Privacy policy
Last updated July 10, 2026.
Bramble is an iOS app that helps people set protective boundaries, practice recovery, and receive support from a trusted Circle. This page describes what we collect, how we use it, how long we keep it, and the limits we put on ourselves — including how Bramble’s DNS-only VPN configuration handles network data, and how we handle your mobile number.
For questions, email luke@getbramble.app.
Who we are
Bramble is operated by Bramble Health LLC (“Bramble,” “we,” “us”). Our address is 5871 Via Las Nubes, Riverside, CA 92506.
What we collect
We collect only what we need to make the app work.
- Account information. Your name, email, and Apple Sign In identifier when you create an account.
- Profile information you choose to add. A phone number and profile photo. A selected profile photo is uploaded to Bramble’s private storage and used only as your avatar; it is not analyzed by the content filter.
- Mobile number. When you request beta access through the form on this site, when you enable SMS notifications, or when you invite someone to your Circle via SMS. See “SMS program” below for full details.
- Recovery and well-being data you create. Check-ins, mood and stress ratings, faith-alignment preference, journal entries, urge-moment events, reflections, worksheets, and Circle membership.
- Messages. Circle, group, companion, and care-team messages are stored so they can be delivered and synchronized. Eligible Circle messages are end-to-end encrypted — Bramble stores ciphertext rather than readable message text. Journal entries, Circle messages, and companion chats are excluded from the protection-model training pipeline.
- Protection settings and events. Protection level, app and site choices, blocks, rewrites, bypass attempts, false-positive corrections, and image and video classification verdicts.
- Device and diagnostic data. APNs push token, Bramble’s random device and install identifiers, device model, OS and app version, structural crash data, performance and energy measurements, protection-layer state, and count-only extension diagnostics. Diagnostic uploads are scrubbed on-device and do not contain raw URLs, journal text, messages, or free-form crash strings.
What the DNS-only VPN processes
Bramble uses an on-demand packet-tunnel configuration because that is how iOS can keep a device-wide DNS shield active. It is not a general-purpose VPN and does not route ordinary web traffic. Only DNS requests — the site names your device asks to reach — enter the tunnel. Web pages, passwords, messages, files, and other traffic do not.
Blocking decisions are made on the device. A request Bramble blocks is not sent to an upstream resolver. An allowed DNS request is sent over an encrypted connection to Bramble’s Cloudflare-hosted resolver and then to an upstream DNS provider so the requested network address can be returned. Bramble’s resolver does not intentionally log or store the raw DNS request.
For the protection learning loop, Bramble uploads the SHA-256 domain hash and outcome for every blocked or rewritten DNS request and a 1% sample of allowed requests. These events are linked to the Bramble account at ingest. Identity is removed from sampled allowed events after two hours. Blocked and rewritten events remain linked while the account is active because they power personal protection and accountability; after account deletion, any retained fleet signal is no longer linked to the deleted account.
Safari page and image checks
Most page and image checks run on the device. When an on-device check cannot reach a confident result, the Safari extension may send a page address, page title, short text snippet, image URL, or temporary image bytes to Bramble and its content-classification processor, Anthropic, for a verdict. Raw page addresses are not stored in the URL-classification cache; Bramble stores a SHA-256 URL hash and verdict for up to seven days. A raw image URL may be retained in the restricted training corpus for up to 30 days, after which the URL is removed and only the hash, verdict, and correction label remain. Bramble does not store image bytes in the training corpus.
No advertising or tracking
Bramble has no ads and no advertising or cross-app analytics SDK. We do not combine Bramble data with data from other companies for targeted advertising or advertising measurement, share it with a data broker, or use Apple’s advertising identifier. Under Apple’s definition, Bramble does not track users and does not need App Tracking Transparency permission.
Network and browsing data is used only to provide, personalize, secure, and improve Bramble’s protection service. It is never sold, licensed, or used for advertising or an unrelated purpose. It is transmitted only to service providers that are necessary to resolve DNS, host Bramble, or classify uncertain content, and those providers are limited to providing their contracted service to Bramble.
Apple Health
If you complete a supported breathing practice and grant permission, Bramble credits the session duration to Apple Health as Mindful Minutes, so your practice appears alongside your other well-being data. This is write-only — Bramble never reads any data from Apple Health. Health data is never transmitted to our servers, never shared with any third party, and never used for advertising or any purpose other than writing your Mindful Minutes.
How we use your information
- To operate the app and the Circle — notify witnesses, deliver check-in reminders, sync streaks.
- To improve the blocking and intelligence layer, in aggregate and hashed where possible.
- To personalize protection, recovery prompts, and support inside Bramble.
- To diagnose crashes and reliability problems.
- To respond to support requests.
Your mobile number — what we will and will not do
We do not sell, rent, lease, share, or otherwise disclose your mobile number, SMS opt-in status, or SMS-related consent data to any third party for marketing or promotional purposes. Mobile-number information collected for the purpose of sending SMS messages — including consent — is never shared with third parties for marketing.
We share your mobile number only with:
- Our SMS provider (Twilio), strictly to deliver the messages you’ve opted into. Twilio is contractually bound to use this information only to deliver the service.
- Law enforcement, when compelled by a valid legal process.
That’s it. No advertisers, no data brokers, no affiliates.
SMS program — what to expect
Bramble sends SMS in two situations, both opt-in. No marketing texts on either program.
- Beta access. When you submit your mobile number through the beta-access form on this site and check the consent box, we send one SMS containing your TestFlight invite link. One message per submission — no follow-ups, no recurring messages.
- In-app notifications. If you opt into SMS inside the app, message types include Circle invitations, urge-moment alerts to people in your Circle, check-in reminders, streak milestones, and account notifications. Message frequency varies — expect approximately 2–10 messages per week depending on your activity and the activity of people in your Circle.
- Message and data rates may apply. Standard messaging rates from your wireless carrier may apply to each message sent or received.
- Opt out at any time. Reply STOP to any Bramble SMS and you will be unsubscribed from all messages. Reply HELP for help, or email luke@getbramble.app.
- Carriers are not liable for delayed or undelivered messages.
Service providers we work with
To run the app, we share limited data with service providers (“sub-processors”), each contractually bound to use it only to provide their service to us:
- Supabase — hosting, database, and authentication for your account and recovery data.
- Anthropic — AI classification of uncertain web content (page addresses, short text snippets, and image URLs from the Safari extension) and the in-app companion chat. Anthropic processes this only to return a verdict or reply; it is not used to train third-party models.
- Apple — push-notification delivery, and, with your permission, writing Mindful Minutes to Apple Health.
- Twilio — SMS delivery.
- Resend — transactional email.
- Cloudflare — encrypted DNS relay, edge hosting, rate limiting, and delivery of Bramble’s protection data.
- Cloudflare DNS and Google Public DNS — upstream DNS resolution for allowed requests. They receive the DNS question solely to return an answer.
- Cisco Umbrella — domain-safety metadata used to classify unknown domains. Only the domain name is sent — never who asked.
We never sell your data, and we share with these providers only what each needs to deliver its part of the service.
How we protect what you share with your Circle
Bramble is designed around a privacy posture, not just a privacy policy.
- Journal entries are stored for your account and visible only to you. Circle members never see them, and they are not used to train the protection system.
- Circle messages are stored end-to-end encrypted where supported and are never used to train the protection system.
- Check-in text — intention, gratitude — is visible only to you.
- Mood values are shown to your Circle only as a trend direction (“trending up,” “holding steady,” “needs support”) — never the raw 1–10 number.
- Urge moments are surfaced to your Circle as “had a hard moment” — never with content details.
- DNS learning events are hashed on your device before upload. Allowed DNS questions still have to be transmitted to a resolver in real time to return a network address; Bramble does not retain those raw questions at its resolver.
How long we keep your information
We keep account, recovery, message, and account-linked protection data while your account is active. If you delete your account in Settings, Bramble initiates deletion immediately; processors and backups may take up to 30 days to complete deletion. Aggregate or de-identified protection signals may be retained because they are no longer associated with your account.
Specific shorter periods apply to higher-volume or more sensitive operational data:
- Identity on sampled allowed-DNS events: 2 hours; the hash and outcome may remain de-identified.
- Raw URL-classification input: processed in real time and not stored; the hash and decision cache expires after 7 days.
- Raw training-image URLs: 30 days; the hash, verdict, and correction label may remain.
- Structural crash reports: 30 days.
- Performance, energy, and extension-health diagnostics: 90 days.
Your rights
You can request a copy of your data, ask us to correct it, or ask us to delete it. To delete your account, go to Settings → Account in the app, or email luke@getbramble.app and we will respond within 30 days.
Children
Bramble is intended for adults (18+). We do not knowingly collect data from children under 13.
Changes
If we change this policy in a material way, we will notify you in the app and update the “Last updated” date above.
Contact
Bramble Health LLC
5871 Via Las Nubes, Riverside, CA 92506
luke@getbramble.app