Privacy Policy
The German version of this privacy policy is the legally binding one. This translation is provided for your convenience.
This policy describes which data the Brief-ly app and this website process, why, and what rights you have. In short: your letters stay on your iPhone. To understand a letter, the scan is sent to an AI service for a few seconds and is not stored there. We do not run a server on which your letters are kept.
1. Controller
Mohammad Al Qudah · Rebmannsweg 3 · 79539 Lörrach · GermanyEmail: [email protected]
2. Data in the app
2.1 Scans, summaries and folders
When you scan a letter, the app creates a PDF file from the camera images. This file, the summary, detected deadlines, notes and the folder structure are stored exclusively on your iPhone (legal basis: Art. 6(1)(b) GDPR – providing the app function). If you switch on “Also save letters to iCloud Drive” in Settings, the files are additionally stored in your own iCloud account with Apple; Apple’s privacy terms apply to that. We have no access to it.
2.2 Transfer to the AI service
To understand a letter, the scan (as a PDF) is transmitted together with your chosen language, the names of your folders and – if you have entered them – the profile names (e.g. “Me”, “Partner”, “Child”, “Company”) via a relay operated by us (Cloudflare Workers, Cloudflare Inc.) to Anthropic PBC, San Francisco, USA. Anthropic generates the summary from it and sends it back. Under the API terms, Anthropic does not use the content to train AI models and does not store it permanently after processing (retention for abuse monitoring: at most 30 days under Anthropic’s policies). The legal basis is Art. 6(1)(b) GDPR; the transfer to the USA relies on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses. Letters often contain special categories of personal data (e.g. health or religious information); by scanning a letter you expressly consent to the processing of such data for this purpose (Art. 9(2)(a) GDPR). You can withdraw your consent at any time by not scanning any further letters.
2.3 Usage counter and device ID
The relay counts how many letters have been read by a device, in order to apply the five free letters and the subscription and to prevent abuse. For this, the app generates a random eight-character device ID on first launch; it does not allow any conclusions about you or your iPhone. Stored are: device ID, total number of letters, number per day and subscription status (Art. 6(1)(b) and (f) GDPR). The content of letters is not stored there. For technical reasons Cloudflare processes your device’s IP address.
We also count anonymously how many letters are read in which app language, and how many new users and subscriptions there are per language and month. These totals contain no device ID and allow no conclusions about you (Art. 6(1)(f) GDPR – improving and targeting our offer).
2.4 Calendar, reminders and notifications
If you allow it, the app adds detected deadlines to the “Post & Fristen” calendar and to the Reminders app on your iPhone and sends local notifications three days before, one day before and on the day of the deadline. This data does not leave your device (apart from your own iCloud sync). You can revoke the permissions at any time in the iPhone settings.
2.5 Face ID
The optional app lock uses Face ID or the device passcode through Apple’s interface. Biometric data is processed exclusively by iOS; the app only receives the information “successful” or “not successful”.
2.6 Subscription and payment
Purchases are made through Apple’s App Store. We do not receive any payment data, only the information whether a valid subscription exists. Apple’s privacy terms apply.
2.7 Feedback
If you share a report via “Send beta feedback”, it contains usage counters and your notes on misclassifications (without letter contents). It is sent through the program you choose (e.g. Mail); we process the report only to improve the app (Art. 6(1)(f) GDPR).
2.8 No analytics, no advertising
The app contains no tracking or analytics services and no advertising. Crash reports are transmitted only via Apple (TestFlight/App Store) if you have agreed to this in the iOS settings.
3. This website
When you visit this website, the hosting provider (Cloudflare Inc.) processes technically necessary data such as IP address, time, page requested and browser type in server logs (Art. 6(1)(f) GDPR – secure operation). No cookies are set and no analytics services are used. Fonts are loaded from Google Fonts (Google Ireland Ltd.); your IP address is transmitted to Google in the process. If you write to us by email, we store the message in order to handle your request.
4. Storage period
Data in the app remains until you delete it – individually or via “Delete all data” in Settings; deleting the app removes it completely. Counters linked to the device ID are deleted at the latest 12 months after last use. Server logs of the website are deleted after 7 days.
5. Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR) and the right to lodge a complaint with a supervisory authority, e.g. the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg (Landesbeauftragter für den Datenschutz und die Informationsfreiheit Baden-Württemberg). Because your letters are stored only on your device, you can exercise most rights directly in the app. For anything else, write to [email protected].
6. Children
Brief-ly is intended for adults. We do not knowingly collect data from children under 16.
7. Changes
We update this policy when the app or the legal situation changes. You can find the current version in the app under Settings and on this page.
As of: October 2026