Privacy policy

Last updated: October 22, 2026

This policy explains what data the Bineural app for Android (package name ninja.ronin2.isotonos) processes, why, and who it is shared with. Bineural has no user accounts of its own: we never ask for your name, email or password. The only sign-in is Google sign-in, which is optional and used only to save backups to your Google Drive.

1. Controller

The data controller is Nomada. For any privacy question, write to martin@nomada.dev.

2. Data that stays on your device

• Sessions, settings and coin balance. They are stored in a local database on your phone. We do not send them to our servers.
• Android backup. That database is included in Android’s automatic backup, which Google manages in your Google account according to your system settings. It lets you recover your sessions and balance when you reinstall the app or switch phones. We have no access to that backup. You can turn it off in Android settings.
• Cover photos. If you pick a photo from your gallery as a session cover, the app keeps a cropped copy on your device. It is not uploaded to our servers and is not part of the Android backup; it only leaves your phone if you turn on the Google Drive backup (see below). Deleting the session also deletes the photo. The app only accesses the photo you pick.

3. Optional Google Drive backup

If you want, you can sign in with your Google account to save backups to your own Google Drive. It is optional: the app works the same without signing in.

• What permission it asks for. Only access to the app’s private folder in your Drive (the drive.appdata scope). The app cannot see or change any other file in your Drive.
• What the backup contains. Your sessions, settings, coin balance and the photos you picked as covers.
• Where it lives. In a hidden folder in your Google Drive, tied to Bineural, which uses your account’s storage. It goes straight from your phone to Google: we never receive or store your backups.
• Your account data. The app does not store your name, email, photo or any identifier of your Google account, and does not create any account on our server. Google is the one that remembers which account authorized the backup.
• How to delete it. You can sign out, delete the backup and revoke access at any time. The steps are in Delete account and data.

4. Data that leaves your device

Creating sessions with AI

When you create a session with AI, the app sends our server (Google Cloud Functions, on Firebase, United States region) what you answered in the creator: the text you wrote describing how you want to feel (up to 240 characters), the duration, the listening mode (headphones or speaker), the ambient sounds and music styles you chose, and the app language.

• To design the session, the server sends that information to an AI model provider: DeepSeek (servers in the People’s Republic of China) and, if it fails, OpenAI (United States). These providers process it to return the session, under their own policies.
• We keep a record of each generation in Google Cloud Firestore: the input described above, the resulting session (or the error) and the date. We use it to review failed generations and improve session quality.
• The record is anonymous: it contains no user or device identifier, so we cannot link it to you. It is kept with no set deletion period.
• Do not write personal data (names, health data, contact information) in the creator text.
• Sessions created by hand or with “Edit as new” are not sent to the server.

App verification (Firebase App Check)

To accept requests only from the official app, every AI creation carries a Firebase App Check token, which uses Google’s Play Integrity API to certify that the request comes from a genuine copy of the app. Google processes technical information about the device and the app for this.

Usage analytics (Google Analytics for Firebase)

We measure, in aggregate, how the app is used: how many users there are, how many sessions are created and of what kind (how it was created, duration, listening mode, number of stages, sounds, music styles and language), and other in-app usage events. Google Analytics also collects an app instance identifier, device data (model, OS version, language) and an approximate location derived from the IP address. The text you write in the creator is not sent to analytics. We do not use this data to identify you.

Ads (Google AdMob)

The app shows Google AdMob ads at creation time: full-screen ads and rewarded videos you choose to watch. Never while you listen. AdMob may use your device’s advertising ID, IP address and device information to serve and measure ads and to prevent fraud, and may show personalized ads.

• Where the law requires it (for example in the European Economic Area, the United Kingdom and Switzerland), the app asks for your consent before using your data for personalized ads, and you can change your choice.
• You can reset or delete your advertising ID, or limit personalized ads, in Android settings (Google › Ads).

In-app purchases (Google Play Billing)

Coin pack purchases are processed entirely by Google Play. We neither receive nor store your payment details; the app only receives from Google Play the confirmation of the purchase to add the coins to your balance.

5. Providers that process data

We do not sell your data. Some of these providers are outside your country, so data may be transferred internationally, under the safeguards each provider offers.

6. Legal bases

• Providing the service you ask for: AI session generation, app verification, Google Drive backup and in-app purchases.
• Legitimate interest in improving the app: aggregate analytics and the anonymous generation record.
• Consent for personalized ads where the law requires it.

7. Children

Bineural is not directed at children under 13 and we do not knowingly collect data from children under that age. If you believe a child has given us data, write to us and we will delete it.

8. Your rights

Under applicable law, you may request access to, correction or deletion of your data, object to or restrict its processing, and withdraw your consent. Since the app has no accounts and the generation record is anonymous, in most cases we have no way to identify data about you. Even so:

• You can erase everything stored on your device by uninstalling the app or clearing its data in Android settings.
• You can delete your Google Drive backup and revoke Bineural’s access to your Google account by following the steps in Delete account and data.
• You can reset your advertising ID and change your ad consent choice.
• You can write to martin@nomada.dev with any request. You may also lodge a complaint with your country’s data protection authority.

9. Security

Communication between the app and our server is encrypted (HTTPS). Access to the generation record is restricted.

10. Changes

If we change this policy, we will publish the new version on this page with its update date.