Privacy Policy

NeuroBridgeEDU is a local-first desktop application. By default, transcript text and summaries stay on your device. If you opt into Pro cloud AI, the app sends transcript text to your chosen provider for summaries, and your question plus recent chat history and meeting context for Study Sage chat. Recordings and audio never leave your device. Release builds make an automatic update check and, only if a Pro licence key is stored, a Lemon Squeezy licence check. Neither sends recording, transcript, or audio content.

This page describes what data we touch, how we touch it, and the rights you have under the EU General Data Protection Regulation (GDPR). It applies to both the desktop application and to the marketing website at neurobridgeedu.eu.

The data controller is Emanuel Covasa, trading as NeuroBridgeEDU. You can contact the controller at contact@neurobridgeedu.eu.

Desktop app — what stays on your device

The following are stored locally in a SQLite database in your OS application support directory and are never sent to us:

• Audio recordings you make (saved as WAV files alongside the database).
• Transcripts generated by the on-device Whisper model.
• Summaries generated by on-device Built-in AI models (Mistral / EuroLLM) on macOS, Windows, and Linux. Ollama and opt-in Pro cloud are optional alternative providers.
• Your settings, including chosen models, language, and reading-style preferences.
• Local database files and recordings are plaintext on your machine.
• API keys for cloud providers are protected by the operating system keychain.

Desktop app - automatic connections

• Update check: the app asks GitHub (api.github.com) whether a newer version exists. It checks about five seconds after launch, every 24 hours, on reconnect, and retries about 30 minutes after a failed check. The request carries the app version and normal web metadata, such as your IP address, but no account or app content. Licence validation: if a Pro licence key is stored, the app validates it with Lemon Squeezy (api.lemonsqueezy.com) at most once per launch, unless a recent validation is cached. It sends your licence key and, once activated, its Lemon Squeezy instance id. A hashed device id is sent only when you activate a licence, not during routine checks. No recording, transcript, or audio is sent. Free installs with no licence key make no such call.

Desktop app — opt-in error reports

If you opt in during onboarding (it's off by default), the app may send anonymous error reports when something crashes. Each report contains: a stack trace, the app version, the OS version, and an anonymous installation ID. Reports never contain your audio, transcripts, summaries, or any personally identifying information.

Website — what we log

The marketing site uses Rybbit, a privacy-friendly analytics service hosted on European infrastructure. It records aggregate page views, referrer hosts, and rough geography (country level). It does not set cookies that identify individual visitors, does not fingerprint browsers, and does not track you across sites.

Contact form / Pro access form

If you submit the contact form or the Pro access form we receive the fields you typed: your name, email, role, and (optionally) institution. We use this only to reply to you about your request.

The data we receive is used for these purposes only:

• Replying to your message. If you wrote to us, we reply.
• Replying to Pro access requests. If you ask about Pro or institutional access, we reply to that request.
• Diagnosing crashes. If you opted into error reporting, the trace helps us fix the bug.
• Understanding website traffic. Aggregate analytics tell us which pages are useful and where to focus.

We do not use your data for advertising, do not sell or rent it to anyone, and do not use it to train AI models.

Under the GDPR you have the following rights with respect to data we hold about you:

• Right of access — ask us what data we have about you and we'll send you a copy.
• Right to rectification — ask us to correct any data that's wrong.
• Right to erasure — ask us to delete your data (the "right to be forgotten").
• Right to restrict processing — ask us to pause processing your data while a question is being resolved.
• Right to data portability — get a machine-readable copy of your data.
• Right to object — object to specific processing activities, including marketing.
• Right to lodge a complaint with the Irish Data Protection Commission (or your local supervisory authority) if you believe we've handled your data improperly.

To exercise any of these rights, email contact@neurobridgeedu.eu. We respond within 30 days.

We are based in Ireland and store any data we receive on European infrastructure (Rybbit analytics is hosted in the EU; n8n automations on emmi.zone run on EU servers).

If you use Pro cloud AI providers (Mistral, OpenAI, or Anthropic), the content you send goes directly from your device to that provider. We don't intercept or proxy it. Ollama is a separate local provider by default; if you point it at a remote host, that host is your own configuration. Gemini is legacy-only for existing saved keys. Each provider has its own privacy policy and data-residency story; please review the one(s) you opt into.

Services we rely on

• Mistral AI - optional cloud AI provider, bring-your-own-key (Pro only).
• Lemon Squeezy - processes Pro licence purchases and licence validation.
• GitHub - hosts the automatic app update check.
• Hugging Face - hosts the Whisper and AI model downloads.

A managed, keyless cloud option is planned for v2.1 and is not live today.

The marketing website does not set tracking cookies. Rybbit analytics runs cookieless. We use one functional cookie for the theme preference (light / dark / system) which is stored locally in your browser and not transmitted to us.

The desktop app does not use cookies (it's not a browser application).

For any privacy-related question, complaint, or rights request, email contact@neurobridgeedu.eu. Please mention "Privacy" in the subject line so we can route it appropriately.

If you're not satisfied with our response, you can lodge a complaint with the Irish Data Protection Commission at dataprotection.ie.