Privacy policy

Server logs

Like almost every web server, ours writes a short technical record of each request: the time, the requested address (for example /en/privacy/), the result code, how long the answer took, and your IP address. These records help us keep the site running and find faults and abuse. The legal basis is our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

The records stay in the log store of the server that hosts this website. How long they are kept there is set by that hosting setup. We do not analyse them, combine them with other data or use them to build profiles; we look at them only to fix problems.

Downloading the APK file is an ordinary request and is logged in the same way. Beyond that, we do not record who downloaded the app.

To stop abuse of the sign-up form, the server counts requests to it per IP address for one minute. This count is kept in memory only and is never written to disk.

When someone signs up for the e-mail list, the log notes only that a sign-up happened, with the address masked (for example a***@example.com), never the full address. A sign-up that our spam trap catches is logged as dropped, and a failed notification e-mail is logged with the masked address.

Playing without an account

You can play as a guest. Your progress, statistics and settings are then stored only on your phone. If you create an account later, they are moved into it.

Usage statistics and crash reports (see below) are also sent when you play as a guest, but without an account ID.

Your account

To create an account, you sign in with an e-mail address and a password, or with your Google account. Google Firebase Authentication stores your e-mail address, the name you enter (with Google sign-in: the name and profile picture link that Google provides) and the sign-in method. Passwords are handled by Firebase; we never see them.

In Cloud Firestore, also part of Google Firebase, we keep an account record with your e-mail address, name, sign-in method, app language, the date the account was created, and your overall statistics.

Legal basis: the account is part of the service you asked for (Art. 6(1)(b) GDPR).

Progress and game history

With an account, the app saves your progress so that it is not lost and is the same on every device: the levels you have reached, stars, scores, weekly points, and a record of each game played (game, level, score, accuracy, number of correct answers, duration, date, app version, platform and language). A copy is also kept on your phone.

Legal basis: saving your progress is part of the service you asked for (Art. 6(1)(b) GDPR).

Leaderboards and friends (optional)

Joining the leaderboards is your choice. If you join, you pick a nickname and an animal avatar. They are shown with your scores (daily challenge result, weekly points, total stars) to other signed-in BrainPlay players. Your e-mail address and real name are never shown.

Nicknames pass through a filter, and players can report an entry. A report stores who reported whom, on which board and for what reason, so that we can review it.

If you open Friends, the app creates a friend code for you. Friends who add you with this code see only what you already show on the leaderboards. The list of players you follow is stored with your account.

You can leave the leaderboards at any time: Profile → Leaderboards → Leaderboard profile → Leave leaderboards. This deletes your public profile and your entries on the all-time board and on the current and previous daily and weekly boards. Older daily and weekly entries are marked for automatic deletion about two weeks after their period ends.

Legal basis: your choice to take part (Art. 6(1)(b) GDPR); for the filter and reports, our legitimate interest in fair leaderboards without abuse (Art. 6(1)(f) GDPR).

Usage statistics

The app uses Google Analytics for Firebase to see which games and levels are played, so that we can adjust levels that are too hard or too easy. The app reports events such as a completed level (game, level, stars), the end of the introduction tour, starting as a guest, opening the Premium screen and joining the leaderboards. Firebase adds technical data of its own, such as an app-instance ID, the device model, the Android and app version, and an approximate location (country or region) derived from the IP address.

These statistics contain neither your name nor your e-mail address. The app-instance ID is a pseudonymous identifier, however, so we regard the statistics as personal data.

The statistics are switched on when you install the app. You can switch them off at any time: Profile → Settings → Share anonymous usage data. Legal basis: our legitimate interest in knowing how the games are used (Art. 6(1)(f) GDPR); this switch is your way to object.

Crash reports

When the app crashes or runs into an error, Firebase Crashlytics sends a report: the technical error details, the device model, the Android and app version and, if you are signed in, the random user ID of your account (not your e-mail address or name). We use these reports only to find and fix errors. Legal basis: our legitimate interest in a working, secure app (Art. 6(1)(f) GDPR).

Protection against abuse and remote settings

The app uses Firebase App Check with Google Play Integrity: Google confirms that requests come from the genuine BrainPlay app on a genuine device. This protects the leaderboards against cheating.

The app also loads a few settings from Firebase Remote Config, for example how many levels are free and how often ads may appear. This request includes the app-instance ID.

Legal basis: our legitimate interest in security and in running the service (Art. 6(1)(f) GDPR).

Ads in the free version

The free version of the app can show ads from Google AdMob: a banner on some screens, from time to time a full-screen ad between levels, and an optional ad that you can choose to watch for a reward. For this, Google processes your device’s advertising ID, your IP address and approximate location, information about the device, and how you interact with the ads.

Where the law requires it (for example in the EU, the EEA and the United Kingdom), the app first asks for your consent with Google’s consent form, and ads are personalised only if you agree. Legal basis: your consent (Art. 6(1)(a) GDPR); where no consent is required, our legitimate interest in financing the free version (Art. 6(1)(f) GDPR). For ads, Google also uses data under its own privacy policy.

The app has no button yet to reopen the consent form. To change your choice, clear the app’s storage in the Android settings; the app then asks again. This also removes progress that is not saved in an account. You can reset or delete your advertising ID in the Android settings at any time. Premium removes all ads.

Premium subscription

Premium is bought through Google Play. Google handles the payment; we never receive your card details. RevenueCat, our subscription service, receives the purchase status and the user ID of your account, so that the app knows whether Premium is active. Legal basis: the contract with you (Art. 6(1)(b) GDPR).

Daily reminder

If you switch on the daily reminder, it is scheduled on your phone itself. The reminder time stays on the device; no server is involved. Android first asks whether the app may show notifications.