Privacy policy

Brilim holds your name, the rooms you are in with the name you give each person, the links you make for a week, what your phones need to reach you, and, if you sign in with Google, the name and email address Google gives it.

What Brilim keeps. Your name, which starts as the first name Apple or Google gives and is yours to change, the language and time zone of your phone, the rooms you are in, and per phone a notification token, its platform, the app version, whether notifications are allowed, when it last checked in and how long notifications took to arrive. Lights and replies are kept as the current state of a room, with a log of transitions that is deleted after thirty days. If you sign in with Google, Firebase keeps the name, email address and profile-picture link Google provides; Apple provides no email. Crash reports (the phone model, its system version, the app version and where the app failed) go to Firebase Crashlytics, without your name. A knock is the one thing sent from inside a light: one of three sound-words, chosen by how many times you tapped, delivered once and never shown to anybody but the person it was sent to; it is kept in the room’s state until your light goes out, and as a line in the log of transitions. In each room it also keeps the name you give the other person; only your phones show it, and it is deleted when the room leaves your list. Somebody who has you in a room can give you a name of their own, which only their phones show. For each notification sent, Brilim keeps a record for a day, so a notification retried after a fault is never delivered twice.

Links. Nobody can look you up: Brilim has no nicknames, no search and no directory, and never reads your contacts. The only way into a room with you is a link you made, from the empty seat. It works for one person, for a week: Brilim keeps who made it and when, and once it is used, who used it and the room, and deletes it when the week is over. A link somebody sends you — or, on Android, the Play install that link started — carries one thing into the app: that link. On iPhone, getting Brilim from that page copies the link, and Brilim reads your clipboard only when you tap the system Paste button.

What Brilim never does. It does not read your calendar or your location. It has no analytics in the apps. It never tells anyone whether you looked, how long you took, or how often you answered. When your light goes out, the other person gets no notification: your lamp simply goes dark on their screen.

Who. Brilim is made and run by Miguel Almeida, in Portugal, who is the controller of this data. For anything on this page, write to hello@brilim.app.

Why. Brilim uses what it keeps to do what you asked of it: the law calls this performing a contract. Crash reports, server logs, and nightly totals taken from the log of transitions (how many lights and moments, across all rooms, never by name) are kept to keep Brilim working: the law calls this a legitimate interest.

Where. Rooms, names and devices are kept in Google Cloud Firestore, in Belgium. Your sign-in account, with what Google gives it, is kept by Firebase Authentication in the United States. Notifications and crash reports pass through Google’s servers worldwide. Brilim’s server logs keep each request’s IP address and phone type, and for its timers the room and the account they belong to, for thirty days. Transfers outside the EU rely on the EU–US Data Privacy Framework, under which Google is certified, and on Google’s standard contractual clauses.

How long. Your account, until you delete it; the log of transitions and server logs, thirty days; links, a week; the record of each notification, a day; crash reports, ninety days; backups, seven days. A Remove, until either account is deleted; an ended room’s two account identifiers and its state, for as long as the room exists.

Keeping it safe. Everything travels encrypted, and Google stores it encrypted. A phone writes nothing itself, and reads only what is yours.

Your rights. You can ask to see, correct, take with you, restrict or delete what Brilim holds about you, or object to how it is used, by writing to the address above; you can also complain to the CNPD, Portugal’s data protection authority. Brilim is for people 16 and over.

Ending it. Deleting your account in Settings ends every room and removes your account and your devices. The other person is told nothing about you beyond the room ending.

Deleting your account, in full. Open Brilim, go to Settings from your initial in the corner, and hold Delete account. You are asked to sign in again first, because a phone somebody else is holding should not be able to do this. Deleted immediately: your name, your sign-in account and anything Google gave it, your devices, the names you gave the people in your rooms, the links you made or used, and every Remove, yours or the other person’s. Every room you are in ends. The other person keeps the ended room, under the name they gave you or else under yours, until they remove it from their list: that copy of your name is the one thing that stays. Otherwise an ended room keeps only the two account identifiers and its state, and its log of transitions is deleted after thirty days, as above. Backups that still hold your account are gone within seven days, and nothing is restored from them.

Without the app. Write to hello@brilim.app from the email address of the Google account you signed in with. You get one reply asking you to confirm; once you do, the account is deleted exactly as above, within thirty days of your email and usually the same day, and you are told when it is done.