Privacy Policy — Scry

Scry is Bravely Studios LLC’s remote desktop product for your own computers and invited support sessions. This Privacy Policy covers the Scry browser app at scry.bravely.dev, the marketing hub at bravely.dev/scry, and the native host and client apps for macOS, Windows, iPhone, iPad, and Android.

Here is a summary of the personal data Scry collects, aligned with the App Store privacy details for the app. None of this data is used to track you across other companies’ apps or websites, and we never sell it. • Email Address (Contact Info) — your account email address. Used for app functionality; linked to your identity. • User ID (Identifiers) — your Bravely Account identifier. Used for app functionality; linked to your identity. • Product Interaction (Usage Data) — anonymous, aggregate feature-usage events. Used for analytics; you can opt out where a client offers the toggle. • Crash Data (Diagnostics) — crash and error reports. Used for app functionality, to keep Scry reliable. • Customer Support (User Content) — information you choose to send us when you contact support or submit a diagnostic report. Used for app functionality. The sections below describe how each of these is handled in more detail.

When you sign in to Scry, we store the account details needed to identify you and secure access to your devices. This can include your Bravely Account identifier, email address, sign-in method, and the display name returned by that sign-in method. We do not store your password in plain text; credential handling is delegated to our authentication system and the sign-in method you use.

To make remote access work, Scry stores the devices attached to your account and the metadata needed to establish sessions between them. This includes device names, platform type, online/offline state, ownership and sharing state, session identifiers, timestamps, and connection diagnostics such as connection-allocation details and coarse network errors. When direct peer-to-peer connection is unavailable, some active session traffic may pass through Bravely-managed relay systems so the session can stay connected.

We use Scry data only to operate the product: • authenticate you and protect access to your devices • show your device list and current availability • establish, route, and troubleshoot active remote sessions • enforce preview and paid-feature access rules • answer support requests and investigate abuse or fraud We do not sell your information or use it for advertising.

Scry uses product analytics to understand aggregate product usage, feature adoption, and coarse failure states. Events may include app version, platform, anonymous device identifiers, account-linked identifiers where needed for Pro access troubleshooting, and high-level session lifecycle events. Where a client exposes an analytics toggle, you can opt out there. We do not use Scry analytics to record the contents of your desktop, your files, or the text you type into another app.

Scry has a paid Pro tier. We store your Bravely Account identifier, contact email, Pro access status, platform customer identifiers, and transaction identifiers so we can unlock the correct features on your account across supported platforms. Payment card details are handled by the platform that billed you, not by Bravely Studios LLC.

Native Scry builds may request system permissions such as screen capture, accessibility/input control, microphone access, notifications, or file access when those capabilities are part of the feature you are actively enabling. Granting a permission does not by itself publish your data to other users; the permission is used so the app can perform the remote access or support action you requested on your own device.

We share Scry data only in these limited cases: • with service providers that run parts of the service on our behalf, including authentication, hosting, analytics, Pro access, billing, and app-store providers • with another person you explicitly authorize once support-session or trusted-sharing features are enabled in your build • when required by law, legal process, or to protect the safety and integrity of the service We do not sell or rent your data to advertisers or data brokers.

We secure Scry using authenticated accounts, transport encryption, and device/session authorization checks. We are not marketing Scry as end-to-end encrypted at this time, and we do not make privacy or security claims beyond what we have shipped and documented publicly. If stronger guarantees are shipped later, this policy and the product materials will be updated to match that proven contract.

We retain account, device, session, and Pro access records only as long as reasonably necessary to operate Scry, investigate abuse, comply with legal obligations, and support customer requests. You can delete your Bravely Account at any time from within Scry — open Settings and choose “Delete Account.” Deletion runs on a 30-day grace period: you are signed out immediately and can restore your account by signing back in within those 30 days, after which your account and associated personal data (profile, device list, sessions, sign-in records, and entitlements) are permanently deleted, and any subscription billed directly by Bravely Studios LLC is canceled. Subscriptions purchased through the App Store or Google Play are managed by that store and should be canceled there. You can also email support@bravely.dev to have us process the deletion for you.

Depending on where you live, you have rights over the personal data we hold about you. We honor these rights for everyone who asks, regardless of where you live. • Access — ask what personal data we hold about you and get a copy. • Correction — ask us to fix data that is wrong or incomplete. • Deletion — ask us to delete your personal data by emailing privacy@bravely.dev from the address on your account. Where a product has a built-in Delete Account control you can use that instead; bravely.dev/delete-account explains what applies to each product. • Portability — ask for your data in a portable, machine-readable format. • Objection and restriction — ask us to stop or limit certain processing. • Withdraw consent — where we rely on consent (marketing email, optional analytics), you can withdraw it at any time without affecting processing that already happened. • Non-discrimination — we will not degrade your service or charge you more for exercising any of these rights. EEA and UK residents also have the right to lodge a complaint with your local supervisory authority. California residents may use an authorized agent; we may verify the agent's authority and confirm the request with you first. Other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and others as they take effect) have equivalent rights, including a right to appeal a denied request — reply to our decision email with "Appeal" and we will respond in writing within the period the law requires. Canadian residents have access, correction, and consent-withdrawal rights under PIPEDA; Australian residents have access and correction rights under the Australian Privacy Principles. To exercise any right, email privacy@bravely.dev. We respond within the timeframe the applicable law requires — generally 30 days under GDPR and 45 days under the CCPA, with an extension where the law permits one. We may need to verify your identity before acting, usually by confirming control of the email address on the account.

If you are in the EEA or UK, we rely on these lawful bases under the GDPR and UK GDPR: • Performance of a contract — creating and securing your account, delivering the features you paid for, syncing your content, processing purchases, and providing support. • Legitimate interests — keeping the service secure and reliable, preventing fraud and abuse, understanding aggregate product usage, and improving the product. We balance these against your rights and do not use them to justify intrusive tracking. • Consent — marketing email, and optional analytics where a client offers a toggle. You can withdraw consent at any time. • Legal obligation — keeping tax, accounting, and consent records, and responding to lawful requests.

Bravely Studios LLC is a US company. We and our sub-processors process data in the United States and in other countries where they operate. For personal data originating in the EEA, UK, or Switzerland, we rely on appropriate transfer safeguards in our processor agreements — such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum — where those safeguards are required. Email privacy@bravely.dev if you want more detail about the safeguards that apply to you.

For California residents, the categories of personal information we collect for this product are: • Identifiers — your Bravely Account identifier, email address, and device or installation identifiers. • Commercial information — records of purchases, subscriptions, entitlements, trials, and refunds. • Internet or other electronic network activity — aggregate feature-usage events, app version, platform, crash and error reports. • Coarse geolocation — a country-level signal derived from your network connection, used for consent rules and tax. • Your content — only the content the product is built to store or sync for you, described in the sections above. We collect this from you, your device, and our own systems, and we use it to run the product, honor what you have bought, keep the service secure, and support you. We disclose it to the service providers listed under "Sub-processors," each for a business purpose under a written contract. We do not sell your personal information and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding 12 months. We do not use or disclose sensitive personal information for any purpose that would trigger the right to limit. If that ever changes we will update this policy and provide the required opt-out before the practice begins. Retention is described under "Data Retention" above and, for account-level data, in the Bravely Account privacy policy.

We use the following service providers to run this product. They receive only what they need to perform their service for us, and each is bound by the data-processing terms that apply to our use of their service. Where a provider is not yet covered by a written data-processing agreement with us, its entry below says so. If you need a data-processing agreement in place before you use this product, email privacy@bravely.dev: • Cloudflare, Inc. — hosting, the Workers runtime, D1 databases, R2 object storage, and bot protection for bravely.dev and our app subdomains. See cloudflare.com/privacypolicy. • Google LLC — Firebase Authentication, which backs Bravely Account sign-in (including Sign in with Google). See policies.google.com/privacy. • Apple Inc. — Sign in with Apple, and App Store purchase and receipt handling for our Apple platform apps. See apple.com/legal/privacy. • Paddle.com Market Ltd — our merchant of record for purchases made on the web or in our desktop apps. Paddle handles checkout, payment processing, invoicing, and sales tax/VAT. See paddle.com/legal/privacy. • RevenueCat, Inc. — validates App Store and Google Play receipts and reports subscription lifecycle events so we can unlock what you bought. See revenuecat.com/privacy. • PostHog Inc. — product analytics for aggregate feature usage and reliability. See posthog.com/privacy. • Resend Inc. — sends our transactional email (sign-in codes, receipts, password resets, support replies). See resend.com/legal/privacy-policy. If we add or change a sub-processor in a way that materially changes how your data is processed, we will update this policy and give additional notice where the law or our data-processing commitments require it.

We protect your data with authenticated accounts, encryption in transit, access controls on our backend systems, and a deliberately small number of people who can reach production. No system is perfectly secure, and we do not claim guarantees we have not built and verified. Where a product makes a specific security claim, that claim appears in the app-specific sections above and is limited to what we have actually shipped. If we become aware of a breach affecting your personal data, we will notify you and the relevant regulators as required by law.

We may update this Privacy Policy from time to time. If we make a material change — a new category of data, a new sub-processor, a new purpose, or a new legal basis — we will update the "Last updated" and "Effective" dates and give additional notice where the law requires it. Where a change requires fresh consent under the GDPR, UK GDPR, CASL, or a similar regime, we will ask for it before relying on the new purpose. Non-material changes (typos, clarifications, link fixes) are reflected by updating the "Last updated" date.

Bravely Studios LLC Privacy and data rights: privacy@bravely.dev Product support: support@bravely.dev Website: https://bravely.dev Postal address: available on request to privacy@bravely.dev.