Privacy Policy — Mosaic Brain

1. Overview

Mosaic Brain is an adult self-help and habit-reflection application. The installed application name on your device is Mosaic, distributed on the Apple App Store as Mosaic Brain.

This release (v1.0.0) contains no user accounts, no cloud backend, no cloud database synchronization, no partner messaging, no commercial advertisements, no behavioral analytics SDKs, and no crash-reporting telemetries. The application does not automatically upload your habit information, urge logs, or reflections to the developer.

2. Information stored by Mosaic

When you use the mobile application, Mosaic stores the information you choose to enter on your device. This may include:

• Your date of birth (used locally to verify that you are at least 18 years old and to calculate the life calendar visualizer);
• Your chosen habit category and journey start date/time;
• Logged urge occurrences, intensities (1–5), and associated trigger tags;
• Recorded slips, reflections, and trigger notes;
• Personal cognitive restructuring notes and journal reflections;
• Method lesson progress and completed readings;
• Application preferences (such as theme color, tile style, and local reminder settings);
• App lock preferences and a salted PIN hash (if you enable PIN protection).

3. Local storage and encryption

The records listed above are stored on your device in a local SQLite database encrypted with SQLCipher (AES-256).

The encryption key is generated locally on your device and kept in operating-system secure storage (the iOS Keychain via Flutter Secure Storage). If you enable an in-app PIN, the PIN is never saved in plaintext; only a cryptographically salted hash is stored in secure storage.

The developer operates no cloud account service, has no remote master key, and has no technical means to view, decrypt, or restore this local database.

4. Information Mosaic does not automatically transmit

Mosaic does not connect to any developer-operated servers during normal use. Specifically, the application does not transmit:

• Your habit selections, urge logs, slip notes, or reflections;
• Your date of birth or age;
• Device identifiers, Advertising IDs (IDFA), or vendor identifiers;
• Behavioral usage telemetry, interaction metrics, or screen views;
• Crash logs or diagnostics to remote services.

The app contains no third-party tracking libraries and declares zero data collection in the Apple App Store Privacy Nutrition Labels.

5. Device backups and copies outside Mosaic

While Mosaic does not transmit data over the network, copies of device data may exist outside Mosaic's sandbox depending on how your operating system is configured:

• Operating system backups: Standard device backup services (such as Apple iCloud Backup or computer backups via Finder/iTunes) may back up application container data and eligible keychain items according to your personal Apple account and iOS device settings.
• Manual export: Mosaic includes a limited data export feature in Settings. This generates a brief, unencrypted JSON summary of your active habit name and slip dates on your screen. It is not a complete backup and does not include your journal or urge history. If you choose to copy this text, anyone with access to that copy can read it.
• Screenshots: Any screenshot captured on your device is managed by the operating system photo library, not Mosaic.

Mosaic has no in-app cloud backup or restore service. Retention, restoration, and deletion of device-level backups are governed entirely by Apple and your device settings.

6. Notifications and device permissions

Local reminders: If you grant notification permission, Mosaic uses local device scheduling to deliver an optional daily check-in reminder. These notifications use neutral, discreet wording (such as "Daily reflection"). No remote push notification service, push servers, or device tokens are used.

Biometrics (Face ID / Touch ID): If you enable biometric app lock, authentication is performed entirely by Apple's LocalAuthentication system framework. Mosaic receives only a boolean success or failure signal; biometric samples never leave the Secure Enclave and are never accessible to Mosaic.

External links: Tapping "Privacy Policy" or "Crisis Helplines" in the app opens an explicit web link or telephone prompt in your default system browser or phone dialer. Mosaic attaches no habit data or identifiers to these actions.

7. Deleting your local data

You can delete all application data at any time from within the app:

Limitations: Local deletion removes data within Mosaic's local sandbox on that device. It cannot retroactively delete copies you manually exported, screenshots you saved, or prior device backups created by iOS. It is not a guarantee of forensic memory-wiping.

8. Support communications and website data

If you contact our support team—either by emailing support@mosaicbrain.app or by submitting the contact form on our support website—you voluntarily provide information necessary to address your inquiry.

This may include your name, email address, inquiry topic, message content, and optional technical details (such as app version or iOS version).

Contacting support does not transmit or connect to your local in-app Mosaic database.

9. Third-party services used by the website

The public website (mosaicbrain.app) is hosted as static content.

• Hosting & Content Delivery: The site is served through static hosting infrastructure (such as Cloudflare Pages). Standard HTTP network logs (containing IP addresses and browser user-agent headers) may be processed transiently by the infrastructure provider for connection delivery, DDoS mitigation, and security operations under their respective privacy policies.
• Support Form Processing (Formaloo): If you choose to submit a support request through the embedded web form on our Support page, the form is processed by Formaloo Inc. The information you voluntarily type into the form is transmitted to Formaloo to deliver the inquiry to our support mailbox. Formaloo operates under its own privacy policy. Mosaic embeds this form using sandboxed frames without loading general advertising or cross-site tracking scripts.
• Zero Tracking on Mosaic Pages: Mosaic Brain does not embed Google Analytics, Meta Pixel, tracking cookies, or behavioral surveillance tools on this website.

10. Adults-only status (18+)

Mosaic Brain is strictly intended for adults aged 18 and older. During initial onboarding, the app requires the entry of a date of birth to confirm that the user is an adult. The app does not knowingly permit use by or collect information from minors.

11. Medical and wellness notice

Mosaic Brain is an educational self-help tool based on cognitive reframing and habit tracking. It is not a medical device, clinical software, or licensed medical or psychological treatment. It does not provide medical diagnoses, treatment plans, or emergency intervention.

Substance withdrawal caution: If you are stopping alcohol, benzodiazepines, opioids, or any substance where sudden cessation can trigger severe, life-threatening withdrawal complications, talk to a qualified medical professional before stopping abruptly.

12. Security

We prioritize data privacy through architecture: by keeping application data on your local device under SQLCipher encryption and hardware-backed key storage, we eliminate server-side database breach risks for your entries. We recommend maintaining an active device passcode and enabling biometric device locking to safeguard your phone against unauthorized physical access.

13. Changes to this policy

If future updates modify data storage, network capabilities, or support integrations, this policy will be revised accordingly. The updated version will be published at https://mosaicbrain.app/privacy with an updated effective date.