Who is responsible for your data
Neuro Gardens (“we”, “us”) is the controller of personal data processed through the Neuro Gardens app on iOS, Android and the web, and through this website. You can reach us about anything in this policy at support@neurogardens.com.
What we process, why, and for how long
We process personal data only where the law gives us a basis to. For each purpose:
| Purpose | Data | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Showing you this website and keeping it secure | IP address, browser and device type, pages requested | Legitimate interests (Art. 6(1)(f)): running a secure, working site | Not stored by us. Our host, Cloudflare, keeps short-lived request logs for security. |
| Understanding how the website is used (Google Analytics), when analytics cookies are on (in the EU, EEA, UK and Switzerland, only if you accept them) | Pages viewed, clicks on buttons and links, approximate location (country/city), device and browser type, a random visitor ID stored in a cookie | Your consent (Art. 6(1)(a)) | Cookies expire after up to 2 years; Google keeps the reports for up to 14 months |
| Telling you when the app launches (email list) | Email address, which form you used, sign-up time | Your consent (Art. 6(1)(a)) | Until you unsubscribe or withdraw consent |
| Stopping spam sign-ups | IP address of the sign-up request | Legitimate interests (Art. 6(1)(f)): protecting the list from abuse | Erased automatically after 5 minutes |
| Answering support requests | Name, email address, your message and anything you include | Legitimate interests (Art. 6(1)(f)), or performing our contract with you (Art. 6(1)(b)) | Up to 24 months after the conversation ends |
| Streaming music in the app | IP address and the files requested | Performing our contract with you (Art. 6(1)(b)) | Not stored by us beyond Cloudflare’s short-lived request logs |
| Suggesting a sound in the Sound Guide, answering repeat questions, and improving the guide (including training our own models) | The text you type and the guide's replies, not linked to your name, account, device or IP address | Your consent (Art. 6(1)(a)), and your explicit consent (Art. 9(2)(a)) for any health details you choose to share, given in the app before your first message | Up to 3 years |
| Unlocking purchases and Neuro Gardens Plus | Confirmation from Apple or Google of what you bought and when it expires | Performing our contract with you (Art. 6(1)(b)) | Kept on your device while your purchase is active |
Information that stays on your device
Your audio settings, chosen outcomes, mixes, volume levels, liked songs and playback history are stored locally on your device, and songs you download for offline listening are saved to the app’s storage. We never receive this information.
Cookies, analytics and local storage
Analytics cookies. How we ask depends on where you are, which we work out from your connection’s country (we do not store it):
- In the EU, EEA, UK or Switzerland (or if we can’t tell where you are), we ask first. Until you click Accept, Google Analytics is not loaded and nothing is sent to Google.
- Everywhere else, Google Analytics is on by default and you can turn it off at any time.
When Google Analytics is on, it sets these cookies:
| Cookie | Purpose | Expires |
|---|---|---|
_ga | Distinguishes visitors with a random ID | 2 years |
_ga_20KESCW7G3 | Keeps track of your visit (session) | 2 years |
We use Google Analytics only to measure how the site is used. Advertising features, Google signals and ad personalization are not enabled. You can change your mind at any time with the Cookie settings link at the bottom of every page; choosing Reject or Turn off analytics removes these cookies.
Local storage (no consent needed). The site saves a few small values in your browser: your cookie choice, whether you closed the email sign-up box, and whether you already signed up. They contain no personal data, are never sent to us, and only exist to remember choices you made. Clear your browser’s site data to remove them.
Fonts and all other files are served from our own domain. Links to outside sites, such as PubMed studies, only contact those sites if you click them.
Sound Guide
The app's optional Sound Guide suggests an outcome based on what you type. When you use it, new messages are sent to Anthropic, PBC, which runs the AI model that writes the reply, as our processor. We save the text of each Sound Guide conversation and the reply so the same question can be answered again without calling the AI, and so we can improve the guide, including by training our own models. We don't save your name, account, device or IP address with the conversation, so we can't link it to you. To prevent abuse we keep a one-way hash of your IP address, separately, for up to 24 hours. Please don't enter health details you'd rather not share; the guide offers general wellness suggestions, not medical advice.
Purchases
Purchases are made through Apple (App Store) or Google (Google Play), which act as independent controllers under their own privacy policies. We never see your payment card details.
Who receives your data
We do not sell, rent or trade your personal information. We share it only with:
- Cloudflare, Inc., which hosts this website, our music library and our databases as our processor under a data processing agreement
- Google (Google Ireland Limited and Google LLC), which provides Google Analytics as our processor, when analytics cookies are on (in the EU, EEA, UK and Switzerland, only if you accept them)
- Anthropic, PBC, which runs the AI model behind the in-app Sound Guide, as our processor, only for messages you send to the guide
- Apple and Google, for purchases you make through their stores
- Authorities, where we are legally required to
International transfers
Cloudflare, Apple and Google are based in the United States, so your data may be processed outside the EU and UK. These companies participate in the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), and transfers are also covered by the European Commission’s Standard Contractual Clauses.
Your rights
If you are in the EU, EEA or UK (and, as a matter of policy, wherever you are), you have the right to:
- Access the personal data we hold about you and get a copy of it
- Correct data that is inaccurate
- Erase your data
- Restrict how we use it
- Port it: receive it in a machine-readable format
- Object at any time to processing based on our legitimate interests
- Withdraw consent at any time, for example by unsubscribing from the email list. This does not affect processing that happened before you withdrew.
- Complain to your local data protection authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU, see the list at edpb.europa.eu.
To use any of these rights, email support@neurogardens.com. We respond within one month and may ask you to confirm you own the email address in question.
Do you have to give us your data?
No. Signing up for emails and contacting support are optional, and you can use the website without giving us any personal data. We do not make decisions about you by automated means or profile you.
Security
All data is sent over HTTPS and stored with encryption at rest. Access is limited to the people who need it to run Neuro Gardens.
Children
Neuro Gardens is not directed to children under 16, and our email list is only for people 16 or older. If you believe a child has given us personal data, contact support@neurogardens.com and we will delete it.
Changes to this policy
If we make significant changes we will update this page and the date below, and tell you in the app or by email where appropriate.
Last updated: October 3, 2026