1. Controller

Brainys, Republic of Lithuania is the controller of the personal data described here. This policy applies to the Brainys website, web app and mobile apps.

2. What we collect

• Account data: email address, display name, password (stored only as a salted hash), avatar, date of birth (asked before your first prize redemption or at sign-up), the time you accepted our Terms, and — if you enable it — two-factor authentication secrets and recovery codes (hashed).
• Sign-in with Google: your Google account email, name and profile picture, as provided by Google.
• Gameplay data: games and rooms you play or host, questions shown, answers and answer times, scores, IQ and CELL movements, achievements, streaks, tournament participation, daily-challenge entries, friends and friend requests, and questions or media you create.
• Purchase data: when you buy CELL, our payment partners send us the product bought, the amount, the transaction identifier and its status. We never receive or store your card or bank details.
• Prize data: the delivery address you enter at redemption or save in your Account settings (full name, street, city, postal code, country, optional phone) for physical items, the CELL coupon codes issued to you and their use, and, for higher-value prizes, proof of age or identity you choose to send.
• Device and technical data: IP address and browser/app information in server logs, a sign-in log (time, method, IP address and browser of successful and failed sign-ins), push-notification tokens if you enable notifications, and the identifiers needed to keep you signed in.
• Consent records: when you accepted the Terms and this policy, and which version.
• Guests: if you join a room without an account we store the nickname you enter, your answers and a random participant identifier kept in your browser.
• Support: anything you send us when you contact us.

3. Why we use it and on what legal basis

• To provide the Service — run games, keep score, credit CELL and IQ, deliver prizes, show leaderboards and friends (performance of our contract with you, GDPR Art. 6(1)(b)).
• To verify age (13+ to play, 18+ to buy CELL, 18+ for prizes) and to honour purchase limits and the deletion cooling-off (legal obligation and legitimate interest in operating a compliant skill-gaming service, Art. 6(1)(c) and (f)).
• To keep the game fair and secure — detect cheating, multiple accounts, abuse and fraud, and protect the CELL/IQ economy (legitimate interest, Art. 6(1)(f)).
• To send transactional emails and in-app notices — email verification, password reset, friend requests, tournament reminders, prize status (contract and legitimate interest). You control optional notifications in Profile → Notifications.
• To send push notifications — only if you turn them on in your device or browser (consent, which you can withdraw at any time in your device settings or the app).
• To keep accounting and transaction records (legal obligation, Art. 6(1)(c)).
• To improve the Service using aggregated, non-identifying statistics (legitimate interest).

We do not sell personal data, we do not show advertising and we do not profile you for marketing.

4. Who we share it with

We use service providers who process data on our behalf under data-processing agreements:

• Hosting and database: servers located in the European Union.
• Real-time gameplay: Pusher (room and notification events; data is limited to what the game needs, such as room codes, nicknames, scores and answer states).
• Sign-in: Google (when you choose "Continue with Google").
• Push notifications: Google Firebase Cloud Messaging (notification tokens and message content).
• Payments: RevenueCat (purchase records and entitlements) together with Apple App Store, Google Play or our web checkout provider, each acting under its own privacy terms for the payment itself.
• Transactional email: our email delivery provider (your address and the email content).
• Prize fulfilment: postal carriers or gift-card issuers receive only what is needed to deliver your prize.

Other players see your display name, avatar, tier, scores and placements in rooms, tournaments, leaderboards and friend lists. We may disclose data where required by law or to protect Brainys, our players or the public.

5. International transfers

Some providers above (for example Pusher, Google, RevenueCat) may process data outside the European Economic Area. Where they do, transfers rely on an adequacy decision or the European Commission's Standard Contractual Clauses with supplementary measures.

6. How long we keep it

• Account and gameplay data: for as long as your account exists.
• When you request deletion of your account: the account is frozen immediately and erased after a 30-day cooling-off (signing in and choosing "Keep my account" cancels the request). On erasure, personal details (email, name, avatar, date of birth, sign-in methods, push tokens, friends, notifications, saved delivery address, prize delivery details) are deleted or replaced with anonymous values; unused CELL coupons are cancelled. CELL/IQ transaction records and game results are kept in anonymised form because we must be able to account for the economy and prizes (GDPR Art. 17(3)(b)).
• Purchase and prize records: as long as required by accounting and tax law (in general up to 10 years).
• Sign-in log: 90 days, then deleted automatically; on account deletion its personal details (email, IP, browser) are removed immediately. Consent records are kept as long as we may need to prove acceptance.
• Server logs and backups: rolling short-term retention, typically days to a few weeks.
• Guest data: kept with the room and removed when the room is purged under our cleanup schedule.

7. Your rights

• Access and portability: download a copy of your data from Profile → Account → Download my data.
• Rectification: change your name, email, avatar and password in your profile; contact us for anything else.
• Erasure: delete your account from Profile → Account → Delete account (see section 6 for what remains in anonymised form).
• Restriction and objection: you may object to processing based on legitimate interest, or ask us to restrict it, by contacting us.
• Withdraw consent: turn push notifications off at any time.
• Complain: you can lodge a complaint with your local supervisory authority. Our lead authority is the State Data Protection Inspectorate of the Republic of Lithuania (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt).

To exercise any right, contact us. We answer within one month.

8. Cookies and local storage

Brainys uses only strictly necessary storage, so no cookie banner is shown:

• a session cookie that keeps you signed in and a CSRF cookie that protects sign-in forms;
• a flag that tells the site it is running inside the Brainys mobile app;
• browser storage for preferences and in-progress drafts (sound settings, a game you are setting up, a guest's room participant id, your unclaimed guest IQ).

We do not use advertising or cross-site tracking cookies. If we introduce analytics, it will either be cookieless or asked for with a consent prompt, and this policy will be updated first.

9. Children

Brainys is not intended for children under 13. We do not knowingly collect personal data from them; if you believe a child has created an account, contact us and we will delete it. The Prize Shop is restricted to players aged 18 or over.

10. Security

Passwords are hashed, traffic is encrypted in transit, access to production systems is restricted, and two-factor authentication is available for your account. No system is perfectly secure; tell us immediately if you suspect unauthorised access.

11. Changes

We will post any changes here and update the date at the top. For material changes we will also notify you in the app or by email.