Privacy Policy

Who we are

The Brutalist (thebrutalist.app), ABN 31 573 604 785, is a service operated from New South Wales, Australia. Privacy questions: hello@thebrutalist.app.

What we collect

• Account data — your email address and sign-in records.
• Usage data— how many renders you’ve used and your plan, so we can meter the free trial and subscription.
• Payment status — handled by Stripe. Card numbers go directly to Stripe; we never see or store them.
• Your sketches & renders— processed transiently to generate your images. We don’t keep a server-side library of your sketches or renders; they are delivered to your device.
• Technical logs — standard hosting logs (IP, timestamps, errors) kept briefly for security and debugging.

The important one: your sketches go to Google

To generate a render, your sketch image is sent to Google’s Gemini API, our AI provider. We use Google’s paid API tier, under which Google states that customer content is not used to train its models. We make no other use of your sketches; Google handles them under its Gemini API terms.

How we use your information

To operate the service, meter usage, process subscriptions, send essential service emails (like sign-in codes), and provide support. We don’t sell your data, we don’t run ads, and we don’t use advertising trackers.

To improve the product we use PostHog analytics: it counts visits and the main steps (signing in, making a render, opening the subscription screen), and it records sessions inside The Brutalist — taps, scrolls and drawing — so we can see where the app is hard to use. Anything you type into a form, like your email or sign-in code, is hidden in those recordings, and we link them to your account number, not your email. Recordings are kept for at most 30 days. Its cookies, and the ones that keep you signed in, are the only cookies we use.

Who processes data for us

• Supabase— account database & authentication (hosted in Sydney, Australia)
• Google (Gemini API) — AI image generation
• Stripe — subscription payments
• Vercel — website hosting and logs
• PostHog — product analytics and session recordings (hosted in the European Union)
• Zoho — our email (when you write to us or we write to you)

Some of these providers process data outside Australia, primarily in the United States (Google, Stripe, Vercel). We only share what each provider needs to do its job.

Retention & your rights

We keep your account data while your account is active. Email us to access, correct, or delete your data — deletion requests are honoured within 30 days, except records we must keep (e.g., billing records for tax law). If you’re unsatisfied with how we handle a privacy complaint, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If we materially change this policy we’ll notify you by email or in the app.