Privacy Policy

01 Who we are

BrainScribe is a voice-first writing coach built to help middle and high school students — especially those with ADHD — get their ideas out of their heads and onto the page. We operate at brainscribe.io and are based in the United States.

Questions about this policy? Email us at brainscribe.io@gmail.com. We respond to all privacy inquiries within 5 business days.

02 What we collect — and why

We collect only what we need to provide the service:

• Account information — name and email address, provided when you sign in with Google. This information is used solely to identify your account and send service-related messages. It is not used for advertising, sold to third parties, or combined with data from other services.
• Assignment content — the text of writing assignments students enter. Used to generate the coaching session and outline.
• Voice and spoken text — when a student speaks, their audio is transcribed. We store the transcription, not the audio. Audio is processed in real time and not retained.
• Session transcripts — the full dialogue between the student and the AI coach. Stored so students, and their linked parents and teachers, can review the session. We may also review transcripts — including with automated tools — to monitor the AI coach’s quality and to help keep students safe.
• Written paragraphs — the scribed essay sections that result from each coaching session.
• Relationship data — which parents are linked to which students, and which teachers are connected to which assignments. Used only to provide dashboard access.

We do not collect Social Security numbers, payment card numbers (payments are handled by Stripe), school records beyond what you provide, or any biometric data.

03 Children's privacy (COPPA)

If a user is under 13: BrainScribe requires verifiable parental consent before a student under 13 can access the service. We do not knowingly permit children under 13 to use BrainScribe without a parent or guardian's approval.

How the age gate works: When a new user signs up, we ask them to self-declare whether they are 13 or older or under 13. If a student indicates they are under 13, their account is immediately blocked. They are asked to provide a parent or guardian's email address. We then send the parent a consent email containing a secure approval link.

The parent must sign in with their own Google account and check two consent boxes confirming their relationship to the student and agreeing to this Privacy Policy. Only after that approval is the student's account activated.

7-day deletion window: If parental consent is not completed within 7 days of the student signing up, the student's account and all associated data are automatically deleted. The student can sign up again at any time and restart the process.

Note on Google sign-in: When a user signs in with Google, their name and email address are received from Google before the age declaration step. If an under-13 student does not receive parental consent within 7 days, this data is permanently deleted.

BrainScribe is designed for middle and high school students, which means many of our users may be between 13 and 17. We treat all student accounts with the same protections regardless of age:

• Student data is never used for advertising or marketing.
• Student data is never sold to third parties.
• Session transcripts and essays are private to the student, their linked parents, and their linked teachers.
• Parents can request a full export or deletion of their child's data at any time by emailing brainscribe.io@gmail.com.

04 Student education records (FERPA)

BrainScribe acts as a school official or service provider when used in an educational setting, consistent with FERPA. Student education records are:

• Used only to provide and improve the coaching service.
• Not disclosed to third parties without consent, except as permitted by FERPA.
• Not used for behavioral advertising.
• Accessible to the student and their connected parents and teachers within the platform.

05 How we share data

We share data in the following limited circumstances only:

• Anthropic (Claude AI) — Assignment text and session history are sent to Anthropic's API to generate coaching responses. Anthropic does not train on API inputs by default. See Anthropic's privacy policy.
• ElevenLabs — Coach response text is sent to ElevenLabs to generate voice audio. See ElevenLabs' privacy policy.
• Supabase — Our database and authentication provider. Data is stored in Supabase's infrastructure. See Supabase's privacy policy.
• Resend — Used to send notification emails to teachers and parents. No student content is included in these emails.
• Legal requirements — We may disclose information if required by law, court order, or to protect the rights and safety of our users.

We do not sell your data. We do not share your data for advertising. We do not use student data to build profiles for any purpose outside of BrainScribe.

06 Google API Services — Limited Use disclosure

BrainScribe's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically, information received from Google Sign-In (your name and email address) is used only to:

• Create and authenticate your BrainScribe account.
• Identify you within the app and associate your sessions, essays, and settings with your account.
• Send you service-related emails (e.g. teacher invite confirmations, parental consent requests).

We do not use Google user data to serve advertising, do not transfer it to third parties except as necessary to operate BrainScribe (as described in How we share data), do not allow humans to read it unless you have given us explicit permission or it is required for security or legal compliance, and do not use it for any purpose that is not disclosed in this privacy policy.

07 Data retention and deletion

• Active accounts: data is retained as long as the account is active.
• Deleted accounts: all personal data is permanently deleted within 30 days of account deletion.
• Under-13 accounts pending parental consent: if consent is not given within 7 days of sign-up, the account and all associated data are permanently deleted automatically.
• Session transcripts: retained unless the student or parent requests deletion.
• Voice transcriptions: stored as text. Audio is not retained.

To request deletion of your data or your child's data, email brainscribe.io@gmail.com with the subject line "Data deletion request." We will confirm and complete the deletion within 10 business days.

08 Security

We use industry-standard security practices: all data is encrypted in transit (TLS) and at rest. Authentication is handled through Google OAuth. Database access is protected by row-level security policies — meaning each user can only access their own data.

No system is perfectly secure. If you believe your account has been compromised, contact us immediately at brainscribe.io@gmail.com.

09 Your rights

Depending on where you live, you may have the right to:

• Access a copy of the personal data we hold about you.
• Correct inaccurate data.
• Delete your data (right to be forgotten).
• Export your data in a portable format.
• Opt out of any non-essential data processing.

To exercise any of these rights, email us at brainscribe.io@gmail.com. Parents may exercise these rights on behalf of their children.

10 Cookies

We use a single authentication session cookie to keep you logged in. We do not use advertising cookies, tracking pixels, or third-party analytics that identify individual users. We do not use cookies to track students across other websites.

11 Changes to this policy

If we make material changes to this policy, we will notify users by email and update the "Last updated" date at the top. Continued use of BrainScribe after changes take effect constitutes acceptance of the revised policy.

12 Contact us