Privacy Policy

1. Data we collect

• Location data.With your permission, we collect your device’s precise location while you are using a tour. This is essential to the Service: it lets Brambling trigger the right audio at the right point on a route. You can withdraw location permission at any time in your device settings, though location-triggered playback will not work without it.
• Account data. Your email address, which we use to sign you in via a one-time code.
• Purchase data. A record of the tours and passes you have bought. Payment is processed by the Apple App Store or Google Play; we do not receive or store your card details.
• Usage and diagnostic data. Basic technical information needed to operate the app, such as which tours you download and anonymous error or performance diagnostics.

2. How we use your data and our lawful basis

• To provide the Service, including location-triggered playback and account access — on the basis of performance of our contract with you (and your consent for accessing device location).
• To process and deliver your purchases — performance of our contract with you.
• To maintain, secure, and improve the Service — our legitimate interests in running a reliable, safe product.
• To comply with legal obligations where applicable.

3. Service providers

We share personal data with trusted providers who process it on our behalf, only as needed to run the Service:

• Supabase— database, authentication, and backend hosting.
• Postmark— delivery of one-time sign-in codes to your email address.
• Apple and Google— app distribution and processing of in-app purchases.
• Transport for London (TfL)— queried for live transport arrival times; requests are made via our servers and do not include your account details.

We do not sell your personal data.

4. International transfers

Some of our providers may process data outside the UK. Where that happens, we rely on appropriate safeguards, such as the UK’s International Data Transfer Agreement or adequacy regulations, to protect your data.

5. Data retention

We keep your personal data only for as long as needed to provide the Service and to meet legal, accounting, or reporting requirements. If you delete your account, we delete or anonymise your associated personal data, except where we are required to retain certain records (for example, purchase records for tax purposes).

6. Your rights

Under UK data protection law you have the right to access, correct, delete, or restrict the processing of your personal data, to object to processing, and to data portability. You can delete your account and associated data directly from within the app. To exercise any other right, contact us using the details below. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

7. Children

The Service is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, please contact us so we can remove it.

8. Changes to this policy

We may update this Privacy Policy from time to time. We will update the “Last updated” date above and, where the changes are material, notify you in the app.

9. Contact

For any privacy questions or to exercise your rights, contact us at hello@brambling.app, or by post to Brambling House Limited, 31 Groveland Road, London, BR3 3PU, United Kingdom.