HERAZUR LLC / BRUSHLOOP

Brushloop privacy policy

Effective October 20, 2026

This policy explains how Herazur LLC (“we”, “us”) handles information in Brushloop, a two-minute toothbrush timer and brushing habit tracker. Brushloop is published on Google Play as “Brushloop: Toothbrush Timer” (package com.brushloop.app).

Summary

• Your brushing history, progress, and settings are stored only on your phone. They are not uploaded, even if you sign in.
• An account is optional. It exists so that Premium follows you to your other devices.
• Usage analytics and crash reports are on by default. You can turn them off at any time in Profile → Your data.
• There are no ads. We do not use your advertising ID, sell your personal information, or track you across other companies’ apps or websites.

Information we collect

Brushing records stored on your phone

Your morning and evening brushing sessions (date, time, length, and whether you used the timer or tapped “Already brushed”), floss days, toothbrush replacement dates, XP, levels, achievements, personal records, and settings such as reminder times, sound, vibration, theme, and timer length. These are saved in the app’s storage on your phone. We do not receive them.

Account information (optional)

If you create an account with an email address and password, Firebase Authentication stores your email address, a user ID, and whether your email address is verified; your password is handled by Firebase and we never see it. If you continue with Google, Firebase receives the email address, name, profile photo link, and account identifier your Google account shares. Firebase also sends the verification and password-reset emails you ask for. Your brushing history is not uploaded to your account.

Usage analytics and crash reports (on by default)

Unless you turn off Share usage & crash reports in Profile → Your data, Firebase Analytics receives which tab you open and these events: onboarding completed (and whether reminders were turned on); a brushing session logged (morning or evening, timer or manual, length, whether it was a full session, whether it was filled in for an earlier day, and XP gained); a level, achievement, or weekly goal reached; the Premium screen viewed and which feature led there; Premium unlocked (plan, whether it was a trial, and whether it was restored); and sign-up, sign-in (with the method), sign-out, and account deletion. Firebase also records standard technical information such as an app-instance identifier, device model, operating system and app version, and approximate location (country or region) derived from your IP address.

Firebase Crashlytics receives a report when the app crashes: the stack trace, device model, operating system and app version, and a random installation identifier. Analytics events and crash reports do not include your name, email address, or account ID. Advertising-ID collection and ad-personalization signals are switched off, and the advertising-ID permission is removed from the app. Turning the switch off stops both analytics and crash reports.

Premium

Brushloop Premium is optional and is sold through Google Play as a monthly or yearly subscription or a one-time lifetime purchase. Google Play processes the payment; we never see your card details. When the app starts, and when you view plans, buy, or restore, the app checks with RevenueCat whether Premium is active. RevenueCat receives a random app user ID that its library creates, or your account’s user ID while you are signed in (never your name or email address), together with your purchase records (product, trial status, purchase and renewal or expiry dates, and store transaction details) and basic technical information needed to validate purchases, such as store country, app version, and operating system. Automatic device-identifier collection in that library is switched off.

Notifications

Morning and evening reminders, snoozes, and timer alerts are scheduled on your phone. No notification is sent from a server, and we do not collect a push token. Reminder settings stay on your phone.

Android device backup

If Android backup is turned on for your Google account, Android may include Brushloop’s data in your device backup so it can be restored on a new phone. That backup is managed by Google under your Google account; we cannot read it. You control it in your phone’s backup settings.

What we do not collect

We do not ask for photos, contacts, location permission, or microphone access, and the app contains no advertising tools.

Permissions

Notifications: the reminders you turn on, with “Start brushing”, “Snooze”, and “Already brushed” actions. Vibration: a gentle cue when it is time to switch zones and when a session ends; you can turn it off in the app. Keep the screen on: during a brushing session. Run at startup: restoring your reminders after the phone restarts. Internet: the optional account, analytics and crash reports, and Premium; the timer, tracking, and reminders work offline. Google Play billing: buying and restoring Premium. You can change permissions in your device settings.

How we use information

We use information to run the timer and track your habit on your phone; provide your optional account; sell, verify, and restore Premium; send the reminders you choose; understand which features help people keep a brushing habit and fix crashes; respond to support requests; and meet legal obligations.

Service providers

We share information only with providers that process it on our behalf to run the app:

• Google Firebase (Authentication, Analytics, Crashlytics): your optional account, usage analytics, and crash reports.
• RevenueCat: Premium status and purchase records.
• Google: Google Sign-In, Google Play distribution, and in-app purchases.

We may also disclose information if required by law or to protect the rights, safety, or security of our users or others. We do not sell personal information or share it for cross-context behavioral advertising.

Where data is processed

Your brushing records stay on your phone. Account information, analytics, crash reports, and purchase records may be processed by Google and RevenueCat in the United States and other countries. Where required, transfers rely on appropriate safeguards such as the providers’ standard contractual clauses.

Retention

• Brushing records stay on your phone until you use Profile → Your data → Reset all data, clear the app’s storage, or uninstall the app. Because we never receive them, we cannot recover or delete them for you.
• Your account is kept until you delete it.
• Analytics data is kept for the retention period set in Firebase, and crash reports for Crashlytics’ standard period of 90 days.
• Purchase records are kept by RevenueCat and Google Play for as long as needed to provide and restore Premium, handle refunds, and meet tax and accounting obligations.

Deleting your account

In the app, open Profile → Account → Delete account, then confirm with your password or your Google account. This permanently deletes your account from Firebase Authentication. It cannot be undone.

Your brushing history stays on your phone; to erase it, use Profile → Your data → Reset all data or uninstall the app. Deleting your account does not cancel a Premium subscription: cancel it in Google Play under Payments & subscriptions → Subscriptions. Purchase records linked to your account in RevenueCat are not deleted automatically. To ask us to delete them, email us with your Google Play order number (it starts with “GPA.”).

If you cannot use the app, email support@herazur.us from your account’s email address with the subject “Brushloop account deletion”, and we will delete it for you and confirm.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, to object to or restrict certain processing, and to withdraw consent. You can view and delete your brushing records in the app and turn off analytics and crash reports at any time. For other requests, contact us at the address below. We aim to respond within 30 days and will not discriminate against you for exercising your rights. You may also complain to your local data protection authority.

Security

Brushing records stay in the app’s private storage on your phone, protected by Android’s app sandbox. Data sent to our providers is encrypted in transit. No method of transmission or storage is completely secure.

Children

Brushloop is intended for a general audience and is not directed to children under 13. We do not knowingly collect personal information from children under 13. Purchases are made through the store account of the device owner. If you believe a child has provided us information, contact us and we will delete it.

Not dental advice

Brushloop is a habit and timer app. It does not provide medical or dental advice; follow your dentist’s recommendations for your oral care.

Changes to this policy

If we change how we handle information, we will update this page and its effective date and, for significant changes, tell you in the app.

Contact

Privacy questions: furkan@herazur.us. Support and account deletion: support@herazur.us.