Privacy Policy

NeuroSpicy is a life-management app designed for brains that work differently. In this policy, “NeuroSpicy”, “we”, “us” and “our” refer to NeuroSpicy as the organisation responsible for your data. If you're in the UK, EU, or EEA, NeuroSpicy acts as the controller of your personal data for the purposes of the UK GDPR and EU GDPR.

To contact us about your privacy, email support@getneurospicy.com. You can also manage many of your privacy choices directly inside the app.

NeuroSpicy only collects what's needed to run the app for you. We don't use advertising or behavioural-profiling trackers, and we don't sell your data.

• Account and sign-in details — your email address and authentication identifiers so you can sign in and stay signed in securely. Required.
• The content you create — tasks and subtasks, brain dump entries, routines and their steps and history, appointments, reminders, daily plans, and your settings. This is saved so your information is there next time you open the app, on any device you sign in on. Required for the feature.
• Onboarding and personalisation — answers you give during first-time setup, and your chosen preferences, so NeuroSpicy can tailor its defaults to you.
• Household sharing — if you create or join a household, the membership and any tasks you deliberately mark as shared, so you can collaborate with people you trust.
• Reminders and notifications — the reminders you set, and a device push token if you enable notifications, so we can deliver reminders to your device.
• AI usage counts — a count of how often you use AI features, to help manage fair use. This records the type of request only — never your task or audio content.
• Entitlement state — whether you have access to paid features, so the right features are available to you.
• Device-local state — capacity and focus-timer state can be kept on your device so the home screen and focus features work smoothly. This isn't sent to your account and is cleared when you sign out.

How each type of data is shared or retained is summarised in our developer-facing data inventory, which mirrors this policy. Where data is described as “optional”, the related feature simply won't work until you turn it on, but you can still use the rest of the app.

You can sign in to NeuroSpicy using an email address and password, or by signing in with Google. When you sign in with Google, Google acts as the sign-in provider — we receive only the details needed to create and identify your NeuroSpicy account, not access to your Google Calendar or other Google data.

Session tokens keep you signed in and are stored on your device and in your account. You can sign out at any time. You're responsible for keeping your sign-in details secure.

You can export a portable copy of your data, and you can permanently delete your account and data, from within the app at any time. Deleting your account removes the things you've added (tasks, brain dumps, routines and their history, appointments, reminders, daily plans and settings). Any connected calendar is disconnected — the calendar itself stays with Apple or Google.

Apple Calendar (including iCloud calendars) is read on your device using the permission you grant iOS. Which calendars you've chosen is remembered on your device — the events themselves are not copied into your NeuroSpicy account. Apple Calendar data stays under Apple's terms and your device's privacy controls.

Words are sent to an AI service only at the moment you use an AI feature — for example, breaking a task into steps, or turning a recording into text. Nothing is sent in the background, and your brain dumps, tasks, routines and calendars are not used to train anyone's model.

The microphone opens only when you press record and closes when you stop. Voice audio is never stored — it's held in memory, transcribed, and discarded. Only the text comes back, and it's only saved if you choose to save it as a task or brain dump entry.

You can turn AI help off entirely from within the app; the AI features will then decline instead of sending anything, and everything else keeps working.

A household is off unless you create one or accept an invitation. Joining one shares nothing on its own. Only tasks you deliberately mark as Household are visible to the other people in it, and they can see that task's title, notes you put on it, its dates, and who it's assigned to.

Everything else stays yours alone: your private tasks, brain dumps, routines, calendars, capacity, focus time, reminders, settings, and privacy choices. Other members see only the optional display name you choose, or “Household member” if you haven't set one — never your email address.

If you leave a household, or it's closed, you immediately lose access to its shared tasks, and anything assigned to you becomes unassigned. Closing a household turns its shared tasks back into private tasks for whoever created them — nothing is deleted.

Your account and app data are stored using our backend provider (Lovable Cloud / Supabase). Access is protected by your sign-in and by row-level security rules, so a user can only reach their own data and any shared tasks they're entitled to. Google OAuth connection keys are stored encrypted.

We use reasonable technical and organisational measures to protect your data. However, no method of transmission or storage is completely secure, and we can't guarantee absolute security.

We keep your data for as long as your account is active, so it's there when you return. Device-local data (such as capacity and focus-timer state) is kept on your device and cleared when you sign out. Google Calendar events are fetched when needed and not retained beyond the request.

When you delete specific content (like a task or routine), it's removed from your account. When you delete your account, your app data is removed, and your account and authentication details are deleted. The only things that may be kept are limited records we're required or permitted to keep for security, fraud prevention, or legal reasons.

We rely on carefully chosen providers to run NeuroSpicy. These include: our backend and authentication provider (Lovable Cloud / Supabase); the AI service used for AI features (accessed through the Lovable AI Gateway); the Lovable App User Connector, which holds your Google Calendar connection on your behalf; the Google Calendar API; and Apple EventKit on your device. Each provider processes data only to help us deliver the service, under their own terms.

Because NeuroSpicy and its providers operate online, your data may be processed in countries other than your own, including countries that may not have the same data protection laws. Where this happens, we use safeguards such as standard contractual clauses and provider-level protections to keep your data appropriately protected, in line with UK and EU requirements.

Depending on where you live, you may have rights over your personal data under the UK GDPR, EU GDPR, or similar laws. These can include:

• accessing a copy of your personal data;
• correcting data that's inaccurate;
• asking us to delete your data (“right to erasure”);
• receiving a portable copy of your data (“data portability”);
• objecting to, or restricting, certain processing;
• withdrawing consent where processing relies on it.

You can act on several of these directly inside the app — exporting your data, changing your settings, or deleting your account. You can also email support@getneurospicy.com and we'll respond within the time required by law. If you're not satisfied with our response, you have the right to complain to your local data protection authority.

NeuroSpicy isn't directed at children under 16 (or the age of digital consent in your country) and we don't knowingly collect their data. If you believe a child has given us their information, contact us and we'll delete it.

We may update this Privacy Policy from time to time. We'll show the “Last updated” date at the top of the page and, for significant changes, let you know through the app or by email before they take effect.