Privacy policy

Last updated September 19, 2026.

Bramble is an iOS app that helps people set protective boundaries, practice recovery, and receive support from a trusted Circle. This page describes what we collect, how we use it, how long we keep it, and the limits we put on ourselves — including how Bramble’s DNS-only VPN configuration handles network data, and how we handle your mobile number.

For questions, email luke@getbramble.app.

Who we are

Bramble is operated by Bramble Health LLC (“Bramble,” “we,” “us”). Our address is 2108 N St Ste C, Sacramento, CA 95816.

This policy covers Bramble as a whole. The browser extension also has its own, written for the stores that distribute it: the browser extension privacy policy.

What we collect

We collect only what we need to make the app work.

• Account information. Your name, email, and Apple Sign In identifier when you create an account.
• Profile information you choose to add. A phone number and profile photo. A selected profile photo is uploaded to Bramble’s private storage and used only as your avatar; it is not analyzed by the content filter.
• Mobile number (optional). If you choose to enable SMS notifications, or if you invite someone to your Circle via SMS. See “SMS program” below for full details.
• Recovery and well-being data you create. Check-ins, mood and stress ratings, faith-alignment preference, journal entries, urge-moment events, reflections, worksheets, and Circle membership.
• Messages. Circle, group, companion, and care-team messages are stored so they can be delivered and synchronized. Eligible Circle messages are end-to-end encrypted — Bramble stores ciphertext rather than readable message text. Journal entries, Circle messages, and companion chats are excluded from the protection-model training pipeline.
• Protection settings and events. Protection level, app and site choices, blocks, rewrites, bypass attempts, false-positive corrections, and image and video classification verdicts.
• Page addresses from Safari. The Safari / macOS extension keeps the addresses of top-level pages you visit — including in-page History navigations (single-page apps) and Private Browsing when the extension is allowed there — in a restricted classification corpus used to improve its block and allow lists and its classifiers. The query string is removed before storage. Everything after the “?” in an address is dropped in full, so search terms you type, login tokens, and advertising and analytics identifiers are not kept — this is a structural removal, not a list of parameter names we try to keep current. Identifier-shaped path segments (for example a password-reset UUID) are also replaced with a placeholder. What remains is the site and the section of it you reached. This corpus is kept only for accounts that agreed to the data disclosure shown at sign-up; if that agreement is not on file, or cannot be read, nothing is stored — the check runs on our servers, not only in the app. You can withdraw that agreement at any time in Settings → “Keep page addresses”, without deleting your account. Withdrawing stops new addresses being kept and deletes the ones already held. Declining, or withdrawing, does not change how pages are checked or filtered; it changes only whether a copy is kept. You can turn it back on later. The Chrome / Chromium extension does not send page addresses off the device. These addresses are stored under a pseudonymous per-account key rather than your account identifier, are never shown on an admin screen or to your Circle, and are deleted when you delete your account.
• Device and diagnostic data. APNs push token, Bramble’s random device and install identifiers, device model, OS and app version, structural crash data, performance and energy measurements, protection-layer state, and count-only extension diagnostics. Diagnostic uploads are scrubbed on-device and do not contain raw URLs, journal text, messages, or free-form crash strings.

What the DNS-only VPN processes

Bramble uses an on-demand packet-tunnel configuration because that is how iOS can keep a device-wide DNS shield active. It is not a general-purpose VPN and does not route ordinary web traffic. Only DNS requests — the site names your device asks to reach — enter the tunnel. Web pages, passwords, messages, files, and other traffic do not.

Blocking decisions are made on the device. A request Bramble blocks is not sent to an upstream resolver. An allowed DNS request is sent over an encrypted connection to Bramble’s Cloudflare-hosted resolver and then to an upstream DNS provider so the requested network address can be returned. Bramble’s resolver does not intentionally log or store the raw DNS request.

For the protection learning loop, Bramble uploads the SHA-256 domain hash and outcome for every blocked or rewritten DNS request and a 1% sample of allowed requests. These events are linked to the Bramble account at ingest. Identity is removed from sampled allowed events after two hours. Blocked and rewritten events remain linked while the account is active because they power personal protection and accountability; after account deletion, any retained fleet signal is no longer linked to the deleted account.

Safari page and image checks

Most page and image checks run on the device. When an on-device check cannot reach a confident result, the Safari extension may send a page address, page title, short text snippet, image URL, or temporary image bytes to Bramble and its content-classification processor, Anthropic, for a verdict. The URL-classification cache itself stores only a SHA-256 URL hash and verdict, for up to seven days. Separately, the page address is retained — without its query string — in the restricted classification corpus described under “Page addresses from Safari” above. A page address may be sent for a verdict with its query string intact; it is not stored that way. A raw image URL may be retained in the restricted training corpus for up to 30 days, after which the URL is removed and only the hash, verdict, and correction label remain. Bramble does not store image bytes in the training corpus.

No advertising or tracking

The Bramble app has no ads and no advertising or cross-app analytics SDK. We do not combine Bramble data with data from other companies for targeted advertising or advertising measurement, share it with a data broker, or use Apple’s advertising identifier. Under Apple’s definition, Bramble does not track users and does not need App Tracking Transparency permission. This website is measured, and that is described under “This website” below.

Network and browsing data is used only to provide, personalize, secure, and improve Bramble’s protection service. It is never sold, licensed, or used for advertising or an unrelated purpose. It is transmitted only to service providers that are necessary to resolve DNS, host Bramble, or classify uncertain content, and those providers are limited to providing their contracted service to Bramble.

This website

Everything above describes the app and its extensions. This site — getbramble.app — is a different thing, and it is measured. We would rather say so plainly here than let the section above imply otherwise.

We use Google Analytics on these pages to count visits and see which ones get read, so we know whether any of this is reaching the men it was written for. It records the pages you open, roughly where you are from your IP address, your device and browser, and how you arrived — a search, a link, or typing the address in. Google processes this on our behalf and stores an identifier in your browser so a return visit is not counted twice.

It is not connected to your Bramble account. Nothing you do inside the app reaches this measurement, and nothing measured here is tied to your name or email. We do not run ads, so none of it builds an advertising audience, and none of it is sold.

In the EU, the EEA and the UK we ask before any of it runs. A small card appears on your first visit, nothing is loaded until you answer, and if you decline, nothing is loaded at all — not then, and not on any visit after. Your answer is kept in your own browser rather than on our servers, which is also why clearing your site data means we ask again.

Elsewhere it runs without interrupting you. If you would rather not be counted wherever you are, your browser’s private window or its tracking protection will stop it, as will Google’s own opt-out add-on. Reading this site is never a condition of using Bramble — the app carries no analytics of this kind.

Apple Health

How we use your information

• To operate the app and the Circle — notify witnesses, deliver check-in reminders, sync milestones.
• To improve the blocking and intelligence layer. DNS learning events are hashed on the device before upload. Page addresses from Safari are stored as the URL itself after the query string is dropped, not as a hash.
• To personalize protection, recovery prompts, and support inside Bramble.
• To diagnose crashes and reliability problems.
• To respond to support requests.

Your mobile number — what we will and will not do

We share your mobile number only with:

• Our SMS provider (Twilio), strictly to deliver the messages you’ve opted into. Twilio is contractually bound to use this information only to deliver the service.
• Law enforcement, when compelled by a valid legal process.

That’s it. No advertisers, no data brokers, no affiliates.

SMS program — what to expect

Bramble sends SMS in one situation — in-app notifications you opt into. The beta-access form on this site does not send SMS. No marketing texts, ever.

• Beta access. The beta-access form on this site asks for your email address, first name, whether you have an iPhone, and a sentence about what brings you. It does not collect your mobile number and does not send SMS. Luke reads each application and replies personally by email.
• In-app notifications. If you opt into SMS inside the app, message types include Circle invitations, urge-moment messages to people in your Circle, check-in reminders, milestones, and account notifications. Message frequency varies — expect approximately 2–10 messages per week depending on your activity and the activity of people in your Circle.
• Message and data rates may apply. Standard messaging rates from your wireless carrier may apply to each message sent or received.
• Opt out at any time. Reply STOP to any Bramble SMS and you will be unsubscribed from all messages. Reply HELP for help, or email luke@getbramble.app.
• Carriers are not liable for delayed or undelivered messages.

Service providers we work with

To run the app, we share limited data with service providers (“sub-processors”), each contractually bound to use it only to provide their service to us:

• Supabase — hosting, database, and authentication for your account and recovery data.
• Anthropic — AI classification of uncertain web content (page addresses, short text snippets, and image URLs from the Safari extension) and the in-app companion chat. Anthropic processes this only to return a verdict or reply; it is not used to train third-party models.
• Apple — push-notification delivery, and, with your permission, writing Mindful Minutes to Apple Health.
• Twilio — SMS delivery.
• Resend — transactional email.
• Cloudflare — encrypted DNS relay, edge hosting, rate limiting, and delivery of Bramble’s protection data.
• Cloudflare DNS and Google Public DNS — upstream DNS resolution for allowed requests. They receive the DNS question solely to return an answer.
• Cisco Umbrella — domain-safety metadata used to classify unknown domains. Only the domain name is sent — never who asked.

We never sell your data, and we share with these providers only what each needs to deliver its part of the service.

How we protect what you share with your Circle

Bramble is designed around a privacy posture, not just a privacy policy.

• Journal entries are stored for your account and visible only to you. Circle members never see them, and they are not used to train the protection system.
• Circle messages are stored end-to-end encrypted where supported and are never used to train the protection system.
• Check-in text — intention, gratitude — is visible only to you.
• Mood values are shown to your Circle only as a trend direction (“trending up,” “holding steady,” “needs support”) — never the raw 1–10 number.
• Urge moments are surfaced to your Circle as “had a hard moment” — never with content details.
• DNS learning events are hashed on your device before upload. Allowed DNS questions still have to be transmitted to a resolver in real time to return a network address; Bramble does not retain those raw questions at its resolver.

How long we keep your information

We keep account, recovery, message, and account-linked protection data while your account is active. If you delete your account in Settings, Bramble initiates deletion immediately; processors and backups may take up to 30 days to complete deletion. Aggregate or de-identified protection signals may be retained because they are no longer associated with your account.

Specific shorter periods apply to higher-volume or more sensitive operational data:

• Identity on sampled allowed-DNS events: 2 hours; the hash and outcome may remain de-identified.
• URL-classification hash and decision cache: 7 days.
• Page addresses from Safari (the classification corpus): kept while your account is active, under a pseudonymous per-account key rather than your account identifier; deleted when you delete your account.
• Raw training-image URLs: 30 days; the hash, verdict, and correction label may remain.
• Structural crash reports: 30 days.
• Performance, energy, and extension-health diagnostics: 90 days.

Your rights

You can request a copy of your data, ask us to correct it, or ask us to delete it. To delete your account, go to Settings → Account in the app, or email luke@getbramble.app and we will respond within 30 days.

Children

Bramble is intended for adults (18+). We do not knowingly collect data from children under 13.

Changes

If we change this policy in a material way, we will notify you in the app and update the “Last updated” date above.

Contact

Bramble Health LLC
2108 N St Ste C, Sacramento, CA 95816
luke@getbramble.app