Cookie Policy
Last Updated: October 2026 Version: 1.7
This Cookie Policy explains how Brainstretch uses cookies and browser storage.
What Are Cookies
Cookies are small files stored by your browser. Browser storage, such as localStorage, can also store preferences on your device.
Essential cookies
Brainstretch uses essential first-party cookies to keep the service secure and functional.
| Cookie or storage | Purpose | Duration | Notes |
|---|---|---|---|
| Session cookie | Keeps your browser session secure and supports sign-in; also holds the guest token for a guest’s visit described under Guest Demos | Session or limited duration | Required for account-backed play and for holding a guest’s visit |
| Remember-me cookie | Keeps you signed in between visits when selected | Limited duration | Optional account convenience |
| CSRF/session protection | Protects forms and LiveView sessions | Session or limited duration | Required for security |
Cookie names may vary by environment or deployment.
Returning-player cookie
This is an essential first-party cookie that supports sign-in. It is not used for analytics or advertising.
| Cookie or storage | Content and purpose | Duration |
|---|---|---|
_brainstretch_returning |
Your profile’s display name, or empty if your profile has no name; no email, account ID or sign-in token. Lets this browser greet you with “Welcome back” and offer sign-in after your sign-in expires. | Up to 400 days; kept when you sign out |
To remove it, choose Remove [your name] from this device (or Forget this device) on the Welcome back page, delete your account while signed in on this browser, or clear this browser’s cookies.
Guest Demos
Guest play is not stored as durable account progress. While you play as a guest, the board is held in server memory for at most a few hours and identified by a random token in the page address, not by your browser session — keep that address to return to the board, even after closing your browser; without it, the board cannot be recovered.
When you open a game’s play or quest page without signing in, Brainstretch also puts a separate random guest token in the essential session cookie. The token holds no name, email address, or account ID. Brainstretch uses it only to hold your current visit, the games you finish and the first-chapter quest stars you win, in server memory under a hash of the token, never in its database, as described in the Privacy Policy. A visit is dropped 30 minutes after your last play, and never kept more than 4 hours after it began.
The token stays in the session cookie until that cookie expires, up to 180 days after it was last updated, until you sign out, or until you clear this browser’s cookies. If you sign up or sign in on this browser during a visit, the token stays in the session, so the visit’s games and quest stars can be added to your profile. If you sign in through an emailed sign-in link that carries your visit, the session cookie of the browser you open it in holds the visit’s key (a hash of the guest token, not the token itself) until you sign out, so the visit can be added to the profile you play as.
Preferences and localStorage
Brainstretch may use localStorage to remember display preferences such as theme on the same device.
Visitor Analytics
Brainstretch may use first-party, privacy-friendly visitor analytics, such as self-hosted Umami, to understand how public pages, guest demos, and signed-in play are used. On pages you use while signed in, they also receive gameplay and progress event counts (such as game starts and finishes and changes to a streak, XP, daily tasks, or awards) that carry no account or profile identifier; the Privacy Policy describes them. These analytics are intended to be cookieless and not used for cross-site tracking, third-party advertising, or selling personal information.
Visitor analytics may process page URLs, referrers, approximate region or country derived from request data, browser, operating system, device type, visit timestamps, and basic event counts. Analytics data may be retained for up to 24 months.
If Brainstretch enables visitor analytics, we will honor browser Global Privacy Control where supported and may store an analytics opt-out flag in localStorage so this browser remains opted out.
See the Sub-processors page for analytics infrastructure details.
Optional campaign measurement
Brainstretch offers optional Google Ads campaign conversion measurement on the website only. Brainstretch does not load the Google tag, contact Google, or allow Google measurement storage until you affirmatively choose Allow campaign measurement. This choice is not shown and Google measurement is not used in the Capacitor native app.
The following cookies or browser storage may be used for this feature:
| Cookie or storage | Content and purpose | Duration |
|---|---|---|
brainstretch_campaign_measurement |
Exactly v1:granted or v1:denied, with no identifier; remembers your website choice |
180 days |
_gcl_au |
A pseudonymous Google Ads measurement identifier, where created | Up to 90 days |
_gcl_aw and other applicable _gcl_* variants |
Google ad-click information or identifiers used to attribute a later conversion, where created | Up to 90 days |
_gcl_ls localStorage |
Conversion-linking or ad-click state used to preserve attribution in the browser, where created | Observed expiry fields up to 90 days; the production tag must be verified before enablement |
With permission, Brainstretch measures only Confirmed registration and the account’s First engaged game completion. The Google tag can also disclose IP and network data, date and time, the full page URL and referrer (including ad-click parameters where present), browser, device, operating-system and screen information, consent and tag configuration, and Google, ad-click, or cookie identifiers. This information is not described as anonymous.
You can withdraw permission in Privacy settings. Withdrawal stops future Brainstretch-initiated Google tag loads and conversion events, clears readable first-party _gcl_* cookies and _gcl_ls, and reloads the page. It cannot retract requests already sent, guarantee deletion from Google’s systems, or clear storage that the browser does not make available to Brainstretch. You can also clear browser data and use Google’s privacy controls.
This rollout does not use enhanced conversions, customer-data uploads, remarketing audiences, ad personalization, Google Analytics, a Google Tag Manager container, or native-app tracking.
Managing Cookies
You can delete or block cookies in your browser settings. Blocking essential cookies may prevent sign-in, saved play, and security features from working. Unlike the other essential cookies, blocking the returning-player cookie does not prevent signing in; this browser simply stops being greeted by name after a sign-in expires. Blocking optional campaign measurement does not prevent you from using Brainstretch.
Changes
We may update this policy as Brainstretch evolves. Changes will be posted on this page.
Contact
Cookie questions can be sent to privacy@brainstretch.ing.