Privacy Policy

1. Who We Are

Boon is a product of Brainy Circles OÜ, a company registered in the Republic of Estonia (registry code 17226352, Sepapaja tn 6, 15551 Tallinn). This policy covers boon.ink (the public site) and app.boon.ink (the Boon product). Brainy Circles OÜ is the data controller for the personal data described below.

2. Information We Collect

• Account information: your email address, display name and username, and your password, which is stored only as a salted hash and never in plain text. If you sign up or log in with Google, we receive your Google account id, your verified email address, and your name and profile picture from Google. To keep you signed in we issue tokens to your browser and record the browser type and IP address each sign-in came from.
• Product content:the briefs and messages you send to Boon, Boon's replies, and the fonts, pairings, collections and feedback you save.
• Images you upload for detection: used only to identify the fonts in them. Boon does not keep a copy of the image once the detection has finished.
• Where you came from:when you arrive from one of our posts, a campaign link or a friend's invite, we save that first link's source details (such as the post, the page, the campaign tags and the referral code) on your account when you sign up, so the right post or friend gets the credit.
• Credits and plan: your credit balance and the history of how credits were given and spent, your plan, and, if you take part in a product test (for example, how many starting credits new accounts get), which version you got.
• Payment information: founding membership payments are processed by Stripe. We never see or store your card details. We store your Stripe customer and subscription ids and your membership status.
• Partner programme: if you join as a partner and ask to be paid, the payout method you choose (PayPal or Wise), the payout email, name and country you give us, and the record of your earnings and payouts.
• Usage data: standard technical data from our hosting providers, such as IP address, browser and device type, pages visited and request times. We also record product events, such as sign-ups, asks to Boon, and when a pick is opened, a font is downloaded, or a link to a font source is clicked. For visitors who are not signed in, these events are recorded without an account and without a profile.

3. How We Use Your Information

• To create and secure your account and keep you signed in.
• To generate font suggestions, pairings, detections and licensing information for you.
• To save your collections, saved fonts and preferences across sessions.
• To run credits, the founding membership and the partner programme, including paying partners.
• To understand which posts and links bring people to Boon, and to test changes to the product.
• To improve Boon's suggestion quality, using deidentified or aggregated usage patterns.
• To send account email (verification, account and product notices) through Resend.
• To secure the service, prevent abuse and enforce our Terms of Service.

4. AI Processing

When you chat with Boon, the text you type is sent to Anthropic's Claude models, served through Amazon Web Services Bedrock in the EU, to understand your request and write Boon's reply. Font search, ranking, pairing and detection run on Brainy's own models, on our own infrastructure, not on a third-party AI service.

Your conversations are not used to train Anthropic's models. We may use deidentified, aggregated signals from how briefs map to saved or rejected fonts to improve Boon's own ranking models over time.

5. Legal Basis for Processing (GDPR)

• Contract: to provide your Boon account, credits, membership and partner payouts.
• Consent: where you have given it, for example to receive email you signed up for.
• Legitimate interest: service security, fraud and abuse prevention, measuring where sign-ups come from, product tests, and improving Boon's suggestions.
• Legal obligation: keeping accounting and tax records under Estonian and EU law.

6. Cookies and Local Storage

app.boon.ink stores your sign-in tokens and a few settings (such as your theme) in your browser. When you arrive from one of our posts or an invite link, boon.ink and app.boon.ink remember that link in your browser's local storage until you sign up, so the account you create is credited to the right post or friend. We measure how Boon is used with PostHog in cookieless mode: it stores nothing on your device, and a signed-in person is identified by their account id, never their email. The site loads webfont files from Google Fonts, which receives your browser's IP address when a page loads. We do not run advertising trackers.

7. Data Retention

• Account, product, collection and chat data is kept while your account is active and deleted with your account.
• Uploaded detection images are not kept after the detection finishes.
• Email addresses people gave us before the open beta, to hear when Boon opened, are kept until they unsubscribe or ask us to delete them.
• Payment, payout and earnings records are kept as long as accounting and tax law requires, even after an account is deleted.
• You can ask us to delete your data at any time. Verified requests are handled within 30 days, except for records we must keep by law.

8. Your Rights

Under GDPR and applicable law, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Have your data deleted ("right to be forgotten").
• Object to or restrict processing.
• Receive a portable export of your data.
• Withdraw consent at any time, for example with the unsubscribe link in any email.
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To use any of these rights, including deleting your account, email ron@brainycircles.com from the address on your account.

9. Sub-Processors

We share data with these providers to run Boon:

• Vercel (USA): hosting for boon.ink and app.boon.ink.
• Amazon Web Services: application servers and database (EU, Frankfurt), Bedrock AI processing (EU), and storage for images you post, such as avatars (USA).
• Google (USA): Sign in with Google, and delivery of webfont files used on the site.
• Stripe (USA): payments for the founding membership, as merchant of record.
• Resend (USA): account and transactional email.
• PostHog (USA): product analytics, run without cookies.
• PayPal and Wise: partner payouts, only for partners who request one.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

10. Links to Other Sites

Picks and font cards link to font sources such as Google Fonts, Adobe Fonts and Envato. These links pass through our own address so we can count the click. When you follow one, the other site's own privacy policy applies to what it collects.

11. International Transfers

Brainy Circles OÜ is based in the EU. Some of our providers (Vercel, Google, Stripe, Resend, PostHog) are US companies, and some images you post are stored by Amazon Web Services in the USA, so data may be processed outside the EU/EEA. These transfers are protected by Standard Contractual Clauses or equivalent safeguards and, where applicable, by EU-US Data Privacy Framework certification.

12. Security

We use encryption in transit (TLS), encryption at rest at our cloud providers, salted password hashing and scoped access controls to protect your data.

13. Children

Boon is not intended for anyone under 16, and we do not knowingly collect data from children under 16. If you believe a child has created an account, contact us at ron@brainycircles.com and we will delete the data.

14. Changes to This Policy

We may update this policy as Boon changes. Material changes will be announced on the site or by email at least 14 days before they take effect.

15. Contact

For privacy questions, email ron@brainycircles.com.

Brainy Circles OÜ
Sepapaja tn 6, 15551 Tallinn, Estonia
Registry code 17226352