This policy explains how Zero Entropy (“we”) handles information when you use Cranial Gym on iOS or Android. We design the app to collect only what is needed to provide training, purchases, reliability, optional analytics, and support.
Information we handle
- Account and profile: email address, display name, account identifier, onboarding preferences, and subscription entitlement when you create or use an account.
- Training activity: module, difficulty, completed-session evidence, answers needed to show a result, and saved-session state. We do not combine module scores into a medical, intelligence, or cognitive-health rating.
- Spoken practice: recordings and transcripts needed to provide transcription or grading. Audio and transcripts are temporary processing data, are not used for advertising, and are not included in product analytics.
- Purchases: product, entitlement, transaction state, and restore status supplied by Apple or Google through RevenueCat and Superwall. We do not receive full payment-card details.
- Notifications: permission and reminder preferences. Device notification tokens, when needed, are used only to deliver requested notifications.
- Diagnostics: privacy-minimized crash and technical failure information through Sentry. Default personal-information collection is disabled.
- Optional anonymous analytics: if you opt in, Amplitude receives a random device reference and a small allowlist of product-interaction events, such as onboarding completion, module completion or technical no-result, and appearance choice. It does not receive your account identity, email, audio, transcript, answer, score, passage, sentence, prompt, or free-form text.
Why we use it
We use information to provide and secure the app, save and sync eligible progress, process requested AI-assisted features, enforce fair-use and cost limits, verify purchases, restore access, deliver chosen reminders, diagnose faults, answer support requests, prevent abuse, comply with law, and—only with opt-in consent—understand a limited set of product interactions.
Services that process data
Depending on the feature and platform, data may be processed by InstantDB (account and synced app data), Cloudflare (trusted gateway and delivery), OpenAI (requested speech, transcription, and synthesis evaluation), RevenueCat and Superwall (subscription and paywall operations), Amplitude (optional anonymous analytics), Sentry (diagnostics), Expo, Apple, and Google (application, notifications, integrity, and store services). Each provider processes only the data required for its role under its applicable terms.
AI-assisted features
Sentence Recall and Read and Synthesize may send the minimum necessary audio, transcript, passage rubric, or response to a trusted server and AI provider when you request evaluation. Prompts and content are treated as untrusted data. Provider credentials are never placed in the mobile app. Product limits may apply to protect service availability and cost; the app explains them near the point where they matter.
Retention and deletion
Local temporary recordings are removed after transcription, result completion, session exit, or a bounded stale-file cleanup. Account and synced training information is kept while your account is active unless a shorter operational period applies. Optional analytics has a target retention of no more than 12 months. Backup, fraud-prevention, tax, and legal records may remain for a limited period when required.
You can request account deletion in Profile. The deletion workflow removes or de-identifies account, profile, eligible synced training, trusted-gateway, entitlement-linkage, and optional analytics data, subject to legally required retention. Store subscription cancellation is managed separately in your Apple or Google account. See Delete account help.
Your choices and rights
You can use core guest features without creating an account, deny microphone or notification permission, use typed responses where offered, opt in or out of anonymous analytics at any time, restore purchases, and request access, correction, or deletion where applicable. Depending on where you live, you may also have rights to restrict or object to processing or to receive a portable copy.
Children, tracking, and sale
Cranial Gym is not directed to children under 13. We do not sell personal information, show third-party advertising, or use app data for cross-app advertising or tracking. Optional analytics is not linked to your account identity and does not use advertising identifiers.
International processing and security
Providers may process data in regions different from yours, subject to appropriate contractual and technical safeguards. We use encrypted transport, least-privilege access, server-held secrets, authenticated commands, rate limits, deletion controls, and privacy-minimized logs. No system is perfectly secure, so we also limit collection and retention.
Contact and changes
Questions or privacy requests can be sent to support@zeroentropylab.com or through the support page. We may update this policy when features or legal requirements change. Material changes will be reflected by a new effective date.