Briefly

Privacy Policy

Last updated: 8 October 2026

1. Who we are

Briefly is operated by Locryn Thomas, a sole trader based in the United Kingdom. Our contact email is hello@brieflynews.org. This policy covers both the Briefly web app at brieflynews.org and the Briefly iOS app — they share the same account and backend service.

2. What we collect

We collect the following categories of personal data:

  • Account data — your name and email address and the sign-in identity you use: Google on the web; Google, Sign in with Apple or an emailed sign-in link in the iOS app. If you use Sign in with Apple, we also keep your Apple user identifier and an Apple token, encrypted, solely so we can revoke Briefly's Sign in with Apple access when you delete your account.
  • Connected source data — with your explicit permission, we read email senders, subjects and Gmail's short preview of each message, calendar event titles and times, Notion page titles, and Stripe and Shopify revenue summaries (including Shopify's top-selling products). We never read full email bodies, attachments or passwords. Slack and GitHub connections made on the web are no longer read for briefs; their access stays with Nango until you disconnect them or delete your account.
  • What you tell Briefly — the descriptions, schedules and delivery choices for your briefs, your goals, the preferences and context in your memory (and a history of changes to it), and replies you send to a brief.
  • Generated briefs — each brief Briefly writes for you, its short notification summary and its delivery status, stored so you can review past briefs.
  • Device and notification data — if you enable notifications, an Expo push token with your device platform and model name in the iOS app, or a web push subscription in your browser, used solely to deliver brief notifications. The voice input offered during onboarding is your device's own keyboard dictation — the Briefly app does not record or process audio.
  • Purchase and billing data — iOS in-app purchases are processed by Apple and managed through RevenueCat, which receives the purchase details and Briefly's internal user id, never advertising identifiers. Web subscriptions are processed by Stripe. We keep the resulting subscription status and a log of billing events.
  • Support requests — the name, email address and message you send us.
  • Technical and security data — IP address, browser or device type, a sign-in security log kept by our authentication service, records used to enforce usage limits and AI spending limits, and error reports.
  • Usage analytics — on the web, Google Analytics and PostHog run in your browser only after you accept our cookie banner. Separately, our servers send PostHog a small set of product events linked to your Briefly user id — signing up, connecting or failing to connect a source (including from the iOS app), setting up a brief from a description, editing memory, contacting support, and starting or cancelling a web subscription. The iOS app itself contains no analytics or advertising SDK and does not track you.

3. How we use your data

We use your data to:

  • Compose your personalised briefs and set them up from your description
  • Store your preferences and memory so briefs improve over time
  • Send you your brief and transactional emails (billing, account alerts)
  • Deliver brief notifications to your device, if you enable them
  • Send your brief to Telegram, if you choose that delivery method
  • Process payments via Stripe on the web, or via Apple in-app purchase (managed by RevenueCat) on iOS
  • Enforce usage limits, prevent abuse and keep our AI costs within set limits
  • Understand how the product is used, monitor service health and fix bugs
  • Carry out account deletion, including revoking access you granted to connected services and to Sign in with Apple

4. AI processing and our sub-processors

Nothing is sent to an AI provider until you have agreed to AI processing — during onboarding, or later in Settings. Depending on what you ask Briefly to do, the following is included in requests to AI providers:

  • Writing a brief — your name, the brief's plan, the connected-source data described above, your goals and your memory notes.
  • Setting up a brief — the description you type and which sources you have connected.
  • Handling a reply — the text of your reply.
  • Writing a notification — the text of the brief it announces.

We use:

  • Anthropic (Claude) — writing briefs during the free trial and on the Pro plan, and setting up briefs from your description. Privacy policy.
  • OpenAI (GPT-4o-mini) — writing briefs on the Starter plan, handling replies, and writing notification summaries. Privacy policy.

Under their API terms, neither Anthropic nor OpenAI uses data submitted through their APIs to train their models by default. Standard Contractual Clauses apply to these international transfers.

Our other sub-processors include:

  • Supabase — database, authentication and encrypted secret storage (hosted in the UK, in London)
  • Vercel — application hosting (US)
  • Resend — transactional email delivery (US)
  • Google — Google sign-in, Gmail and Calendar access with your permission, and Google Analytics on the web after cookie consent (US)
  • Apple — Sign in with Apple and iOS in-app purchases; your App Store subscription is billed, renewed and cancelled under Apple's own terms
  • Stripe — payment processing on the web, and revenue data if you connect your Stripe account (US)
  • Notion and Shopify — workspace and store data access, with your permission
  • Slack and GitHub — only if you connected them on the web; no longer read for briefs
  • Nango — holds the OAuth access you grant to connected accounts and proxies our reads from them; access is revoked when you disconnect a source or delete your account
  • Sentry — error monitoring, which may include technical metadata such as your IP address; on the web app, Sentry also records session replay (up to 5% of sessions, and any session in which an error occurs), in production only
  • PostHog — product analytics: in your browser after cookie consent, and the server-side events described above, linked to your account
  • Upstash — short-lived rate-limit counters for support requests
  • Telegram — if you choose Telegram as your delivery method, we send your brief text to your Telegram chat via the Telegram Bot API
  • RevenueCat — manages iOS in-app purchase entitlements; receives your purchase details and Briefly's internal user id, never advertising identifiers
  • Expo — delivers push notifications to the iOS app using your device's push token

5. Legal basis

We process your data on the following legal bases:

  • Contract performance — processing your account data and connected source data is necessary to provide the Briefly service you signed up for.
  • Consent — sending your data to AI providers for brief generation. You consent to this during onboarding and may withdraw consent at any time via Settings → Privacy. Withdrawing consent will pause brief generation.
  • Legitimate interests — security monitoring and service improvement, where this does not override your rights.

6. Data retention and deletion

While your account exists we keep your profile and sign-in identities, brief settings, memory (and its change history), goals, connections, notification tokens and subscription status. Our cleanups run once a day, so each period below can run up to about a day longer:

  • Generated briefs and replies to them are kept for 12 months.
  • Records of individual AI requests are kept for 7 days, records of brief generation attempts for 30 days after they finish, test-email records for 2 days, our scheduled-job logs for 7 days, and sign-in security log entries for 30 days.
  • AI spending records — your user id, the operation, the AI model, token counts and cost, never content — are kept until about 91 days after the request was made and sent, so they cover every spending limit period.
  • If email replies are enabled, a record of each email reply received (to stop it being applied twice) is kept until a day after the reply link it used expires. Reply links last at most 90 days, so such a record can remain for about 92 days.

When you delete your account, we immediately delete your sign-in account and sessions, profile, briefs and their history, replies, memory, goals, connections, notification tokens, subscription status and the support requests you sent while signed in. We then clean up at other services automatically, normally within a day: we revoke every connected-account grant at Nango; cancel any active web (Stripe) subscription immediately, without a refund or proration; delete your RevenueCat customer record; revoke Briefly's Sign in with Apple access; and ask PostHog to delete your analytics profile and events (PostHog deletes events in its own scheduled batches). If a service is unavailable we keep retrying for about five days and then follow up by hand. If you used Sign in with Apple but we do not hold an Apple token for your account (for example, an account created before we kept one), we tell you how to remove Briefly in your Apple settings yourself.

What remains after deletion:

  • Stripe keeps your customer record, invoices and payments for refunds, disputes and accounting, under Stripe's own retention; our billing event log keeps Stripe and App Store transaction identifiers without any link to your account.
  • A deletion record — your user id and the identifiers we need to finish the cleanup — is kept until 30 days after the cleanup is complete, or longer while an item needs follow-up.
  • The AI spending and email-reply records above remain, without your other data, until their periods end.
  • Resend keeps copies of emails we sent you for 30 days. Our database provider's encrypted backups, which may contain your data, expire within 30 days.
  • Error reports already in Sentry follow Sentry's retention schedule; browser analytics in Google Analytics follow the retention period set for our Google Analytics property.
  • Support requests sent without signing in are not linked to your account and are not deleted automatically; email us to have them removed.

If you subscribed through the iOS App Store, deleting your Briefly account does not cancel that subscription — Apple does not allow apps to do this on your behalf. Cancel it in your Apple subscription settings.

7. Your rights

Under UK GDPR, you have the right to:

  • Access — request a copy of your data
  • Rectification — correct inaccurate data
  • Erasure — request deletion of your data
  • Portability — receive your data in a machine-readable format
  • Withdraw consent — stop AI processing at any time
  • Complain — lodge a complaint with the ICO

Exercise any of these rights via Settings → Privacy & Data on the web, via Settings → Account & data → Delete account in the iOS app, or by emailing hello@brieflynews.org.

8. International transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the UK, we rely on Standard Contractual Clauses approved by the UK Information Commissioner.

9. Children

Briefly is intended for users aged 16 and over. We do not knowingly collect data from anyone under 16.

10. Changes to this policy

If we make material changes, we'll notify you by email at least 30 days before the changes take effect. Continued use after that date constitutes acceptance.

11. Contact

For any privacy-related questions, email hello@brieflynews.org.

Effective date: 8 October 2026.

Terms of ServiceBack to home