Your privacy

Privacy Policy

How Brightgrain LLC handles information in its apps and on this website.

Archived version, replaced on October 30, 2026. Read the current Privacy Policy.

Last updated: October 29, 2026

Overview

Brightgrain LLC (“Brightgrain,” “we,” “us,” or “our”) develops and publishes mobile apps, including Hypothetically Speaking, ThreadCircle, Caribbean Seesaw, and Well Worn. This policy applies to these apps, our website, and other Brightgrain apps, including future apps, unless a separate policy is provided. The general sections apply to every app; the app-specific sections below add details for particular apps and do not replace the rest of this policy.

Information our apps may process

Information you provide

Depending on the app and features you use, you may provide app content such as gameplay activity, scores, progress, answers, favorites, question suggestions, wardrobe listings, item details, group or circle information, requests, and return status. ThreadCircle content may include photos you choose to add to an item listing. Well Worn content, such as photos of your clothes and the outfits you save, stays on your device as described below.

Account and service information

Where an app offers accounts, invitations, or shared features, we may process the information needed to create and maintain your account, authenticate access, connect you with a private group, and provide those features. This may include an email address or other account identifier when requested by the app.

Technical and diagnostic information

We may receive limited technical information, such as device type, operating system and app version, crash logs, and diagnostics. Apple, or for our Android apps Google, may provide this information according to your device and app store settings. If you test a pre-release version of an app through Apple’s TestFlight, Apple may share crash reports and any feedback you choose to send with us, under Apple’s terms.

Purchases

If an app offers in-app purchases, payment is handled by Apple. We do not receive your payment card details.

How we use information

We use information to provide app functionality; save preferences and progress; operate private sharing features; respond to support requests; maintain security; diagnose problems; and improve reliability and usability. We do not sell personal information or use it for third-party advertising.

How information is shared

Content you intentionally add to a shared ThreadCircle circle may be visible to other members of that circle. We may also use service providers to host data, operate app features, distribute apps, and process diagnostics. These providers process information on our behalf under their own terms and privacy commitments. We may disclose information if required by law or when reasonably necessary to protect users, our services, or others.

Storage and retention

Some information is stored locally on your device, while information needed for account or shared features may be stored using our service providers. We retain information only as long as reasonably needed to provide the service, meet legal obligations, resolve disputes, and maintain security. Deleting an app removes locally stored app data but may not delete information stored for shared or account-based features. Contact us to ask about deletion of information associated with you. Challenge a Friend in Hypothetically Speaking follows its own, shorter schedule, described below.

ThreadCircle

This section describes what ThreadCircle (version 1.2 and later) stores and why. It adds to, and does not replace, the rest of this policy.

What ThreadCircle stores

  • Your account: your email address and a password (stored only in protected, hashed form by our authentication provider).
  • Your profile: first name and last initial, date of birth (asked once, to confirm you are at least 13), an avatar color, an optional profile photo, optional clothing sizes, your time zone, and the time of day you prefer reminders.
  • What you share: the items you list (photos, title, brand, size, color, and notes), which circles each item is shared with, the circles you create or join, announcements you post, and borrow requests with their dates, notes, and status.
  • Notifications: if you allow notifications, your device’s push notification token, used only to send ThreadCircle notifications through Apple Push Notification service, and the notifications shown in the app.
  • Reports and blocks: if you report an item, photo, announcement, or person, we store your report, the reason and any details you give, and a copy of the reported text so it can be reviewed. The person reported is not told who reported them. If you block someone, we store that so the block can be applied; they are not told.
  • Usage analytics: a small, fixed set of product events (for example, that an item was viewed or a filter was used) recorded on our own backend and linked to your account. These events do not include what you typed, or which item, circle, or person was involved. They are used to understand and improve the app, are not shared with third parties, and are not used for advertising or tracking.

Who can see it

Members of a circle you are in can see your first name and last initial, your profile photo, and the items you have shared with that circle. Someone you have a borrow request with can see that request and the item in it. Your date of birth, email address, and analytics are never shown to other members. People who moderate ThreadCircle for Brightgrain can see reports and the content they concern. ThreadCircle does not use third-party advertising or analytics services.

Keeping and deleting ThreadCircle data

You can delete your account in the app under Profile → Settings → Delete Account. This permanently deletes your profile, items and their photos, profile photo, sizes, circle memberships, borrow requests, notifications, device tokens, blocks, reports, and analytics events. Analytics events are otherwise deleted after 13 months. If you cannot use the app, email support@brightgrain.net and we will delete the account for you.

Hypothetically Speaking: Challenge a Friend

Challenge a Friend (Hypothetically Speaking 2.1 and later) lets you send one friend a private link so you both answer the same questions and then compare your choices. It works without an account, and it does not ask for your name, email address, phone number, or contacts. This section explains what the feature stores and for how long. It adds to, and does not replace, the rest of this policy.

What we store to run a challenge

  • The questions in the challenge: a copy of the question text and answer options from the app.
  • Your choices, and your friend’s choices as they answer.
  • Three random codes that control access: the code in the invitation link, and one private code for each person. We store only a one-way hash of each code; the codes themselves are kept in the link and on your devices.
  • Dates and a status (created, accepted, completed, cancelled, expired), so a link can expire and be cleaned up.
  • If you turn on alerts, your device’s push notification token (see below).
  • Short-lived anti-abuse counters, described below.

Choices made in a challenge are kept separately from ordinary votes. Your friend’s challenge answers are not added to community results. If you made your own choices by playing a normal round first, those choices were recorded as ordinary votes when you played, as they are for any round; creating a challenge does not record them again.

Who can see the choices, and when

Until your friend has finished the whole challenge, you can see only your own choices and your friend can see only theirs. After your friend submits their answers, the app shows both of you every question with both sets of choices side by side. Choices are not revealed one question at a time. The web page that opens when someone taps the link without the app is the same generic page for every link: it does not show the questions or anyone’s choices, and it does not contact our database.

We do not sell challenge data or use it for advertising. Challenge information is sent between the app and our servers over encrypted (HTTPS) connections, but it is stored in readable form with our database provider and is not end-to-end encrypted, so people with administrative access to that database could technically read it. We do not describe challenge data as anonymous: it is not tied to your name or email address, but it is linked to your devices through the private codes and, if you enable alerts, your push token.

The invitation link

The link works for one friend: the first person who opens it and taps Accept becomes the person who answers, so send it only to the person you mean to challenge. The link’s secret code is part of the web address, so it may appear in logs kept by our hosting provider and by the apps you share it through. These codes are not account passwords and we cannot recover them. If you delete the app or switch phones before a challenge is finished, you cannot get back into that challenge.

Optional alerts and push tokens

Only the person who created a challenge can receive an alert. If you agree, first in the app’s own explanation and then in the iOS permission prompt (on Android 13 and later, Android’s notification permission prompt), the app gives our server your device’s push notification token for that challenge. We use it only to send you one alert when your friend finishes, delivered through Apple Push Notification service on iPhone and iPad, or through Firebase Cloud Messaging on Android. The alert says only that your friend finished; it contains no choices, scores, or link. Your friend is never sent alerts, and we do not ask for their token.

On Android (version 2.4 and later), these alerts are delivered by Firebase Cloud Messaging, a Google service. To deliver one, we send Google only your device’s push token and the alert itself: its fixed text and the challenge’s internal ID, which lets the app open the right comparison and is not the invitation link or any of its codes. The push token itself is issued on your device by Firebase software included in the app. The app uses Firebase only to deliver these alerts: it does not include Firebase Analytics or any other Google analytics or advertising service, and it does not use the Android advertising ID.

We erase the token if you turn alerts off while the challenge is still open, if you cancel the challenge, when the link expires, or if Apple (or, on Android, Google) tells us the token is no longer valid. Once a challenge is completed, the token stays with the completed challenge until it is deleted (30 days after completion), and we send no further alerts for it. You can turn alerts off in the app’s Settings, in iOS Settings under Notifications, or on Android in the app’s notification settings in Android Settings.

Anti-abuse counters

To limit abuse, our servers keep short-lived counters tied to a one-way hash of the network (IP) address a request came from. A hashed address is still derived from your address, so we treat it as personal information. These counters are deleted after about two days.

When challenge data is deleted

Cleanup runs automatically once a day, so each deletion below can happen up to about a day after the time stated.

  • Link not finished: a challenge link lasts 14 days from when it was created. After that it stops working, the choices and any push token are erased, and the remaining record (hashed codes, dates, and status) is deleted 30 days after the link expired.
  • Completed: the whole challenge, including both people’s choices and any push token, is deleted 30 days after your friend finished.
  • Cancelled by you: the choices and any push token are erased right away, and the remaining record is deleted 30 days later.
  • On your phone: the app keeps your private codes and a copy of the comparison so you can reopen it, and removes them on about the same schedule.
  • Backups: our database provider may keep routine backups for a limited time, so deleted data may remain in a backup until it expires.

You can cancel an open challenge yourself in the app, which erases the choices and any push token right away. Every challenge is also deleted automatically on the schedule above. Because the challenge link works like a key to the challenge, we will never ask you to send it to us.

Hypothetically Speaking: install ID, usage statistics, and reminders

Hypothetically Speaking does not have accounts. The first time it runs, the app creates a random installation ID with no name, email address, or other contact details attached. Your ordinary votes, any questions you suggest, and an app-open counter are linked to that ID so the app can count one vote per question per installation and show you your own results. Using Reset all progress clears your progress on this device and starts a new ID; it does not delete anything already sent to our servers (see “Deleting Hypothetically Speaking data” below). On iPhone and iPad, the ID is kept in the device’s keychain, so deleting and reinstalling the app on the same device usually keeps the same ID, and an encrypted or iCloud backup restored to a new device can bring it along. On Android (version 2.4 and later), the app’s data is not included in Android backups, and deleting the app removes the ID, so a reinstalled, new, or restored phone starts with a new ID and without your progress or open challenges.

Installation key (version 2.4 and later)

The app also creates a random secret key for each installation and keeps it only in your device’s secure storage (the iOS keychain, or Android’s keystore). It is sent only to our server, over an encrypted connection, when the app registers your installation ID or uploads something for it; our server stores only a one-way fingerprint of the key, not the key itself. The first key registered for an installation ID becomes that ID’s key. From then on, our server accepts votes, suggestions, mode answers, usage events, and app-open counts for that ID, and shows its suggestions, only to a device that holds the registered key. This shows that a request comes from whoever holds that key; it does not prove who originally created the ID. Installations that have not registered a key do not have this protection: anyone who knows the ID of such an installation could still add votes, suggestions, mode answers, usage events, or app-open counts for it. That includes copies of the app older than version 2.4, and 2.4 installations whose registration has not finished. The key carries no name or contact details and is not used for advertising or tracking. If the app cannot confirm its key, it pauses uploading and keeps your answers on your device.

If another copy of the app has already registered your installation ID with a different key, the app shows Online sync: Paused in Settings. You can then choose Start a new online identity, which gives this device a new installation ID and key after you confirm. Everything on the device is kept. Records already sent under the old ID stay on our server, counted in community results, and are not moved to the new ID; answers still waiting on the device are sent under the new ID, and any that had already reached us are not counted twice.

What other people can see

In the app, other players see only combined totals. Our public interface returns only those totals and, for ordinary votes, the question and option of each vote, with no installation ID or time. Questions people suggest, answers in But There’s a Catch and What’s Your Price?, usage events, challenge choices, and app-open counts cannot be read by others.

Usage statistics (version 2.2 and later)

To learn whether features such as the weekly set, Challenge a Friend, and reminders are useful, the app sends us a small number of usage events linked to the same installation ID: when a play session starts, that a question was answered (not which question or which answer), when a weekly set is started or finished, whether the share sheet was opened, completed, or cancelled and roughly where (for example “Messages” or “other”), challenge steps such as created or completed, changes to notification settings, and which kind of notification was tapped (for playful reminders, which message). These events never include question text, your answers, challenge links or codes, notification text, or anything you type. They are not used for advertising, are not shared with data brokers, and are not combined with data from other companies’ apps or websites. Raw events are deleted after 13 months. You can turn this off at any time in the app under Settings ▸ Privacy ▸ Share usage statistics; doing so also deletes any events not yet sent.

But There's a Catch and What's Your Price? (version 2.3 and later)

When you finish a scenario in these modes, the app stores your choices linked to the same installation ID, the same way it stores ordinary votes: for But There's a Catch, your choice before the catch and your choice after it; for What's Your Price?, the offer you picked or that you refused every offer. Only your first finished answer to each version of a scenario is kept; replays are not stored again. Other players see only combined totals, never anyone's individual answers. The dollar amounts are hypothetical: nothing is bought, sold, or paid, and no payment information is involved.

The usage events described above also include when a round of these modes starts or finishes, that a catch was shown, whether a catch changed your choice (not which choices), that a price was picked (not which one), and when a playlist is created, started, or finished (not its name or questions).

Playlists

Playlists you make in the app are saved only on your device. Their names and contents are not sent to us. Deleting the app deletes them.

Reminders

The daily challenge reminder and the optional playful reminders (four a day) are scheduled on your device by the app. They are off unless you turn them on, and turning them on does not send anything to our servers apart from the usage events described above. iOS or Android may delay or silence any notification according to your settings. On Android 13 and later, Android asks for your permission before the app can show reminders or alerts.

Weekly set and shared questions

The app downloads the current weekly set of questions from our servers. Anyone can read it; downloading it does not identify you. If you share a question, the link contains only the question’s public catalog number, not your answer.

Deleting Hypothetically Speaking data

Because the app has no accounts, an email does not show us which installation it comes from, and details such as a question’s wording or when you used the app do not prove that records are yours. We therefore cannot delete votes, suggestions, mode answers, usage events, or app-open counts on request by email, and we will never ask you for your installation key, installation ID, a challenge link or code, or screenshots of your settings. What you can do in the app:

  • Usage statistics: turn off Settings ▸ Privacy ▸ Share usage statistics to stop sending them and delete any not yet sent. Events we have received are deleted after 13 months.
  • Challenges: cancel an open challenge; every challenge is also deleted automatically as described above.
  • Reset all progress is not a deletion of server records. It clears your progress on this device and gives the app a new installation ID, so new records are no longer linked to the old ones. Votes, suggestions, mode answers, usage events, and app-open counts already sent stay on our server under the old ID, without your name or contact details, and still count in community totals.

You can still write to privacy@brightgrain.net with any privacy question; we will reply, but we cannot delete records we cannot verify as yours.

Caribbean Seesaw

This section describes what Caribbean Seesaw stores and why. It adds to, and does not replace, the rest of this policy.

Solo play

You can play solo against computer opponents without an account. If you use Game Center, Apple provides features such as leaderboards, achievements, and saved games under Apple’s own terms; Game Center saved games are stored in your iCloud account.

Online play

Online play is optional and uses Sign in with Apple. To run online games, our service provider stores:

  • Your account: the sign-in information that Sign in with Apple provides so we can recognize your account.
  • Your online profile: the display name and avatar you choose, and the table and card designs you select.
  • Games: private lobbies and their six-character join codes, the games you play, the moves made in them, and your results and statistics.
  • Reactions: the quick reactions you send during a game, chosen from a fixed set. There is no chat, and reactions are deleted shortly after they are sent.
  • Reports and blocks: if you report or block another player, we store that so it can be reviewed or applied.
  • Notifications: if you allow notifications, your device’s push notification token and a random identifier for your installation of the app (not an advertising identifier), used only to send game notifications, such as when a game begins, when it is your turn, timeout warnings, and when a game ends, through Apple Push Notification service. Notifications do not include your cards or join codes.

Who can see it

Players in a lobby or game with you can see your display name, your avatar, and your play in that game. Your Apple account details are not shown to other players. A join code shared in a link only fills in the Join screen in the app; the web page that opens without the app shows the code and nothing else.

Deleting Caribbean Seesaw data

You can delete your online account from within the app. This deletes your sign-in account and the profile, device tokens, results, statistics, and notification records associated with it. Some records may be kept where needed for the integrity of games other players took part in, or for safety reports, and may remain in routine backups for a limited time. To ask about deletion, email privacy@brightgrain.net.

Well Worn

Well Worn is a private wardrobe app for iPhone that is currently in development. This section describes how it is being built. If anything changes before or after release, we will update this policy.

What stays on your device

Well Worn does not use an account, and we do not have a server that receives your Well Worn information. The clothes you add, their photos, your outfits, wear history, likes, plans, preferences, and any optional profile details are stored in the app’s own storage on your iPhone. If you delete the app, this information is deleted with it.

Photos you take or choose are resized and saved again by the app; that copy does not keep embedded details such as the location where the picture was taken. Your original photo in the Photos app is not changed.

Permissions

  • Camera: used only when you choose to take a photo of a piece of clothing.
  • Photos: pictures are chosen through the system photo picker, which gives the app only the pictures you select. The app saves an outfit image to your Photos library only when you choose to save it.
  • Location: used only while you are using the app, and only if you choose your current location for live weather.

What leaves your device

  • Live weather (optional): if you turn on live weather, the coordinates of the city you choose, or your approximate location (about one kilometer) if you choose your current location, are sent to Apple’s weather service to get a forecast. City names you type to find a location are sent to Apple’s location service. Nothing about your clothes is sent. The forecast, and the location it was requested for, are kept on your device for up to a day. Apple handles these requests under its own terms.
  • Things you choose to share: backups, outfit images, and diagnostic files are created only when you ask and are handed to the system share sheet, where you choose where they go. Diagnostic files do not contain photos, names, or locations.

Well Worn does not include analytics, advertising, tracking, or a crash-reporting service.

Deleting Well Worn data

You can delete individual pieces and outfits at any time, or use Settings ▸ Privacy ▸ Delete all my data to remove everything Well Worn has stored on your device. Backups you have exported are yours and are not affected.

Hypothetically Speaking: accounts, sync, and operations (version 2.5 and later)

This section adds to, and does not replace, the rest of this policy. Everything in Hypothetically Speaking works without an account.

Optional accounts

If you create an account, we store an account ID, the sign-in method you used (an emailed one-time code, Sign in with Apple, or Google), and your email address. If you choose Hide My Email with Apple, we receive Apple’s private relay address instead of your real address, and with Apple an email address may not be provided at all. Accounts have no passwords. We email you a six-digit code that expires after one hour. If you sign in with Apple or Google and an account with the same email address already exists, the sign-in method is added to that account; the app tells you this before it happens. If you choose Hide My Email you get a separate account.

What an account syncs

Signed in, your account keeps: your optional name and avatar (private, used for your greeting and never shown to other players), your answer history (so a new device knows what you have already answered), favorites and playlists, and dated records of finished rounds, Daily Challenge days and challenges you sent (dates and types only, used for the Activity calendar and streaks). Rounds in progress, settings, notification choices and challenge links stay on each device.

Votes stay anonymous

Votes count once per person, including across your devices, and are never shown with your name or email. Deleting your account does not remove votes already counted; they are detached from you and kept under a random identifier that is not linked to your account.

Deleting your account

You can delete your account in the app under Profile → Delete account. This permanently removes your account, sign-in methods, name and avatar, synced history, favorites, playlists, activity records and device links. If you used Sign in with Apple, the app asks you to confirm with Apple again so we can revoke the token Apple gave us; if that fails, nothing is deleted and you can try again. We keep encrypted backups of our database for disaster recovery for no more than 90 days, so deleted information can remain in a backup until it is removed on that schedule; the cloud storage we use can keep a removed backup for up to 30 more days. Our email provider keeps its own delivery logs under its own retention policy. You can also email privacy@brightgrain.net and we will delete the account for you.

Installation and version information

Each installation tells us its app version and build, platform, operating system version and whether notifications are allowed, so we can see which versions are in use. This is tied to the installation, not to your account, and uses no advertising identifier.

Store rating request

We record that the app has asked you for a store rating once, so it does not ask again. The record contains no rating or review content.

Staff access and operations

A small number of accounts hold staff roles used to review content and view aggregate reports. Changes to staff roles are logged. We monitor how much unseen question content is left for each kind of question. Per-player figures for this monitoring are produced only for players who have turned analytics on; everyone else is counted only in aggregate. Alerts about this go to staff devices as push notifications that contain no player data.

Service providers for these features

We use Supabase to host the database, authentication, and server functions; Resend to send your sign-in code email; Apple and Google when you choose to sign in with them; Apple Push Notification service and Google Firebase Cloud Messaging to deliver notifications you allow. We do not sell this information or use it for advertising.

Your choices

You may choose not to provide optional information, though some features may then be unavailable. You can manage camera, photo, location, and notification access, and diagnostic sharing, in your Apple device settings or, for our Android app, in Android Settings. You may contact us to request access to, correction of, or deletion of personal information associated with you, subject to applicable law and our need to verify the request.

Children’s privacy

Our apps are not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, please contact us so we can take appropriate action.

Security

We use reasonable administrative, technical, and organizational measures intended to protect information. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.

Website privacy

This website is informational. We do not intentionally use advertising trackers or collect information through forms. Our hosting provider may process limited request information, such as IP address, browser details, and access logs, to deliver and protect the site.

Changes to this policy

We may update this policy as our apps or practices change. We will post the revised policy here and update the date at the top of this page.

Contact us

For privacy questions or requests, email privacy@brightgrain.net.