Privacy Policy | Brainura

This Privacy Policy explains how Brainura ("Brainura", "we", "us", "our") collects, uses, shares, and protects personal information when you use our mobile application and related services (collectively, the "Service"). We designed Brainura with privacy in mind: we collect only what we need to run the product, we never sell your data, and we do not display third-party advertising.

1. Who is responsible for your data

The data controller is Hanna Kravchenko, the developer of Brainura, based in Ukraine. For any privacy-related question or to exercise the rights described in this policy you can reach us at krv4art.dev@gmail.com.

2. Data we collect

2.1 Information you provide

Account information— if you sign in, we store your email address and the display name you choose. Sign-in is optional; the app can be used anonymously.
Onboarding answers— goals, focus areas, age group, and preferences you select during onboarding so we can personalise your training programme.
Support messages— if you write to us, in the app or in the chat on our website, we keep the conversation so we can follow up. Messages reach our support team through Telegram. In the website chat we also keep a random identifier in your browser's local storage (so you can see our replies), your browser type and the page you wrote from. We do not ask for your name or email there.
Arena profile (optional)— if you join the Arena, we store the nickname you choose and an avatar you assemble from preset parts in the app (a set of choices, not a photo; no camera or gallery access is used), and show them to other players on Arena tables, duels and live matches. We also store your Arena results (scores, times, skill levels), recordings of your live runs that later players race against (labelled with your nickname), the friends and opponents you play with, your player code, and the challenges you send, receive or mute. You can hide yourself from Arena tables at any time in Settings; players you have already played a duel or live match with can still see that match.

2.2 Information generated by your use of the Service

Exercise results— scores, accuracy, duration, per-exercise details, streaks and Brain Age estimates.
App interactions— which screens you visit, which features you use, and basic preferences (language, theme).
Device and diagnostic data— device model, OS version, app version, locale, time zone, anonymised crash logs and performance metrics.
Approximate location— derived from your IP address at the country/city level for regional content and analytics. We do not request or use precise GPS data.
Identifiers— an anonymous Supabase user ID, a OneSignal player ID for notifications, and Apple/Google purchase identifiers. None of these can be used to identify you outside of Brainura.
Purchase data— subscription status, transaction receipts and renewal information returned by Apple App Store, Google Play and Adapty.

3. How we use this data

To provide and personalise the training experience.
To track your progress and estimate your Brain Age.
To deliver push notifications you have explicitly opted in to.
To detect, investigate and fix crashes and performance problems.
To process subscriptions and prevent fraudulent purchases.
To respond to support requests.
To comply with applicable law and enforce our terms.

4. Legal basis (EEA/UK users)

We rely on the following legal bases under the GDPR:

Contract performance— running the Service you requested (exercise scoring, subscription management).
Legitimate interest— improving the product, security, anonymised analytics, and fraud prevention.
Consent— push notifications, optional account creation, and any feature requiring an explicit opt-in.
Legal obligation— tax records related to purchases, responding to lawful requests.

5. Sharing with third parties

We share data only with the processors below, each under a written data protection agreement. We do not sell data and we do not share it for third-party advertising.

Apple App Store / Google Play— payment processing for in-app subscriptions.
Adapty— subscription state management across stores.
Supabase— database hosting and authentication.
Firebase(Google LLC) — anonymised crash reporting, performance metrics, remote configuration.
OneSignal— push notification delivery.
Groq— AI translation of support messages (in the app and in the website chat). Your support messages are sent to Groq only when you use that feature.
Telegram— delivery of support messages to our support team and of our replies back to you.

6. Advertising and tracking

Brainura does not display third-party advertisements, does not use the iOS App Tracking Transparency framework, and does not share any data with advertising networks or data brokers. We perform first-party analytics only.

7. Data retention

We keep your data while your account is active and for as long as needed to provide the Service. After deletion, anonymised aggregate statistics may be retained indefinitely for product improvement; they cannot be linked back to you. Crash logs are deleted after 90 days. Purchase records are retained for the period required by tax law (typically up to 7 years).

8. Your rights

Depending on where you live (EEA, UK, California, and several other jurisdictions) you have some or all of the following rights:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion ("right to be forgotten").
Object to or restrict certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent for any processing based on consent.
Lodge a complaint with your local data protection authority. For EU residents you may also contact your national DPA directly.

To exercise any of these rights, email us at krv4art.dev@gmail.com. We respond within 30 days.

9. International transfers

Our processors operate servers in the United States and the European Union. When data is transferred outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.

10. Children

Brainura is rated 4+ on the App Store but is designed for adult users. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA) without verifiable parental consent. If you believe a child has provided us with personal information, contact krv4art.dev@gmail.com and we will delete it.

11. Security

We protect your data with industry-standard measures: encryption in transit (HTTPS/TLS), encryption at rest, principle-of-least-privilege access controls, and routine security reviews. No system is perfectly secure; in the unlikely event of a breach affecting your personal data we will notify you within 72 hours where required by law.

12. Cookies and similar technologies

The Brainura mobile app does not use HTTP cookies. The marketing website at brainura.app uses only the technical cookies set by Vercel for hosting (load balancing, security). We do not use analytics cookies, advertising cookies, or any cross-site tracking on the website.

13. Brainura extension for Chrome

The Brainura extension for Google Chrome (the "Extension") is a separate product with a smaller set of free brain games and optional break reminders. It follows a stricter rule than the app: the Extension collects no data automatically and sells nothing. The only thing it ever sends is a feedback message that you write yourself and send by pressing the send button.

No account, no sign-in, no analytics, no crash reporting, and no advertising identifiers.
Reminder settings (days, hours, times per day, session length), the time of your last session, exercise levels and results, and a few small flags and counters (whether the "pin the icon" tip was shown, how many games you have finished, when to ask you for a rating) are stored only in your browser (chrome.storage and IndexedDB) and are never sent to us or to third parties.
Permissions: alarms — to schedule reminders; notifications — to show them; storage— to keep your settings. The Extension does not read the pages you visit and requests no access to websites.
To display text, the browser may download standard font files from Google Fonts (fonts.gstatic.com). No personal data is sent with these requests beyond what any web browser sends when loading a file.
Removing the Extension from Chrome deletes all of its data.

Feedback you choose to send

After you have played a few games, the Extension may ask whether you enjoy it. If you answer that you do not, or give a low rating, you can write what could be improved. Only when you press the send button, the following is sent to our support inbox (the same channel as the chat on this website and in the app): the text you wrote, the rating you tapped (if any), a random identifier generated in your browser, your interface language and the technical information your browser sends with any request (such as its type and your IP address, which is used only to limit abuse and is not stored by us). We use this only to read your feedback and, if you ask a question, to answer you. Nothing is sent if you do not press the button. To have a message deleted, email the address in section 15.

Pages on this website opened by the Extension

When you install the Extension, Chrome opens a welcome page on this website that shows how to pin the Extension to the toolbar. The page counts visits with aggregate, cookieless web analytics (Vercel Web Analytics): no cookies, no advertising identifiers, and no profile of you is built. The Extension itself sends nothing to it.

When you remove the Extension, Chrome opens a short survey page on this website. The Extension sends nothing to it. If you type an answer and press the send button, the same information as described above (text, random identifier, language, browser type) is sent to our support inbox.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced inside the app and at the top of this page at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the latest revision.

15. Contact

For any privacy question, data request, or complaint, please email krv4art.dev@gmail.com. We aim to reply within one business day.