Privacy Policy

Application: Debrief
Effective Date: 31 July 2026
Last Updated: 31 July 2026

1. Introduction

Debrief (the “App”) is developed and operated by Berkay Atik under the Mindnull Studio name (“Mindnull Studio”, “we”, “us” or “our”). Berkay Atik is the data controller for the personal data processing described in this Privacy Policy.

We are committed to protecting your privacy. This Privacy Policy explains what data we collect and process when you use the App, how and why we use it, when it is shared, how long it is retained, how it is protected and what rights you have.

This Privacy Policy complies with the General Data Protection Regulation (GDPR) for users in the European Union and European Economic Area, Türkiye’s Personal Data Protection Law No. 6698 (KVKK), and applicable Apple App Store requirements.

Debrief turns voice recordings into structured tasks, decisions, open questions, follow-ups, commitments and dates. The App has no user account, advertising or cross-app tracking.

2. Data We Process

2.1 Account and Identity Information

Debrief does not require registration or sign-in. The app does not ask for your name, email address, telephone number or password.

2.2 Voice Recordings and Imported Audio

A recording is created only after you start recording or choose an audio file.
The original audio file is stored in Debrief’s private area on your device.
When you are online, a copy is sent over an encrypted connection to our Cloudflare processing service and then to Groq for speech-to-text transcription.
Our processing service handles the audio in memory and is not designed to save it to a content database or backup.

2.3 Transcripts and Organised Content

The transcript is stored locally on your device.
A copy of the transcript is sent through our Cloudflare processing service to the paid Google Gemini API so Debrief can identify tasks, decisions, questions, follow-ups, commitments, people and dates.
The resulting title, summary and organised items are returned to the app and stored locally.
Our processing service is not designed to permanently store the transcript or the organised result.

2.4 Processing Context and App Preferences

To interpret phrases such as “tomorrow” or “by Friday,” Debrief may send the app language, local date and time, time zone, recording duration and app version with a processing request. Notification preferences, theme, onboarding status and similar app settings remain on your device.

2.5 Calendar and Notifications

Calendar access is optional. If you grant permission, Debrief may read limited details of nearby events on your device to suggest a useful recording title or schedule a reminder after an event.
Calendar event content is not sent to Mindnull Studio, Groq or Gemini.
Debrief does not add an event without showing Apple’s confirmation screen for your approval.
Reminders are scheduled and delivered locally by iOS. Debrief does not use remote push notifications for them.

2.6 Purchase and Subscription Data

Purchases are processed by Apple and managed through RevenueCat. The following data may be processed:

An anonymous RevenueCat app user identifier
Subscription or lifetime-purchase entitlement status
Purchase history, receipt and transaction information
Limited device and app information needed to operate the purchase service

Debrief does not receive your payment-card details and does not attach your name or email address to the anonymous purchase identifier.

2.7 Network, Security and Support Data

To protect the processing service and apply fair-use limits, the service may process your IP address, anonymous purchase identifier, app version, request time and numeric usage counters. If you contact support, we receive your email address and any information you choose to include in your message.

3. Third-Party Services and Data Sharing

3.1 Cloudflare

Cloudflare routes encrypted processing requests, protects the service from abuse and stores short-lived numeric quota records. Our service is configured not to write recording or transcript content to its KV store or analytics system.

3.2 Groq

Groq processes audio to create a transcript. Groq states that inference data is not used to train its models. Unless Zero Data Retention applies, input and output data may be retained for up to 30 days for service reliability or abuse review.

Data Information: console.groq.com/docs/your-data

3.3 Google Gemini API and Firebase Hosting

The paid Gemini API processes transcripts and limited context to produce organised results. Google states that prompts and responses submitted to paid Gemini API services are not used to improve its products. Limited records may still be retained for security and abuse prevention unless a zero-retention configuration applies. Google also provides Firebase Hosting for this website.

Terms: ai.google.dev/gemini-api/terms
Privacy Policy: policies.google.com/privacy

3.4 RevenueCat

RevenueCat verifies purchases, restores entitlements and provides subscription status. It processes the anonymous purchase identifier and related transaction information.

3.5 Apple

Apple provides App Store distribution, payment processing and the device services you choose to use, including microphone, speech recognition, calendar, notifications and device backups.

4. How We Use Data

Data is processed for the following purposes:

To record audio and create transcripts
To organise spoken content into useful, editable items
To save your Debrief library on your device
To schedule reminders and support optional calendar features
To verify Premium access and restore purchases
To protect the service, prevent abuse and enforce reasonable usage limits
To answer support and privacy requests

We do not sell personal data, use it for advertising or use recordings and transcripts to train AI models.

4.1 Collection Methods and Legal Bases

Data is collected electronically from the content and permissions you provide through the App, technical information generated when the App sends a request, and purchase information supplied by Apple and RevenueCat.

Depending on the data and purpose, processing is based on one or more of the following legal grounds:

Performance of a contract: To transcribe and organise the content you submit, return the result, verify purchases and provide Premium access.
Consent: Where applicable law requires consent for a particular processing activity or category of data. Consent may be withdrawn at any time without affecting processing carried out lawfully before withdrawal.
Legitimate interests: To protect the service, prevent abuse, apply reasonable usage limits, maintain reliability and respond to support requests, provided that your rights and freedoms do not override those interests.
Legal obligations: To keep or disclose limited information where required by law.

Providing a recording is voluntary. If you do not submit audio for processing, Debrief cannot provide online transcription or AI organisation for that recording. Calendar access is optional and may be refused without preventing use of the App’s core recording features.

5. Data Retention

Data	Retention and Location
Recordings, transcripts and organised items	Stored locally until you delete the debrief or remove the app. Apple-managed device backups may retain a copy according to your backup settings.
Processing content in our Cloudflare service	Processed in memory and not intentionally stored as content.
Immediate rate-limit records	Approximately 2 minutes.
Weekly quota records	Up to 14 days.
Aggregated daily service counters	Up to 48 hours.
Groq and Gemini provider records	Subject to the limited retention practices described in Section 3.
Purchase records	Retained by Apple and RevenueCat under their legal and operational requirements.
Support emails	Kept only as long as reasonably necessary to resolve the request and meet legal obligations.

6. Data Security

Data is encrypted in transit using TLS.
Provider API credentials are stored as server-side secrets and are not included in the app.
Our processing service is designed not to log request bodies or create an archive of recordings and transcripts.
Local app data is protected by iOS security controls and Debrief’s private app container.

No system can guarantee absolute security. Debrief limits the amount of data processed and keeps your saved library on your device.

7. International Data Transfers

Debrief is operated from Türkiye and uses service providers that may process data in the United States, the European Union and other countries. International transfers are handled under the safeguards and legal mechanisms made available by the relevant provider, including Standard Contractual Clauses where applicable.

8. Your Rights Under GDPR

If GDPR or UK GDPR applies to you, you may have the following rights:

To be informed about the processing of your personal data
To request access to or a copy of your personal data
To correct inaccurate or incomplete data
To request deletion or restriction of processing
To object to certain processing
To request data portability where applicable
To withdraw consent without affecting earlier lawful processing
To complain to the competent data protection authority

9. Your Rights Under KVKK

Under Article 11 of Türkiye’s Personal Data Protection Law No. 6698 (KVKK), you may:

Learn whether your personal data is processed
Request information about the processing
Learn the purpose of processing and whether data is used for that purpose
Learn the third parties to whom data is transferred in Türkiye or abroad
Request correction of incomplete or inaccurate data
Request deletion or destruction where the legal conditions are met
Request notification of correction or deletion to relevant recipients
Object to a result produced solely through automated processing
Claim compensation for damage caused by unlawful processing

To exercise these rights, contact mindnullstudio@gmail.com. KVKK requests are answered as soon as possible and no later than 30 days.

10. Children’s Privacy

Debrief is intended for adults and is not designed for anyone under 18. We do not knowingly collect personal data from children. If you believe that a child has provided personal data through Debrief, please contact us.

11. Data Deletion

Deleting a debrief removes its local database record and associated recording from the app.
Removing Debrief from your device deletes its local app container, subject to any Apple-managed backup.
Apple and RevenueCat purchase records follow their own retention and deletion requirements.
For a privacy request relating to provider records, contact mindnullstudio@gmail.com.

12. Automated Processing

Debrief uses speech recognition and a language model to create transcripts and organise content. These results may be incomplete or inaccurate. They are editable, are provided as productivity assistance and do not constitute a legally binding decision or professional advice.

13. Policy Updates

This Policy may be updated when the app, service providers or applicable law changes. The “Last Updated” date will be revised when changes are made. Material changes will also be communicated in the app where appropriate.

14. Contact

For privacy questions or requests:

Developer: Berkay Atik
Brand: Mindnull Studio
Email: mindnullstudio@gmail.com
Application: Debrief