Privacy policy

This Privacy Policy explains how Storm Force LLC ("Storm Force," "we," "us," or "our") handles personal information in connection with Bruner and its websites, apps, and related services (the "Service").

The Service is intended only for adults eighteen (18) years of age or older. We do not knowingly collect personal information from anyone under eighteen. By using the Service, you confirm that you are at least eighteen.

This Privacy Policy does not apply to third-party websites, applications, or services that we do not operate (even if linked from or integrated with the Service), to information you choose to make public, or to data processed only on your device and not transmitted to us.

Storm Force LLC, a Delaware limited liability company
440 North Barranca Avenue #3979, Covina, California, 91723, United States of America

Questions, requests, or complaints: privacy@withbruner.com

Depending on how you use the Service, we collect:

• Account and identity information — your email address, and, if you create an account, a username or display name, your name, and either a password (stored only in hashed form) or the sign-in details provided by a single sign-on provider such as Google. We also store your timezone and, on mobile, a device token used to send notifications.
• Device and log data — your IP address, browser or app version, the general region derived from your IP address, and basic activity logs.
• Your inputs and content — the prompts, questions, exercise answers, and files or documents you submit (and text we extract from them), and the responses the Service generates for you.
• Learning and progress data — your activity, progress, and mastery and spaced-repetition state, together with insights about your learning, some of which are generated by the Service to personalize your experience.
• Usage data — how you interact with the Service, such as features used, sessions, and events.
• Payment information — if you purchase a subscription, your subscription status and entitlements. Payments are processed by our Merchant of Record (identified at checkout), which handles billing and your payment details; we don't collect or store your full card or bank-account details.
• Communications — messages you send us, such as support requests and feedback.

Please don't submit health information, financial-account details, government identification numbers, or other sensitive or confidential information through the Service. Storm Force is not a HIPAA covered entity or business associate, is not a "financial institution" under the Gramm-Leach-Bliley Act, and is not an "educational agency or institution" under FERPA, and the Service is not designed for regulated categories of data.

We use the information described above to provide, operate, maintain, secure, and improve the Service; to develop new features and services; to conduct analytics and research; to personalize your experience; to process your subscription; to communicate with you; to detect and prevent fraud, abuse, and security incidents; to establish, exercise, or defend legal claims and comply with the law; and for other purposes compatible with these, that we disclose to you, or for which we have a lawful basis.

We use some automated processing to operate the Service — for example, to score your progress, schedule reviews, and personalize content. This does not produce legal or similarly significant effects about you, and you can override these outputs within the Service.

AI and third-party providers. We don't use your content to train our own AI models, though we and our service providers may review and analyze your content — including through logging and observability tools — to operate, debug, secure, and improve the Service. To run the Service, your inputs and content are sent to third-party providers — including AI providers used to generate responses, moderate content, extract text from documents you upload, and power search and retrieval — who process them under their own terms, which we don't control and which may change, and which may allow them to use your inputs to operate and improve their services. Please don't submit confidential or sensitive information through the Service that you wouldn't want processed by a third-party provider.

We use cookies and similar technologies to keep you signed in, remember your preferences, secure the Service, and measure usage. Where required by applicable law, we will ask for your consent before setting non-essential cookies. You can also control cookies through your browser settings.

We don't sell your personal information, and we don't "share" it for cross-context behavioral advertising (as those terms are defined under U.S. state privacy laws). We share information only as described here:

• Service providers who help us run the Service — for example, hosting and storage, email delivery, analytics and product monitoring, and the AI and related providers described in Section 4 — who may use it only to provide services to us.
• Authorities, courts, and others, where we believe in good faith that disclosure is required by law or legal process, or is reasonably necessary to enforce our Terms or to protect the rights, safety, or property of Storm Force, our users, or others.
• A successor, in connection with a merger, acquisition, financing, reorganization, or sale of assets, in which case information may be transferred as part of that transaction.
• With your consent, or as otherwise required or permitted by applicable law.

We may also create, use, share, license, publish, and commercialize aggregated or de-identified information that no longer identifies you (which is not personal information), without restriction.

The Service may also link to or integrate with third-party services we don't control; this Privacy Policy doesn't cover them, and you should review their own privacy notices.

These are the third parties that process personal information on our behalf to run the Service. We keep this list current; when we add a provider that handles your content in a materially new way, we will update this section and revise the "Last updated" date.

Providers that receive your inputs and content

• Anthropic (United States) — generates tutor responses and course material.
• OpenAI (United States) — checks content against safety policies.
• Mistral AI (France) — extracts text from documents you upload.
• Voyage AI (United States) — converts your material into embeddings so the Service can retrieve relevant passages.
• Exa (United States) — web search used to enrich explanations. Search queries derived from your topic are sent; your uploaded documents are not.
• Judge0, accessed through RapidAPI (United States) — runs code you submit in programming exercises, in an isolated sandbox. Judge0 controls how long submitted code is retained, and we have not independently verified its retention period. Code you send to a programming exercise leaves our systems and we cannot guarantee its deletion there. Please don't put personal or confidential information in code you submit.

Infrastructure and operations

• Render (hosting and managed database — servers located in Frankfurt, Germany).
• Cloudflare (content delivery, DNS, and object storage for uploaded materials, data exports, and backups — storage located in Western Europe).
• PostHog (product analytics, error monitoring, and opt-in session replay — EU region). Session replay records screen layout and interactions only; text is masked on your device before it is sent.
• Langfuse (monitoring of AI requests, to debug and improve quality — EU region).
• Resend (United States) — sends transactional and account emails, including the text of a note you leave when rating an AI response.
• Expo (United States) — delivers push notifications to your device.
• Upstash (United States) — rate-limits requests to the waiting-list form.

Payments and sign-in

• Our Merchant of Record (identified at checkout) processes payments, handles your card details, and is the seller of record for your purchase. We receive only your subscription status and entitlements.
• If you sign in with Google or Apple, that provider tells us the sign-in details you approve. They act as your identity provider under their own privacy policies, not as our service provider.

We operate the Service primarily from the European Union — our servers, database, and file storage are located in Germany and Western Europe, and our analytics and monitoring providers are configured to their EU regions.

Some of the providers listed in Section 7 are located in the United States, so using the Service involves transferring personal information there and to other countries whose data-protection laws may differ from those where you live. Where we transfer personal information out of the EEA, the UK, or Switzerland to a country without an adequacy decision, we rely on appropriate safeguards — generally the European Commission's Standard Contractual Clauses (with the UK Addendum or Swiss equivalent as applicable) in our agreements with those providers.

You can ask us for more information about these safeguards at privacy@withbruner.com.

We use reasonable measures to protect your information, but no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security. Please safeguard your account credentials and tell us at security@withbruner.com if you suspect any unauthorized access to your account. If a data breach gives rise to a legal notification obligation, we will notify affected individuals and authorities as required by applicable law.

We keep personal information for as long as we need it to provide the Service and for legitimate business or legal purposes — such as security, fraud prevention, resolving disputes, defending legal claims, and meeting tax and recordkeeping obligations — and otherwise as required or permitted by applicable law. When we no longer need it, we delete or de-identify it.

Reporting an AI response. If you report an AI response as inappropriate, we store the reason you select, a copy of the reported message, any note you add, the date, and — if you have session replay turned on — a reference to the replay of that session, so we can see what you saw when it went wrong. We keep this for a legitimate purpose — supporting the safety and integrity of the Service — on a tiered schedule: your note for 90 days after we review the report (or after you file it, if we never do), the copy of the message for 6 months, the replay reference for 30 days, and the rest of the report for 24 months. If you delete your account, any reports you filed are deleted immediately, regardless of these windows. Please don't include personal details about yourself or anyone else in your note.

Rating an AI response. If you rate a response with a thumbs up or thumbs down, we store the rating, the message it applies to, any note you add, and the date, so we can find and fix weak explanations. Rating a response again replaces your earlier rating. If you add a note, it is also emailed to our team so someone reads it — a copy therefore sits in an inbox, and deleting your account removes the stored rating but cannot recall an email already sent. If you delete your account, your ratings are deleted with it. Please don't include personal details about yourself or anyone else in your note.

Specific retention periods

Where we apply a fixed schedule, these are the periods we use. They run automatically.

If you delete your account, we act on that request regardless of the periods above, except for the items in the table above that we keep past account closure — records of a payment we are required to retain for tax purposes, the do-not-email entry, and the one-way record and any unpaid balance or restriction, which we keep in our legitimate interest in preventing fraud.

The Service is intended only for adults aged eighteen (18) or older, and we do not knowingly collect personal information from anyone under eighteen. If we learn that we have collected personal information from someone under eighteen, we will delete it and close the account. If you believe a minor has provided us personal information, please contact privacy@withbruner.com.

We rely on your representation of your age and, to the maximum extent permitted by law, disclaim liability arising out of a user's misrepresentation of their age.

You can ask us to access, correct, or delete your personal information, or ask how we handle it, by emailing privacy@withbruner.com. You can also delete your account or download a copy of your data yourself from within the app, under Account & data. We may need to verify your identity before acting on a request, and we will respond as required by applicable law. We may decline to act on, charge a reasonable fee for, or extend the time to respond to requests that are manifestly unfounded, excessive, or repetitive, as permitted by applicable law.

Objecting to processing based on our legitimate interests. Where we rely on our legitimate interests — including the one-way record described in Data Retention — you can object to that processing by emailing privacy@withbruner.com.

Depending on where you live — for example, California, other U.S. states, or the EEA, UK, or Switzerland — you may have additional rights under your local privacy laws, such as the rights to access, delete, correct, or obtain a copy of your data, to opt out of certain processing, and to complain to a data-protection regulator. We honor those rights as applicable law requires; email us to exercise them. As noted above, we don't sell your personal information.

The Service does not currently include voice or biometric features. If we add them in the future, we will provide any notices and obtain any consents required by applicable law before collecting or processing voice or biometric data.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date shown above, and for significant changes we will take reasonable steps to let you know. Your continued use of the Service after an update takes effect means you accept the updated Privacy Policy, to the extent permitted by applicable law.

For questions, requests, or complaints about this Privacy Policy or how we handle personal information:

Storm Force LLC
440 North Barranca Avenue #3979, Covina, California, 91723, United States of America

privacy@withbruner.com