About this policy
This is the privacy policy for the HIYB, a behavioural change application operated by Juliette Ryan. This policy explains what data is collected, how it's stored, and what your rights are.
I've written this in plain language because the data you're entrusting to me is personal — habits, compulsions, urges, thoughts, things you've struggled with for years. You deserve to know exactly what happens to it. If anything in this policy is unclear, email me at juliette.hiyb@gmail.com and I'll explain.
Who I am
I'm Juliette Ryan, a neuroscience and behavioural science engineer. I'm the operator and sole administrator of Here is your brain. I publish neuroscience writing at hereisyourbrain.substack.com.
I built this app because I changed my own maladaptive behaviours using the principles it implements, and I wanted others to have access to the same framework. The data you log is what makes the app work for you — and over time, it's what will help me understand what works for others, so the framework can keep improving.
What data I collect
- I collect the data you enter when you sign up and then the data you log in the app (urges, decisions, triggers, thoughts) and the minimum identifying information needed to make the app work (your email for login).
- I'm the only person who can access identifiable data.
- I use de-identified data to improve the app and to write about what the patterns reveal — sometimes as aggregate findings, sometimes as one person's story. If I want to publish anything that could reasonably identify you, I ask you first. I never sell data. I never use it to train AI models.
- AI is used in one visible place — helping write your graduation story — and very little elsewhere. How I use AI sets out exactly where, and why.
- I also record anonymous page views (which page, where you came from, your country, device and browser type) through Vercel, who host the site. That analytics uses no cookies and includes nothing you log in the app. The signup pages (/curious and /phone) and the page shown after payment (/phone/paid) also carry a Substack subscribe box. Substack serves that box and loads its own third-party trackers with it, including Google advertising scripts, and what those collect is covered by Substack's privacy policy.
- You can request deletion of your account at any time.
- The app complies with the Australian Privacy Act 1988 and the Australian Privacy Principles.
Why I collect it
Two reasons.
To make the app work for you. Most of the data is operational — without recording your urges, the app couldn't track your extinction curve, show you progress, or compute the personalised values that drive the experience.
To improve the framework over time. The patterns across many users' data — what makes Rewiring succeed for some people, where most people slip, what triggers are most common — is what teaches me how to keep refining the protocols, the welcome content, the math, and the writing. This is the research use referenced in the application form. It's done only by me, never sold or shared with third parties, never used to train AI models, and only ever uses de-identified data — your name and email removed, and identifying detail in anything you have written changed or left out.
Who can access your data
The data you log is accessible only to me, in my capacity as the operator of Here is your brain. I review applications, approve users, monitor the app's performance, and use anonymised behavioural data for the research purposes described above.
No-one else — no employees, no contractors, no advisors, no investors, no marketing partners — has access to any identifiable data. There is no operating team beyond me.
Research and writing
I write publicly about behaviour change — in research and on Substack — and the work in this app is what I write about.
De-identified data from the app may be used in that writing. That takes two forms. Sometimes it is aggregate: “across the people using this, urges fell by about a third after the transition.” Sometimes it is a single person's story, described because their trajectory shows something worth showing — what changed, when, and what it looked like along the way.
De-identified means your name and email are removed, and identifying detail in anything you have written is changed or left out.
You can also tell me at any time that you would rather not be written about at all, and I will take you out of future use. Email juliette.hiyb@gmail.com. I cannot retract something already published, and I will say so plainly if that is the case.
Your rights
You have several rights regarding your data:
Access. You can request a copy of the data I hold about you. Email juliette.hiyb@gmail.com and I'll send you a structured export within 30 days.
Correction. If any information about you is inaccurate (your name spelled wrong, an event logged incorrectly), you can edit it directly in the app, or email me and I'll fix it.
Deletion. See “If you close your account” below.
These rights apply regardless of your location. If you're an Australian resident, they're additionally protected by the Australian Privacy Act 1988. If you're in the European Union or United Kingdom, GDPR additional rights apply. If you're in California, CCPA additional rights apply.
If you close your account
Closing your account from Settings signs you out and locks it so it cannot be signed into again. Your logged data is kept, not erased — deliberately. It stops a bad day from destroying months of your own history, and it means you can ask to come back.
If you want everything gone permanently, email me at juliette.hiyb@gmail.com and I'll do it by hand and confirm when it's done.
How long I keep your data
While your account is active, your data is retained for as long as you continue to use the app.
If your account becomes inactive (no logins or events for 24 months), I may contact you to ask whether you'd like to keep the account or close it. If you don't respond, the account stays open — I won't close an account on your behalf.
Children's data
The HIYB app is not intended for use by anyone under 18. The intake forms are designed to filter out applications from minors, and I will not knowingly approve an under-18 user. If you become aware that a minor has somehow gained access to the app, please email me and I'll close their account immediately.
Changes to this policy
When I change this policy, I update this page and move the “Last updated” date at the top. I do not send an email about it.
Security
All communication between you and the app is encrypted (HTTPS). The database requires authentication, and I'm the only person with credentials. There are no stored passwords for attackers to steal — the app uses magic-link login, which sends a one-time link to your email instead of relying on a password.
No system is fully impenetrable. If a data breach does occur that affects your information, I'll notify you in accordance with Australia's Notifiable Data Breaches scheme.
How to contact me
For any questions, requests, or concerns about your data or this policy:
- Email: juliette.hiyb@gmail.com
- I aim to respond within 7 days for most queries, and within 30 days for formal requests (access, deletion, etc.)
Complaints
If you're not satisfied with my response to a privacy-related concern, you can lodge a complaint with the Office of the Australian Information Commissioner (OAIC):
- Website: oaic.gov.au
- Phone: 1300 363 992
For users in other jurisdictions: you also have the right to lodge complaints with your local data protection authority.