Effective date: April 25, 2026 · Last updated: September 16, 2026
This Privacy Policy explains how Netcore Solutions LLC (“we,” “our,” or “us”), a Wyoming limited liability company, collects, uses, stores, and protects your personal data when you use the DEBRIEF mobile application (“App”) and related services (“Service”).
Data Controller: Netcore Solutions LLC
30 N Gould St Ste R, Sheridan, WY 82801, United States
Privacy contact: [email protected]
For users in the European Union and European Economic Area, we act as the data controller under the General Data Protection Regulation (GDPR). For users in California, this policy also addresses your rights under the California Consumer Privacy Act (CCPA/CPRA).
| Data | How collected | Purpose |
|---|---|---|
| Email address | Registration / Sign in with Apple or Google | Account identification, communications |
| Display name | Provided by you during onboarding | Personalization (shown in app) |
| Authentication tokens | Generated at sign-in | Secure session management |
| Subscription status & trial dates | App Store / Google Play | Access control, billing |
| Onboarding completion flag | App interaction | App state management |
| Data | Description |
|---|---|
| Debrief entries | Daily evening reviews and morning briefs you create |
| Debrief answers | Your written responses to structured questions (wins, improvements, goals) |
| Performance scores | The 1–10 day score you give an entry, where you choose to give one. If you do not set a score, none is stored. |
| Pattern alerts | System-detected trends derived from your entries |
Your journal content is private. We do not use your personal debrief entries for advertising, marketing, or AI model training. Entries are processed only to provide the Service to you.
When you use the Coach feature, your debrief entries and a generated profile summary are sent to our server-side proxy (Supabase Edge Function), which forwards them to OpenAI’s API to generate responses. Your data is not sent directly from your device to OpenAI — it passes through our authenticated, JWT-secured backend.
Coach session metadata (session IDs, timestamps) is stored in our database. We do not retain the full content of individual Coach conversations on our servers beyond what is needed to provide the feature.
Where the Coach speaks a response aloud, the text to be spoken is sent through our server-side proxy to ElevenLabs for speech synthesis. No account identifier and no journal content accompanies it.
If you grant notification permissions, we collect a push notification token — from Apple Push Notification Service (APNs) on iOS, or Firebase Cloud Messaging (FCM) on Android. This token is used exclusively to send you smart reminders (evening debrief prompts and morning brief notifications) based on your configured schedule. We do not use push tokens for marketing or promotional messages.
We collect technical and usage data necessary to operate and improve the Service:
We use PostHog for product analytics and RevenueCat for subscription management. We do not use advertising or attribution SDKs (e.g. Adjust, AppsFlyer), and we do not use your data for targeted advertising.
Analytics is anonymous by default. We do not attach your name or email address to analytics events; they are keyed to a pseudonymous identifier that is reset when you sign out.
To understand where the app is confusing or broken, we record anonymised sessions of app usage through PostHog Session Replay. A recording captures the screens you visited, your taps and your navigation path — it is a reconstruction of the interface, not a video of your device, and it never captures other apps, your camera or your microphone.
What we mask: the contents of text input fields are masked, so what you type into them is not recorded.
An honest limitation. On iOS, masking currently applies to text input fields but not to all text rendered on screen, so text displayed by the app during a session may appear in a recording. We are fixing this, and we would rather tell you than let you discover it.
Your written debrief and journal entries are never sold, and never used to train AI models. Recordings are retained for 30 days and then deleted.
For users in the EU/EEA, we process your personal data on the following legal bases:
| Processing activity | Legal basis (GDPR Art.) |
|---|---|
| Account creation and authentication | Contract performance (Art. 6(1)(b)) |
| Providing the debrief and journaling features | Contract performance (Art. 6(1)(b)) |
| Subscription management and billing | Contract performance (Art. 6(1)(b)) |
| AI Coach responses | Contract performance + Consent (Art. 6(1)(b) & (a)) |
| Push notifications (reminders) | Consent (Art. 6(1)(a)) |
| Product analytics and session recording | Legitimate interests (Art. 6(1)(f)) |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
We use personal data only for the following purposes:
We do not sell, rent, or trade your personal data to third parties. We do not use your data for targeted advertising.
We share data with the following sub-processors strictly to deliver the Service:
| Provider | Purpose | Data transferred | Location |
|---|---|---|---|
| Supabase Inc. | Database, authentication, backend infrastructure, Edge Functions | Account data, journal entries, session data | United States (AWS us-east-1) |
| OpenAI, LLC | AI Coach responses (via Supabase Edge Function proxy) | Debrief summaries, profile context — no direct device-to-OpenAI transfer | United States |
| PostHog, Inc. | Product analytics and session replay | Pseudonymous identifier, app usage events, session recordings with typed input masked | United States |
| RevenueCat, Inc. | Subscription and purchase management | Pseudonymous identifier, subscription and transaction status | United States |
| ElevenLabs, Inc. | Text-to-speech for spoken app content | Text to be spoken, sent via our server-side proxy — no direct device-to-ElevenLabs transfer | United States |
| Apple Inc. | Sign in with Apple, App Store payments, push notifications | Authentication tokens, APNs push token, subscription data | United States |
| Google LLC | Sign in with Google, Google Play payments, Android push delivery (FCM) | OAuth token, email address (if chosen by you), FCM push token, subscription data | United States |
All sub-processors are contractually required to process data only on our behalf and in accordance with our instructions. We do not authorize sub-processors to use your data for their own independent purposes.
We are a US-based company and our infrastructure is hosted in the United States. If you are located in the European Union or EEA, your personal data is transferred to and processed in the United States.
We rely on the following transfer mechanisms to ensure adequate protection:
By using the Service, you acknowledge that your data will be processed in the United States, subject to these protective measures.
We implement industry-standard technical and organizational measures to protect your personal data:
Despite these measures, no security system is impenetrable. We cannot guarantee absolute security, and you use the Service at your own risk. If you become aware of a security vulnerability, please report it to [email protected].
We retain your personal data only for as long as necessary to provide the Service or as required by law.
| Data type | Retention period |
|---|---|
| Account and profile data | Until account deletion request is received |
| Debrief entries and answers | Until account deletion request is received |
| Push notification tokens | Until account deletion or token refresh |
| Analytics events and session recordings | Up to 30 days, then deleted automatically |
| Subscription records | Up to 7 years (tax and legal compliance) |
| Server logs (anonymized) | Up to 90 days |
Account deletion: When you request account deletion, we delete your personal data (account, profile, journal entries, coach sessions) immediately upon processing your request. Subscription transaction records may be retained for up to 7 years as required by applicable tax law. Backup systems may retain data for up to 30 days before permanent purge.
To delete your account, contact us at [email protected] or use the account deletion option within the App settings.
California residents have the following additional rights:
To exercise any of your rights, contact us at [email protected]. We will respond within 30 days (GDPR) or 45 days (CCPA). We may need to verify your identity before processing your request.
The Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided personal data to us, please contact us immediately at [email protected]. We will delete such data promptly upon verification.
Compliance note: For U.S. users under 13, we comply with the Children’s Online Privacy Protection Act (COPPA). For EU users under 16, we comply with GDPR Article 8.
The DEBRIEF mobile app (iOS and Android) does not use cookies. Web-based authentication flows (Sign in with Google) may use session cookies managed by the respective provider’s secure web view. We do not use tracking pixels, web beacons, or cross-site tracking technologies.
If you visit our website at netcore-solutions.com, that site may have a separate cookie policy.
Your debrief entries and a profile summary are processed by OpenAI’s language model to generate coaching responses. This is a generative AI system — responses are probabilistic and may not always be accurate or appropriate. AI Coach responses do not constitute professional advice, and DEBRIEF is not a medical, therapeutic or crisis service.
Data sent to OpenAI via our server proxy is subject to OpenAI’s API data usage policy. Per OpenAI’s API terms, data submitted via the API is not used to train OpenAI models by default.
The App automatically analyzes your historical debrief entries to identify recurring patterns (e.g., consistent wins or improvement areas). This processing occurs on our servers and produces informational alerts only. It does not make decisions that produce legal or similarly significant effects on you.
Subscription payments are processed by Apple through the App Store, or by Google through Google Play, depending on where you installed the App. We do not collect, process, or store your payment card information. Apple and Google may collect and process payment data in accordance with their own privacy policies.
We receive from Apple or Google: subscription status, product ID, and transaction dates — sufficient to manage your access to the Service. This information is also processed on our behalf by RevenueCat, as listed in section 5.
The App may contain links to third-party websites or services. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party service you access through the App.
We may update this Privacy Policy from time to time. If we make material changes, we will notify you via the App or by email at least 14 days before the changes take effect.
The “Last updated” date at the top of this page reflects the most recent revision. We encourage you to review this policy periodically. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.
For any privacy-related inquiries, data access requests, deletion requests, or to exercise any of your rights, please contact us:
Netcore Solutions LLC
30 N Gould St Ste R, Sheridan, WY 82801
United States
Email: [email protected]
Website: netcore-solutions.com
We aim to respond to all legitimate requests within 30 days. For complex requests, we may extend this period by a further 30 days and will notify you of the extension.
EU/EEA users: If you are not satisfied with our response, you have the right to complain to your local data protection authority.