This Privacy Policy explains how River's Lab OY ("we," "us," or "our") handles information in connection with our mobile application, Scrambled Brain (the "App"), and our website, scrambledbrain.app (the "Site").
Your health data never leaves your device — we cannot access it
You control everything — delete anytime, no accounts
Optional analytics are truly optional and anonymized
We comply with EU GDPR and Finland Data Protection Act
General
The following gives a simple overview of what kind of personal information we collect and how we handle your data. Personal information is any data with which you could be personally identified.
Data collection on our website
The data collected on this website are processed by the website operator. We collect data when you provide it to us or automatically via our IT systems (technical data like browser type). You have the right to request information about your stored data and its deletion at any time.
Analytics and third-party tools
Statistical analyses may be made of your surfing behavior. This happens primarily using cookies and analytics. This analysis is anonymous and encrypted.
Information, blocking, deletion
As permitted by law, you have the right to be provided at any time with information free of charge about any of your personal data that is stored. You also have the right to have your data corrected, blocked or deleted.
1. Our Core Promise
Your privacy is the foundation of everything we build. Our promise to you is simple: We cannot see, access, share, or analyze your personal health data entered into the Scrambled Brain App. Period.
This isn't just a policy — it's how we built the software. Your tracking data never leaves your device. We have no servers that store your symptoms, moods, notes, or any other health information.
2. Understanding Health Data & GDPR
Under the EU GDPR and Finland's Data Protection Act (1050/2018), health information is classified as "special category data" requiring extra protection. Because your data is stored exclusively on your device with 256-bit AES encryption, River's Lab is not a data controller or processor of your personal health tracking data. Your device itself is the storage system; you are in complete control.
3. Data Related to the Scrambled Brain App
A. Your Tracking Data
Symptoms, moods, habits, and notes are stored exclusively on your device's local storage, protected with industry-standard 256-bit AES encryption. This data is never transmitted to our servers or any third party.
B. Anonymous Usage Analytics
To help us fix bugs, with your explicit consent, we may collect anonymous usage analytics through PostHog. We collect device type, app version, and feature usage patterns, but never the content of your trackers or any health data.
C. PDF Reports
When you generate and share a PDF report, that data is no longer under our control. You are responsible for how you share or store that PDF.
D. Subscription Management
Scrambled Brain's core features are free. Paid features (like the one-time fee for the Founder's Pass) use/will use Apple/Google for payments and RevenueCat for purchase status management. We will never receive your payment card information.
4. Data Related to Our Website
Our website collects standard server log files (browser type, date/time) to ensure technical security and functionality. We use cookies only with your consent. We use cookies to store your languate preferences and anonimyzed analytics.
5. Your Data Rights Under GDPR
Under GDPR and Finnish law, you have rights to access, rectification, erasure, and more regarding data we process (website logs/analytics). To exercise these rights, email support@scrambledbrain.app
6. Data Security
We use 256-bit AES encryption for on-device data and SSL/TLS for website connections. You are responsible for protecting your device with a passcode or biometric lock.
7. Children's Privacy
Scrambled Brain is intended for users aged 16 and older. We do not knowingly collect data from children under the age of digital consent.
All primary data processing occurs within Finland and the EU. Transfers to third parties like RevenueCat use Standard Contractual Clauses (SCCs) approved by the EU Commission.
10. Changes to This Policy
We may update this policy from time to time. Significant changes will be notified via in-app notifications or email.