Privacy

Draft: describes exactly what the site does today. Fill in the highlighted details and have it checked before launch.

1. Controller

First name Last name, address, email (see Imprint). Privacy questions: hello@braintoggle.app.

2. Hosting and server logs

The site runs on host, country. To deliver a page, the server technically processes your IP address (Art. 6(1)(f) GDPR). We don't store IP addresses in our database. Host's server logs: retention.

3. Visitor statistics without cookies

We count page views on our own server, without cookies and without third parties. For this we combine your IP address, browser identifier and a key that changes every day into an anonymous value that can no longer be linked to you after one day. We only store: page, where the visit came from (e.g. TikTok or the referring website), language, device type (phone/computer) and time. Purpose: knowing which riddles and platforms work (Art. 6(1)(f) GDPR). Deleted after 14 months.

4. Cookies

• bt_lang: the language you picked, 1 year.
• bt_vid: only set once you vote on a riddle. A random id so your answer counts once and you see it again next time, 1 year.
• better-auth.*: your login, only if you log in, until you log out or 7 days.
• bt_consent: your cookie settings, 1 year.

These cookies are needed for the features you use (§ 25 (2) no. 2 TDDDG). For anything else we ask you first (cookie settings).

5. Votes

Your answer to a riddle (option, right/wrong, hint used) is stored with the bt_vid id and, if you are logged in, with your account. Others only see totals (Art. 6(1)(b) GDPR).

6. Account (optional)

Username, email, password (only hashed), birth date, optional first and last name, your visibility, your invite code, who you follow, your XP and level (calculated from your answers) and your profile picture: a randomly generated brain or a photo you upload. Photos are converted on our server into a small picture without metadata (such as location); only people who may see your profile can see it. When you remove it or delete your account, the file is deleted right away. Answers you gave in this browser before logging in are linked to your account so they count for your level. Every change to your account (logins with browser type, changed details, email changes, admin actions) is listed in the account history you see in your account; no IP addresses, deleted with the account. Purpose: security and traceability (Art. 6(1)(b) and (f) GDPR). While you're logged in, we keep the session's IP address and browser for security. Purpose: providing your account (Art. 6(1)(b) GDPR). We need the birth date because profiles under 16 are always private and show no real name. In your account you can download all your data and delete your account at any time.

7. Newsletter (optional)

With your consent (Art. 6(1)(a) GDPR) we send you new riddles and news about the app launch. Double opt-in: you're only subscribed after clicking the link in the confirmation mail; unconfirmed signups are deleted after 30 days. By pressing Subscribe you confirm you are 16 or older or have a parent's permission. Sent via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) under a data processing agreement. Unsubscribe anytime with the link in every email; we then delete your address from our database and from Brevo.

8. Emails

Login links and confirmations are sent via Brevo (see 7). We keep a copy for 30 days to sort out delivery problems.

9. YouTube videos

Videos only load when you tap play or allow it in the cookie settings (Art. 6(1)(a) GDPR, § 25 (1) TDDDG). Then data (including your IP address) is sent to Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland, and YouTube may set cookies. Google may transfer data to the USA; Google is certified under the EU-US Data Privacy Framework. We use the privacy-enhanced mode (youtube-nocookie.com).

10. Instagram direct messages

When you comment a keyword (e.g. "answer") on one of our Instagram posts, our account sends you one direct message with the link to that post's riddle. For this, Meta Platforms Ireland Ltd. (Merrion Road, Dublin 4, Ireland) passes us the comment id, its text and your Instagram id. We only store the comment id, the post and whether the message was sent, so nobody gets the same message twice; no name and no comment text. Deleted after 90 days. Until you get the link with the button, we keep your Instagram id for at most 7 days (deleted as soon as the link is sent). If we ask you to follow us, we ask Instagram whether you follow us. Legal basis: Art. 6(1)(b) GDPR (you asked for the link). Instagram itself is covered by Meta's privacy policy.

11. Ads

There are no ads right now. Before we show ads, we will ask you in the cookie settings and update this policy.

12. Your rights

You have the right to access (Art. 15), correction (Art. 16), deletion (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR). You can withdraw consent at any time for the future. Write to hello@braintoggle.app. You can also complain to a data protection authority, e.g. the authority of your federal state.

Last updated: date