Privacy

When you create an account, Briohush asks for your name, email address, and password. You sign in with your email address and password. The app uses Better Auth for account access; its records include account, email-verification, and session records. Password credentials are stored as a hash.

Briohush sends the sign-up verification email through the Polsia email service. A session record can include the IP address and browser user-agent sent with a request.

A weekly goal contains text you write, up to 160 characters, and an optional category: movement, rest, or mindfulness. Each daily check-in records a date, whether you marked it complete, and the time it was completed.

When you are signed in, your goal and check-ins are associated with your member account. You can also save private notes with your goal, up to 2,000 characters. Only you can see those notes in your own goal view. Signed-in members can also save preferred check-in weekdays on their account. Those choices are preferences only; Briohush does not schedule reminders from them.

You can save the same kind of goal and check-ins while signed out. Briohush places a random token in a briohush_guest cookie so the browser can return to that guest goal. The cookie is HttpOnly and SameSite=Lax, is marked Secure in production, and expires after one year. The database uses a SHA-256 digest of the token as the guest record key.

If you sign in and successfully claim a guest goal, Briohush copies that goal and its check-ins to your account, deletes the anonymous goal record, and clears the guest cookie. If your account already has a goal, the claim does not replace it.

When the deployment enables visitor analytics, the browser stores a random visitor ID named polsia_vid in local storage and requests a page-view pixel from the configured Polsia API base. The request includes the Briohush app slug and visitor ID.

The Briohush app does not specify how long the analytics platform keeps this information or how it uses it afterward.

The app does not specify retention or deletion periods for account, goal, check-in, or preference records. The guest cookie’s one-year expiry is not a database retention period; the app does not define database cleanup when that cookie expires. The profile page does not include a self-service account-deletion control.