions. Resend sends sign-in code emails. Apple and Google provide sign-in when you choose them. Apple Push Notification service and Google Firebase Cloud Messaging deliver notifications you allow.

Backups

We keep encrypted backups of the Hypothetically Speaking database for disaster recovery for no more than 90 days, so deleted information can remain in a backup until it is removed on that schedule. The cloud storage we use for these backups can keep a removed backup for up to 30 more days. Our email provider keeps its own delivery logs under its own retention policy.

Deleting Hypothetically Speaking data

If you have an account (version 2.5 and later): delete it in the app under Profile → Delete account. This permanently removes your account, sign-in methods, name and avatar, synced history, favorites, playlists, activity records, and the links between the account and your devices. If you used Sign in with Apple, the app asks you to confirm with Apple again so we can revoke the access Apple gave us; if that fails, nothing is deleted and you can try again. Votes and mode answers already counted are not removed from community totals: they are detached from your account and kept under a new random identifier that is not linked to it. Because an account is identified by its email address, you can also email privacy@brightgrain.net from that address and we will delete the account for you.

Records linked only to an installation ID: these are not tied to any contact details, so an email does not show us which installation it comes from, and details such as a question’s wording or when you used the app do not prove that records are yours. We therefore cannot delete installation-linked votes, suggestions, mode answers, usage events, or app-open counts on request by email, and we will never ask you for your installation key, installation ID, a challenge link or code, or screenshots of your settings. What you can do in the app:

• Usage statistics: turn off Settings ▸ Privacy ▸ Share usage statistics to stop sending them and delete any not yet sent. Events we have received are deleted after 13 months.
• Challenges: cancel an open challenge; every challenge is also deleted automatically as described above.
• Reset all progress is not a deletion of server records. It clears your progress on this device and gives the app a new installation ID, so new records are no longer linked to the old ones. Records already sent stay on our server under the old ID and still count in community totals.

You can still write to privacy@brightgrain.net with any privacy question; we will reply, but we cannot delete records we cannot verify as yours.

3. ThreadCircle

ThreadCircle is a clothes-sharing app for iPhone and iPad, for people aged 13 and over. It requires an account, and the items you add are stored with our provider so they can be shared with your circles. This section describes ThreadCircle version 1.2 and later.

What ThreadCircle stores

• Your account: your email address and a password, which our authentication provider stores only in protected, hashed form.
• Your profile: first name and last initial; date of birth (asked once, to confirm you are at least 13); an avatar color; an optional profile photo; optional clothing sizes and other profile details you choose to add; your time zone; the time of day you prefer reminders; your notification preferences; and when you were last active in the app, which is used to time reminders.
• What you share: the items you list (photos, title, brand, size, color, and notes), which circles each item is shared with, the circles you create or join, announcements you post, and borrow requests with their dates, notes, and status.
• Joining circles: records of attempts to join a circle with a code, used to limit repeated guessing.
• Notifications: if you allow notifications, your device’s push notification token, used only to send ThreadCircle notifications through Apple Push Notification service; the notifications shown in the app; and records of reminders sent, so they are not repeated.
• Reports and blocks: if you report an item, photo, announcement, or person, we store your report, the reason and any details you give, and a copy of the reported text so it can be reviewed. The person reported is not told who reported them. If you block someone, we store that so the block can be applied; they are not told.
• Usage analytics: a small, fixed set of product events (for example, that an item was viewed or a filter was used), recorded on our own backend and linked to your account. These events do not include what you typed, or which item, circle, or person was involved. They are used to understand and improve the app, are not shared with third parties, and are not used for advertising or tracking.

Who can see it

Members of a circle you are in can see your first name and last initial, your profile photo, and the items you have shared with that circle. Items you have not shared with any circle are visible only to you. Someone you have a borrow request with can see that request and the item in it. Your date of birth, email address, and analytics are never shown to other members. If you block someone, you are hidden from each other.

Authorized Brightgrain administrators can access content stored in ThreadCircle, including item and profile photos, to operate the service, review reports, and enforce our community rules. Photos and other content are stored with our provider and are not end-to-end encrypted.

Service providers for ThreadCircle

Supabase hosts ThreadCircle’s accounts, database, and photo storage. Apple Push Notification service delivers notifications. ThreadCircle does not use third-party advertising or analytics services, and it has no in-app purchases.

Keeping and deleting ThreadCircle data

Your information is kept while your account exists. Analytics events are deleted after 13 months.

You can delete your account in the app under Profile → Settings → Delete Account. This cancels your open borrow requests and deletes your account, profile, items and their photos, profile photo, sizes, circle memberships, borrow requests, notifications, device tokens, blocks, reports you made or that concern you, and analytics events. Some things remain for other members without your name attached: circles you created stay available to their other members, an announcement you posted stays in its circle, and notifications other members received about your activity remain in their apps. Deleted information may remain in backups for a limited time.

If you cannot use the app, email support@brightgrain.net from the address linked to your account and we will delete the account for you.

4. Caribbean Seesaw

Caribbean Seesaw is a card game for iPhone and iPad. You can play solo without an account; online play with friends is optional.

Solo play and Game Center

Solo games, your local game history and statistics, and saved games are kept on your device. If you use Game Center, Apple provides leaderboards, achievements, and saved games under Apple’s own terms; Game Center saved games are stored in your iCloud account. We do not receive your Game Center identity.

Online play

Online play uses Sign in with Apple. The app does not ask Apple for your name or email address. To run online games, our provider stores:

• Your account: the identifier Sign in with Apple provides so we can recognize your account.
• Your online profile: the display name and avatar you choose, and the table and card designs you select.
• Games: private lobbies and their six-character join codes, the players in them, the games and Best of 3 matches you play, the moves made, and your results and statistics.
• Reactions: quick reactions you send during a game, chosen from a fixed set. There is no chat. A sent reaction is deleted after about 90 seconds; a short record that you sent it, used to prevent duplicates, is deleted within a day.
• Reports and blocks: if you report or block another player, we store the report and its reason, or the block, so it can be reviewed or applied.
• Notifications: if you allow notifications, your device’s push notification token and a random identifier for your installation of the app (not an advertising identifier), used only to send game notifications through Apple Push Notification service, such as when a game begins, when it is your turn, timeout warnings, and when a game ends. Notifications do not include player names, your cards, or join codes.

Who can see it

Players in a lobby or game with you can see your display name, your avatar, and your play in that game. Your Apple account details are not shown to other players. A join code shared in a link only fills in the Join screen in the app; the web page that opens without the app shows the code and nothing else.

Purchases

Optional theme packs are sold through Apple’s App Store. Apple handles payment, and purchases are tied to your Apple account; we do not receive your payment details.

Service providers for Caribbean Seesaw

Supabase hosts online accounts, games, and server functions. Apple provides Sign in with Apple, Game Center, in-app purchases, and push notification delivery. Caribbean Seesaw does not include third-party analytics or advertising services.

Keeping and deleting Caribbean Seesaw data

Lobbies, join codes, games, moves, results, and statistics are kept while your online account exists; we do not currently delete them on a fixed schedule. Open lobbies that sit idle for about two hours expire, and their join codes stop working.

You can delete your online account from within the app. This revokes the access Sign in with Apple gave us and deletes your sign-in account, profile, device tokens, results, statistics, notification records, reports you made or that concern you, blocks, and lobbies you hosted with their games. Records of games hosted by other players are kept for those players, with your account removed from them. Information stored on your device, in Game Center, or in iCloud is not affected. Deleted information may remain in routine backups for a limited time. To ask about deletion, email privacy@brightgrain.net.

5. Well Worn

Well Worn is a personal wardrobe app for iPhone that is not yet available in app stores. This section describes the version being prepared for release. We will update it if anything changes.

What stays on your device

Well Worn does not use an account, and Brightgrain has no server that receives your Well Worn information. The clothes you add and their photos, your outfits, plans, wear history, likes and dislikes, preferences, and any optional profile details are stored in the app’s own storage on your iPhone. Your iPhone’s iCloud or computer backups may include this storage, depending on your device settings. If you delete the app, this information is deleted with it.

Photos you take or choose are resized and saved again by the app as a new copy; your original photo in the Photos app is not changed.

Permissions

• Camera: used only when you choose to take a photo of a piece of clothing.
• Photos: pictures are chosen through the system photo picker, which gives the app only the pictures you select. The app adds an image to your Photos library only when you choose to save one.
• Location: used only while you are using the app, and only if you choose your current location for live weather.

What leaves your device

• Live weather (optional): weather can be off, entered by you, or live. For a live forecast, the coordinates of the city you choose, or, if you choose your current location, the location your iPhone provides (the app requests only approximate accuracy), are sent to Apple’s weather service. City names you search for, and the coordinates of your current location (to look up its place name), are sent to Apple’s location service. Nothing about your clothes is sent. The forecast, and the place it was requested for, are kept on your device for up to a day. Apple handles these requests under its own terms.
• Things you choose to share: backups, outfit images, and diagnostic files are created only when you ask and are handed to the system share sheet, where you choose where they go. Diagnostic files contain the app version, your device model, counts and storage sizes, and recent error messages; they do not contain photos, names, or locations.

Well Worn does not include analytics, advertising, tracking, or a crash-reporting service.

Deleting Well Worn data

You can delete individual pieces and outfits at any time, or choose Delete all my data at the bottom of the app’s Settings to remove the clothes, photos, outfits, plans, likes, preferences, and saved forecast stored on your phone. Backups you have exported are yours and are not affected. If the app ever finds a wardrobe file it cannot read, it keeps that file in a recovery folder on your phone, so it is not lost, until you delete the app.