Privacy Policy
This Privacy Policy explains how Broco AI Inc. (“Caught”, “we”, “us”, or “our”) collects, uses, discloses, and protects personal information in connection with the Caught: Gym Alarm mobile application (the “App”) and related services.
This Policy forms part of our Terms of Use. By using the App, you agree to the practices described here.
Who We Are
Broco AI Inc. is incorporated under the Canada Business Corporations Act and is the controller of personal information processed through the App.
Privacy contact: support@brocoai.com
We have designated an individual accountable for our compliance with Canadian privacy law. You may reach that person at the email above.
Age Requirement
The App is for users 16 and older. It is not directed to anyone under 16, and we do not knowingly collect personal information from anyone under 16. If we learn that we have collected information from a user under 16, we will delete the account and its content, including any promise video.
If you are a parent or guardian and believe a user under 16 has registered, contact support@brocoai.com and we will act promptly.
Information We Collect
Information you give us
| Category | Examples |
|---|---|
| Account information | Email address, username or display name, password or third-party sign-in identifier, date of birth (for age verification) |
| Promise video | The video and audio you record of yourself as your accountability forfeit |
| Profile content | Profile photo, bio, and any other content you choose to add |
| Schedule data | The workout days, times, and windows you set |
| Check-in content | Photos or camera frames captured when you scan a gym item to verify attendance |
| Social content | Comments, reactions, and roasts you post on other users’ content |
| Support correspondence | Messages you send us, including any information you include in them |
| Reports | Reports you submit about other users or content |
Information collected automatically
| Category | Examples |
|---|---|
| Device and technical data | Device model, operating system and version, app version, language, time zone, device identifiers |
| Usage data | Screens viewed, features used, check-ins completed and missed, session timing, streaks, interactions with the feed |
| Log and diagnostic data | IP address, crash reports, error logs, performance data |
| Push tokens | Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) tokens used to deliver alarms and reminders |
Device permissions we request
- Camera — to record your promise video and to scan gym equipment at check-in.
- Microphone — to capture audio as part of your promise video.
- Notifications — to deliver alarms, reminders, and alerts about your schedule.
You can refuse or revoke any permission in your device settings, but the App will not function without camera access, since both the promise video and check-in depend on it.
What we do not collect
To be explicit:
- We do not collect your location. Check-in is verified by item scanning, not GPS.
- We do not read Apple Health, HealthKit, or Google Fit data.
- We do not access your contacts, photo library (beyond what you explicitly select), calendar, or microphone outside of video recording.
- We do not perform facial recognition and do not create biometric identifiers, faceprints, or voiceprints from your video. Your video is stored and displayed as media, not analyzed to identify you.
- We do not collect or store your payment card details. Subscriptions are processed by Apple or Google, who handle billing under their own privacy policies.
- We do not track you across other companies’ apps or websites, and we do not use advertising or attribution SDKs.
Your Promise Video
Your promise video is the most sensitive information the App handles, so we describe it separately.
How it is stored. The video is uploaded to our cloud storage on Amazon Web Services and stored in encrypted form. Access by our personnel is limited to what is necessary for operating the service, investigating abuse, responding to reports, and complying with law.
When it becomes visible to others. Your video is private until you miss a workout session you scheduled. If you do not complete check-in within the applicable window, the App publishes the video to the public in-app feed, where other Caught users can view it, react to it, and comment on it. Your username and profile photo are displayed alongside it.
You control what is in it. You choose what to record. You can delete or replace your promise video at any time before it is published.
What we cannot undo. Once a video is visible to other users, other people may screen-record, screenshot, download, or re-post it outside the App. We cannot detect, prevent, recall, or delete those copies. Deleting your video, your post, or your entire account removes it from our systems but has no effect on copies that already exist elsewhere. Please treat any upload as potentially permanent and public.
Deletion. You can delete a published post from the feed at any time from within the App. Deleting removes it from public view immediately and from our active systems shortly afterward, subject to the retention periods below.
AI Processing of Check-In Scans
When you scan a gym item to check in, the App sends the captured image to OpenAI’s API to determine whether the image shows the expected object. This is an automated check only — it answers “is this a dumbbell?” and nothing more.
- The image is sent for that single determination and is not used by us to build a profile of you.
- We do not send your promise video, your name, your email, or your account identifiers to OpenAI as part of this request.
- As of the effective date of this Policy, OpenAI states that data submitted through its API is not used to train its models, and is retained only for a limited period for abuse monitoring. OpenAI’s handling of that data is governed by its own terms and privacy policy.
- These scans are processed on servers located in the United States.
The check is automated and imperfect. It may produce incorrect results, and an incorrect result can cause a missed check-in. This automated processing does not produce legal effects concerning you, but you may contact us at support@brocoai.com if you believe a check-in was wrongly assessed, and a person will review it.
How We Use Information
We use personal information to:
- Create and maintain your account and authenticate you;
- Operate the core accountability mechanic — storing your promise video, tracking your schedule, verifying check-ins, and publishing your video when a session is missed;
- Send alarms, reminders, and service notifications;
- Display content in the social feed and enable comments and reactions;
- Moderate content, investigate reports, detect abuse, cheating, spoofed check-ins, and fraud, and enforce our Terms of Use;
- Provide customer support and respond to your requests;
- Analyze usage to understand how the App is used and improve features, reliability, and performance;
- Process subscriptions and manage entitlements;
- Comply with legal obligations and establish, exercise, or defend legal claims.
Legal bases (for users in the EEA and UK)
| Purpose | Legal basis |
|---|---|
| Providing the App and its core features | Performance of a contract |
| Publishing your promise video | Your explicit consent, given when you upload it and accept the mechanic |
| Security, abuse prevention, moderation | Legitimate interests |
| Analytics and product improvement | Legitimate interests, or consent where required |
| Push notifications | Consent (device-level) |
| Legal compliance | Legal obligation |
Where we rely on consent, you may withdraw it at any time by deleting your promise video or your account. Withdrawal does not affect processing carried out before withdrawal.
How We Share Information
We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
We disclose information in these circumstances:
With other users
When your promise video is published, it is visible to other Caught users along with your username and profile photo. Comments you post are visible to other users. Anything you make visible in the App may be seen, copied, and shared by the people who see it.
With service providers
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Cloud hosting, database, video storage and delivery, scheduling infrastructure | United States / Canada |
| OpenAI | Automated object recognition for check-in scans | United States |
| Amplitude | Product analytics — usage events, device identifiers, and engagement metrics | United States |
| Apple / Google | App distribution, push notification delivery, subscription billing | United States and global |
These providers are permitted to process information only for the purposes we specify and are bound by contractual confidentiality and security obligations.
For legal and safety reasons
We may disclose information where we believe in good faith it is necessary to comply with law, a court order, or a lawful request from a government or law enforcement authority; to enforce our Terms of Use; to investigate suspected illegal activity or content; or to protect the rights, safety, or property of any person.
In a business transaction
If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction. We will notify you of any change in control of your personal information.
International Transfers
We are based in Canada, and our service providers are primarily in the United States. Your information will be transferred to, stored in, and processed in countries other than your own, which may have different data protection laws than your jurisdiction. Information stored in a foreign jurisdiction may be accessible to the courts, law enforcement, and national security authorities of that jurisdiction.
Where required, we rely on appropriate safeguards for these transfers, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum.
Retention
| Data | Retention |
|---|---|
| Account information | For as long as your account is active |
| Promise video (unpublished) | Until you delete or replace it, or delete your account |
| Published posts | Until you delete the post or your account |
| Comments and reactions | Until deleted, or account deletion |
| Check-in scan images | Retained only as long as needed to complete verification, then deleted |
| Analytics and usage data | Retained in aggregated or pseudonymized form for up to 24 months |
| Logs and diagnostics | Up to 12 months |
| Records needed for legal, tax, or dispute purposes | As long as required by applicable law |
After account deletion, we remove or irreversibly anonymize your personal information within 30 days, except where we must retain it for legal compliance, to resolve disputes, or to enforce our agreements. Encrypted backups may persist for a short additional period before being overwritten on their normal cycle.
Security
We use technical and organizational measures appropriate to the sensitivity of the information, including encryption in transit (TLS) and at rest, access controls and least-privilege permissions for personnel, authentication safeguards, and monitoring for unauthorized access.
No system is perfectly secure. We cannot guarantee absolute security, and you share content through the App at your own risk. If we become aware of a breach of security safeguards that creates a real risk of significant harm, we will notify affected users and the relevant regulators as required by law.
Your Rights and Choices
In the App
- Delete your promise video at any time before publication.
- Delete a published post at any time.
- Delete your account from within the App. This is available in-app and does not require contacting support.
- Manage notifications and camera access in your device settings.
Your legal rights
Depending on where you live, you may have the right to:
- Access the personal information we hold about you;
- Correct inaccurate or incomplete information;
- Delete your personal information;
- Port your information to another service in a machine-readable format;
- Object to or restrict certain processing;
- Withdraw consent where processing is based on consent;
- Not be discriminated against for exercising your privacy rights;
- Lodge a complaint with a supervisory authority.
To exercise any of these rights, email support@brocoai.com. We will verify your identity and respond within 30 days, or within the period required by applicable law. There is no charge unless a request is manifestly unfounded or excessive.
Canada. You may complain to the Office of the Privacy Commissioner of Canada (priv.gc.ca) if you are unsatisfied with our response.
EEA / UK. You may complain to your local data protection authority, or to the UK Information Commissioner’s Office (ico.org.uk).
California. You have rights under the CCPA/CPRA, including to know, delete, correct, and opt out of sale or sharing. We do not sell or share personal information as those terms are defined, and we do not process personal information for cross-context behavioural advertising. We do not use or disclose sensitive personal information for purposes beyond those permitted without a right to limit.
Cookies and Similar Technologies
The App does not use cookies. It uses device identifiers and local storage for authentication, session management, and analytics, as described above.
Our website may use essential and analytics cookies. Where required, we request consent before setting non-essential cookies.
Third-Party Links and Services
The App may link to third-party websites or services that we do not control. This Policy does not apply to them. Review their privacy policies before providing information.
Changes to This Policy
We may update this Policy from time to time. If we make material changes — particularly to how promise videos are published or shared — we will notify you in the App or by email before the change takes effect, and where required, obtain your consent. The “Last Updated” date above reflects the most recent revision.
Contact
Broco AI Inc.
Email: support@brocoai.com
For privacy requests, please use the subject line “Privacy Request” and tell us which right you are exercising.