Your brief is not our business model.

Information kept on your device

Project names, client labels, questions, answers, filenames, deterministic gap results, activity, versions, acknowledgments, and exports are stored in Brievra’s local app container. The database directory uses Apple complete file protection. Public-link owner and responder capabilities are stored separately in the device-only Keychain so the app can retrieve, decrypt, and revoke responses. Brievra does not upload local workspace content unless you explicitly publish a client link.

Optional encrypted public intake

When a Pro user publishes a link, Brievra encrypts the question structure and display labels on device with AES-GCM before upload. The service stores the ciphertext, a random link identifier, SHA-256 digests of separate responder and owner capabilities, creation/expiry/revocation times, and a response count. The raw responder capability is placed in the URL fragment, which browsers do not send in the HTTP request, and the page removes that fragment from browser history immediately.

The client page decrypts questions in the browser and encrypts answers there before upload. The service does not receive readable brief or response content. A responder capability can read one encrypted form and submit up to five encrypted responses. It cannot list responses or revoke the link. The separate owner capability can list ciphertext responses and revoke the link.

Service provider and network data

Cloudflare hosts the Brievra public-intake Worker, encrypted D1 records, static support pages, TLS delivery, and per-address rate limiting. Cloudflare necessarily processes network information such as IP address, request time, route, and security signals to deliver and protect the service. Brievra disables Worker observability logs and does not add content logging. Cloudflare’s processing is governed by its own legal and security obligations.

Retention and deletion

Brievra links default to 14 days and can never exceed 30 days. A daily cleanup deletes encrypted responses and link records within approximately 24 hours after expiry or revocation. Revoking a link in the app also removes its local Keychain capabilities. Deleting a local brief deletes its app record and first attempts to revoke any active link. Removing the app deletes its local container and Keychain items according to Apple platform behavior, but it does not by itself send a network revocation; outstanding server records still expire automatically.

Purchases

Apple processes App Store downloads, trials, subscriptions, lifetime purchases, refunds, tax, and payment details. Brievra reads StoreKit product and entitlement status to unlock Pro features. The developer does not receive your full payment-card details or Apple Account password.

Sharing and exports

When you use the system share sheet, you choose the destination. Copies sent to Mail, Messages, Files, or another service are controlled by that destination. A person who has a live responder link can open its encrypted form, so share it only with the intended client and revoke it if it is exposed.

Your choices

• Use the complete local workspace without publishing a link.
• Revoke a link at any time from Review.
• Delete local briefs from the app and manage shared exports in their destination.
• Request privacy assistance without sending confidential brief content.

Children, changes, and contact

Brievra is a professional business tool and is not directed to children. Material policy changes will appear here with a new effective date. For a privacy or deletion question, email privacy@nexlevel.com.br. Do not include passwords, payment details, or an unredacted confidential brief.