Privacy policy
DRAFT. Not yet approved. This draft waits for the owner's legal sign-off. It is not legal advice. Every
[TO FILL]and[TO CONFIRM]item must be answered before this page goes live. See README.md.
Last updated: [TO FILL: date it goes live]
This page explains what we collect when you use cerebonic.com, why we collect it, and what you can do about it. We have tried to keep it short and plain.
This policy covers the Cerebonic website only. The Studio app has its own policy at /studio/privacy.
Who we are
Cerebonic by AJ Brett runs cerebonic.com.
| Item | Detail |
|---|---|
| Who is in charge of your data (the "controller") | [TO FILL: legal name and address] |
| How to contact us about your data | [TO FILL: email] |
| ICO registration number | [TO CONFIRM: whether a data protection fee is due, and the number if so] |
What we collect
| What | When we get it | Example |
|---|---|---|
| First name and email | You unlock a free guide | "Sam", sam@example.com |
| Which guide you unlocked, and when | You unlock a free guide | TT-1, 1 November 2026 at 10:04 |
| Where you came from | You follow a link from one of our posts, or a link someone shared | The keyword you commented (such as "GUIDE"), the app (Instagram, YouTube, TikTok or Facebook, or "shared" for a link shared from a guide page) and the code of the video whose link you followed (such as CR-13). Stored with your guide unlock |
| Your step progress | You tick "Mark complete" on a step of a guide | HG-1, steps 1 and 3 ticked, and when each was ticked |
| Page-visit counts | You open the home page or a guide page | "A guide page was opened, from YouTube, video CR-13". Only the page, the app and the video code: no name, email, IP address or cookie |
| Your marketing choice | You tick, or leave unticked, the "send me emails" box | Ticked on 1 November 2026 |
| Account details | You make an account | Your email, a scrambled (hashed) password, and the date you joined |
| Google sign-in details | You sign in with Google | Your name, email and Google account ID. We never see your Google password |
| Waitlist details | You join the waitlist | Your email and the date you joined |
| What you put into our free tools | You use a tool | [TO CONFIRM: what each tool stores, if anything, and for how long] |
| Basic technical data | You visit any page | Your IP address and browser type, kept in our host's server logs |
We do not collect payment details. We do not knowingly collect sensitive data, such as health information.
Why we use it, and our lawful basis
The law says we need a good reason (a "lawful basis") for each use of your data. Here they are.
| Why we use your data | What we use | Lawful basis |
|---|---|---|
| To unlock the guide you asked for, and remember that you unlocked it | Name, email, guide, time | Legitimate interests (giving you the guide you asked for, in return for your details) or contract [TO CONFIRM: which basis the owner picks] |
| To send you marketing emails (new guides, tools and news) | Name, email, your marketing choice | Consent. Only if you ticked the box. You can take it back at any time |
| To run your account and let you sign in | Account details, Google sign-in details | Contract (we need them to give you the account you asked for) |
| To keep you on the waitlist and tell you when it opens | Waitlist details | [TO CONFIRM: consent, or legitimate interests] |
| To show your progress through a guide and let you carry on where you left off | Your step progress, linked to your guide sign-up | [TO CONFIRM: the same basis as the guide unlock above] |
| To learn which posts, videos and apps send people to us | Keyword, app, video code, guide, time; page-visit counts | Legitimate interests (knowing what works, so we make more of it) |
| To keep the site safe and working | Technical data, strictly necessary cookies | Legitimate interests (security and running the site) |
| To meet our legal duties | Any of the above, if the law requires it | Legal obligation |
Getting a guide never depends on agreeing to marketing. The marketing box is separate and starts unticked.
Confirm email (proposed): if you tick the marketing box, we plan to send one email asking you to confirm. You can read the guide straight away either way. [TO CONFIRM: double opt-in for marketing, yes or no]
Cookies
A cookie is a small file a website saves in your browser.
| Cookie | What it does | Type | How long it lasts |
|---|---|---|---|
| Sign-in cookie | Keeps you signed in to your account | Strictly necessary | [TO CONFIRM: proposed 30 days] |
| Guide unlock cookie | Remembers you unlocked a guide, so we don't ask again | Strictly necessary | [TO CONFIRM: proposed 12 months] |
| Security cookie | Protects forms from misuse | Strictly necessary | Until you close the browser |
| Step progress in your browser (browser storage, not a cookie) | Holds a step you ticked while offline, until it can be saved to your guide sign-up | Strictly necessary | Until it is saved, then removed |
Today we only use strictly necessary cookies. The law (PECR) lets us use these without asking first, because the site cannot do what you asked without them.
Flag for the owner: if we add analytics (such as Google Analytics) or advertising pixels (such as a Meta or TikTok pixel), we must show a cookie banner and get your "yes" first, before those cookies are set. This section must then be updated. [TO CONFIRM: analytics, yes or no, and which tool]
You can delete cookies in your browser settings at any time. If you do, you may need to sign in or unlock a guide again.
Who we share it with
We do not sell your data. We share it only with the companies that help us run the site (our "processors"). They may only use it to do that job for us.
| What they do | Company | Where |
|---|---|---|
| Hosting the website | Our own server (a VPS) [TO CONFIRM: the server company's name] | [TO CONFIRM] |
| Storing data (database) | [TO CONFIRM: Neon, or our own server] | [TO CONFIRM] |
| Sending emails | [TO CONFIRM: provider not chosen] | [TO CONFIRM] |
| Google sign-in | Google [TO CONFIRM: only if Google sign-in is kept] | [TO CONFIRM] |
| [TO CONFIRM: any other, such as analytics] | [TO CONFIRM] | [TO CONFIRM] |
We may also share data if the law makes us, or to protect our rights or someone's safety.
Sending data outside the UK
Some of these companies may be based in the US or store data there. [TO CONFIRM: each provider's location]
When data leaves the UK, we make sure it stays protected. We do this in one of these ways:
| Safeguard | What it means |
|---|---|
| UK "adequacy" rules | The UK government has said the country, or the US company's scheme (the UK Extension to the EU-US Data Privacy Framework), protects data well enough [TO CONFIRM: which providers are certified] |
| UK International Data Transfer Agreement (IDTA) or UK Addendum | A contract that makes the company protect your data to UK standards [TO CONFIRM: in each provider's terms] |
You can ask us for more detail using the contact above.
How long we keep it
These are proposals and have not been agreed yet.
| Data | Proposed time we keep it |
|---|---|
| Guide sign-ups (name, email, guide, source, time) | [TO CONFIRM: proposed 2 years after your last guide unlock] |
| Step progress | Deleted at once when you un-tick a step, or when you delete your details. Otherwise [TO CONFIRM: proposed the same as your guide sign-up] |
| Page-visit counts (page, app, video code; no personal data) | [TO CONFIRM: proposed 2 years] |
| Marketing list | [TO CONFIRM: proposed until you unsubscribe, then only your email on a "do not email" list so we never email you by mistake] |
| Proof of your marketing consent | [TO CONFIRM: proposed as long as we email you, plus 2 years] |
| Account details | [TO CONFIRM: proposed until you delete your account, or 2 years with no sign-in] |
| Waitlist | [TO CONFIRM: proposed until the paid version opens, plus 6 months] |
| Free tool inputs | [TO CONFIRM: depends on each tool] |
| Server logs | [TO CONFIRM: proposed up to 30 days, or the host's default] |
When the time is up, we delete the data or make it anonymous.
Your rights
You have rights over your data under UK law.
| Your right | What it means |
|---|---|
| Access | Ask for a copy of the data we hold about you |
| Correction | Ask us to fix data that is wrong |
| Deletion | Ask us to delete your data |
| Objection | Ask us to stop using your data where we rely on legitimate interests |
| Withdraw consent | Stop marketing emails at any time. Use the "unsubscribe" link in any email, or contact us |
| Restriction | Ask us to pause using your data while a problem is sorted out |
| Portability | Ask for your data in a file you can take elsewhere |
To use any of these rights, email [TO FILL: email]. It is free. We will reply within one month.
Complaints. If you are unhappy with how we use your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK data regulator: ico.org.uk or 0303 123 1113.
How to delete your account
- Sign in.
- Go to /account/delete (cerebonic.com/account/delete).
- Confirm.
We then delete your account details. Your step progress is deleted with them. [TO CONFIRM: what happens to guide sign-ups and the marketing list when an account is deleted, and how long deletion takes]
No account? Email [TO FILL: email] and ask us to delete your guide sign-up or waitlist details.
Children
This site is not for children under 13. [TO CONFIRM: the minimum age the owner wants] We do not knowingly collect data from children under that age. If you think a child has given us their details, email [TO FILL: email] and we will delete them.
Changes to this policy
We may update this page. If we make a big change, we will tell you on the site, and by email if you have an account or are on our list. The date at the top shows the last update.
Contact
[TO FILL: legal name and address] Email: [TO FILL: email]