Privacy Policy

Last Updated: February 22, 2026

1. INTRODUCTION

CogniWatch ("we," "our," or "the App") is committed to protecting your privacy. This policy explains how we handle your information when you use our Apple Watch and iPhone application.

Our core privacy principle: CogniWatch does not collect, store, or process any personally identifiable information (PII). We do not know your name, email address, phone number, or location. All conversation content and audio is encrypted on your device before it reaches our servers. We follow security best practices as recommended by Apple and Google.

2. INFORMATION WE COLLECT

Account Information

  • CogniWatch uses Sign in with Apple for authentication. We receive only your Apple-generated user identifier — we do not request or store your name, email address, or any other personally identifiable information (PII)
  • Your Apple-generated user identifier is an opaque, anonymous token that cannot be used to identify you personally

Voice Input and Conversations

  • When you speak to CogniWatch, your voice audio is sent directly to Google Gemini for transcription and response generation
  • Your questions and the AI responses are stored in your personal account to maintain conversation history and enable cross-device sync
  • Audio recordings (your voice messages and AI-generated voice responses) are stored in your personal account for playback

Credit and Purchase Information

  • Credit balance and transaction history (purchases, free grants, usage) are stored in your account
  • We do NOT process or store payment card details — all purchases are handled by Apple through the App Store

Device Information

  • Basic device attestation information is used to verify that requests come from legitimate Apple devices (Firebase App Check)
  • No personal identifiers, location data, or usage patterns are collected

3. HOW WE USE YOUR INFORMATION

  • To provide AI-powered responses to your questions
  • To maintain conversation history for contextual, multi-turn dialogue
  • To sync your conversations and credits between your Apple Watch and iPhone
  • To store and play back audio recordings of conversations
  • To manage your credit balance and process free credit grants

What We Do NOT Use Your Data For

  • We do NOT use your conversations, audio, or any personal data to train AI models — not ours, not anyone else's
  • We do NOT sell, license, or provide your data to data brokers, aggregators, or any third parties for marketing, profiling, or any purpose beyond operating this app
  • We do NOT mine your conversations for insights, trends, or analytics
  • Your data exists solely to provide you with the CogniWatch service. Period.

4. THIRD-PARTY SERVICES

Google Gemini (AI Processing)

CogniWatch uses Google Gemini, accessed through Firebase AI Logic, to process your requests and generate responses. Your voice audio and/or text is sent to Google's servers for processing and response generation, including text-to-speech audio output.

Firebase (Data Infrastructure)

We use Google Firebase services to securely store and sync your data:

  • Firebase Auth — manages your Sign in with Apple identity (with cryptographic nonce for replay attack prevention)
  • Cloud Firestore — stores your encrypted conversation messages and credit balance
  • Firebase Storage — stores encrypted audio recordings for playback
  • Cloud Functions — handles credit operations via tamper-proof server-side transactions
  • Firebase App Check — verifies that requests come from legitimate Apple devices (App Attest on iPhone, DeviceCheck on Apple Watch)

All Firebase data is stored in Google Cloud infrastructure in a multi-region US deployment (nam5) for high availability (99.999% SLA). Your data is isolated under your authenticated user account and is not accessible to other users.

Apple (Purchases and Settings)

In-app purchases are processed entirely by Apple through the App Store. Voice preferences are synced between devices using Apple's iCloud Key-Value Store.

Relevant privacy policies:

Important: Your conversations are sent to Google Gemini in real-time to generate responses. This data transmission is necessary for the app to function. No data from any of these services is used by Sandy Brook DevWorks for AI training, marketing, or any purpose beyond operating CogniWatch.

5. DATA STORAGE AND RETENTION

Where Your Data Lives

  • Your conversation messages, credit balance, and audio recordings are stored in Google Firebase (Cloud Firestore and Firebase Storage) under your authenticated user account
  • Data is stored in Google Cloud infrastructure in a multi-region US deployment for high availability and durability
  • Your data is isolated to your account and is not accessible to other users or to Sandy Brook DevWorks staff in the normal course of operations
  • Voice preferences are synced via Apple's iCloud Key-Value Store

Data Control

  • You can delete individual messages or all conversation history at any time within the app
  • Uninstalling the app removes local data from your devices

No Data Harvesting

We want to be unambiguous: your data is never harvested, sold, or shared with data aggregators. It is never used to train AI models. It is never analyzed for advertising or profiling purposes. Your conversations and audio exist in Firebase solely to provide you with the CogniWatch service, and for no other reason.

6. DATA SHARING

  • We do NOT sell, rent, license, or share your personal information with third parties for marketing, advertising, profiling, or AI training purposes
  • We do NOT provide your data to data brokers or aggregators under any circumstances
  • We do NOT use advertising or tracking technologies
  • Data is shared only with Google Firebase/Gemini as necessary to operate the app (data storage, AI response generation)
  • We receive only aggregate, non-identifying statistics from Apple App Store Connect (download counts, crash reports, basic usage metrics)

7. ANALYTICS AND TRACKING

  • We do NOT use third-party analytics or tracking tools
  • We do NOT track your behavior or usage patterns
  • Basic app statistics (downloads, active devices, crashes) are provided by Apple and do not identify individual users
  • No cookies or tracking pixels are used

8. CHILDREN'S PRIVACY

CogniWatch is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have collected information from a child under 13, please contact us immediately.

9. YOUR PRIVACY RIGHTS

You have the right to:

  • Delete individual messages or all conversation history within the app
  • Sign out at any time from the iPhone app Settings
  • Stop using the app at any time
  • Contact us with privacy questions or concerns

10. DATA SECURITY

We follow security best practices as recommended by Apple and Google, implementing defense in depth across every layer of the app:

  • All data is transmitted over HTTPS/TLS encrypted connections
  • Client-side end-to-end encryption — all conversation text and audio files are encrypted on your device using AES-256-GCM (via Apple CryptoKit) before leaving the device. Firestore and Firebase Storage only ever store ciphertext. Your encryption key is stored in iCloud Keychain and never leaves your devices
  • No PII stored server-side — we do not collect, store, or process personally identifiable information. Your account is identified only by an opaque Apple-generated token
  • Sign in with Apple with cryptographic nonce — prevents token replay attacks, following Apple's recommended authentication practices
  • Apple ID credential revocation — the app automatically detects and responds if you revoke CogniWatch access in your Apple ID settings, immediately signing you out
  • Firebase App Check — verifies that every request originates from a legitimate Apple device using hardware attestation (App Attest on iPhone, DeviceCheck on Apple Watch), preventing unauthorized API access
  • Firebase Auth — ensures that only you can access your data through authenticated sessions
  • Firestore security rules — enforce that users can only read and write their own data. Credit operations are server-side only (read-only for clients) via Cloud Functions with tamper-proof validation
  • Firebase Storage security rules — restrict audio file access to the owning user, with a 5MB file size limit and content type validation
  • User-scoped encryption keys — encryption keys are scoped to your user account, preventing cross-user key sharing on shared devices
  • Structured logging with privacy annotations — all diagnostic logs use Apple's os.Logger framework with privacy: .private annotations, ensuring sensitive data (balances, transaction IDs) is redacted in release builds
  • No API keys are stored on or distributed to client devices — Firebase manages all service authentication server-side

End-to-End Encryption

All conversation messages and audio files are encrypted on your device using AES-256-GCM (via Apple CryptoKit) before being stored in Firebase. This means that even if Firebase data were accessed, it would be unreadable without your personal encryption key, which is stored exclusively in your iCloud Keychain and syncs only to your own Apple devices. Sandy Brook DevWorks cannot read your conversations or listen to your audio recordings.

11. INTERNATIONAL DATA TRANSFERS

AI service providers may process data in countries outside your residence. By using CogniWatch, you consent to this transfer and processing.

12. CHANGES TO THIS POLICY

We may update this privacy policy from time to time. We will notify you of significant changes by:

  • Posting the new policy at cogniwatch.sandybrook.io/privacy
  • Updating the "Last Updated" date
  • (Optional) In-app notification for material changes

Continued use of the app after changes constitutes acceptance of the updated policy.

13. CALIFORNIA PRIVACY RIGHTS

California residents: We do not sell personal information. We do not share personal information for cross-context behavioral advertising. You have rights under CCPA/CPRA to:

  • Request information about data we collect about you
  • Delete your conversation data directly within the app
  • Not be discriminated against for exercising your privacy rights

To exercise these rights, contact us at hello@sandybrook.io.

14. CONTACT US

If you have questions about this privacy policy or our privacy practices:

Email: hello@sandybrook.io

Sandy Brook DevWorks LLC
5900 Balcones Drive Ste 100
Austin, TX 78731
United States