Privacy Policy

Last Updated: September 2026 Version: 1.4

This Privacy Policy explains how Brainstretch handles personal information when you use the public website, guest demos, and account-backed puzzle play.

Who We Are

Eyal Lapid is the data controller responsible for Brainstretch.

• Operator: Eyal Lapid
• Country: Israel
• Privacy contact: privacy@brainstretch.ing
• Security contact: security@brainstretch.ing

Information We Process

Public visitors and guest demos

When you browse public pages or play a guest demo, Brainstretch processes basic request and security data needed to deliver the service, protect the site, and troubleshoot reliability. This may include IP address, request timestamps, browser and device information, visited pages, referring URLs, and server logs.

Guest play does not create an account and is not saved as durable account progress. While you play as a guest, the board is held only in server memory for at most a few hours, identified by a random token in the page address that is linked to no person and discarded when the board expires. Nothing that identifies a guest or records their play is stored beyond the ordinary request and security data described above. If you sign in from a guest board, that board is saved to your new account; a guest game you already finished is not.

Brainstretch may also use first-party, privacy-friendly visitor analytics for public pages and guest demos, such as self-hosted Umami. Visitor analytics may process page URLs, referrers, approximate region or country derived from request data, browser, operating system, device type, visit timestamps, and basic event counts. We do not use visitor analytics for cross-site tracking, third-party advertising, or selling personal information.

Self-hosted Umami is separate from the optional Google Ads feature described below. It is not Google Analytics.

Account-backed play

If you create an account, Brainstretch may store:

• account identifiers such as your email address;
• profile names and profile preferences;
• saved progress, game history, race or challenge state, scores, and gameplay events;
• display preferences and game settings;
• structured in-product feedback, including the selected reason, an optional comment, and limited technical and game-state details;
• support, privacy, security, or account-related communications;
• security logs needed to protect accounts and the service.

Brainstretch also derives internal product analytics from account and gameplay records, such as active-user counts, signup counts, plays by game or state, per-game completion and win rates, race activity, and entitlement summaries. These analytics are used in aggregate for operations and product quality; they are not used for third-party advertising.

Payments

Brainstretch does not currently sell paid subscriptions, premium packs, or in-app purchases. If paid features launch, we may process billing metadata through a payment provider or app store. We do not plan to store full payment card details ourselves.

How We Use Information

We use information to:

• operate Brainstretch and deliver public pages, guest demos, and account-backed play;
• authenticate accounts and protect sign-in sessions;
• save progress, profiles, preferences, races, history, and game state;
• prevent abuse, cheating, automated misuse, and service disruption;
• debug errors, monitor reliability, and keep the service secure;
• investigate correctness, usability, and reliability reports and improve the service;
• measure public-page and guest-demo usage with privacy-friendly visitor analytics;
• understand internal aggregate product analytics and improve game quality;
• attribute two consented website milestones to Google Ads campaigns and measure campaign performance;
• respond to support, privacy, security, and legal requests.

Legal bases

Where GDPR-style legal bases apply, we process personal information based on:

• Contract: to provide account-backed play, saved progress, profiles, and requested features;
• Legitimate interests: to secure the service, prevent abuse, improve reliability, measure privacy-friendly visitor analytics, and understand internal aggregate product analytics;
• Consent: for optional Google Ads website campaign measurement and where consent is otherwise required for optional features or storage; you may withdraw that consent for future measurement in Privacy settings;
• Legal obligations: to comply with applicable law, enforce rights, and respond to valid legal requests.

Providing account information is optional, but if you do not provide account information we cannot create an account, save durable progress, or provide account-backed features. Guest demo play remains available only where Brainstretch makes a demo available without an account.

Optional Google Ads Campaign Measurement

On the website only, Brainstretch offers optional Google Ads campaign conversion measurement after you affirmatively choose Allow campaign measurement. Brainstretch does not initiate a Google tag, request, storage operation, or conversion event before that choice, after a denial, or in the Capacitor native app.

The two measured milestones are Confirmed registration and the account’s First engaged game completion. Brainstretch explicitly sends a conversion action and an opaque, milestone-specific transaction token. Brainstretch does not send Google your email, name, hashed contact data, account, profile, play, or match IDs, free text, scores, or board state.

The Google tag also makes network requests that can disclose IP address and network data, date and time, full page URL and referrer including ad-click parameters where present, browser, device, operating system and screen information, consent and tag configuration, Google or ad-click identifiers, cookie identifiers, and the conversion milestone. We do not describe this information as anonymous or promise that Google cannot associate it with other information.

Google receives this information to attribute the two consented milestones to Google Ads campaigns and report or optimize campaign performance. For ordinary Google Ads website conversion measurement, Google acts as a recipient and independent controller under its terms. See Google’s explanation of information received from sites and apps and Google’s Privacy Policy.

You can withdraw your choice in Privacy settings. Withdrawal stops future Brainstretch-initiated tag loads and events and clears readable first-party Google measurement storage. It cannot retract requests already sent, guarantee deletion from Google’s systems, or clear storage unavailable to Brainstretch; you can also clear browser data and use Google’s privacy controls.

This rollout does not use Google Analytics or GA4, a Google Tag Manager container, enhanced conversions, customer-data uploads, remarketing audiences, ad personalization, or native tracking.

Information Sharing

We do not sell your personal information.

We may share limited information with service providers that help us operate Brainstretch:

• hosting and infrastructure providers;
• transactional email providers for sign-in and account messages;
• observability, error monitoring, and security tools;
• payment processors or app stores if paid features launch;
• professional advisers or authorities when required by law or necessary to protect rights and safety.

With your website campaign-measurement permission, Google Ads is a recipient and independent controller for the limited website campaign conversion measurement described above. Google is not Brainstretch’s provider for self-hosted visitor analytics.

See the Sub-processors page for current provider details.

Service providers may process information in countries outside your own. We use contractual and technical safeguards appropriate to the provider and processing activity.

International transfers

Brainstretch is operated from Israel and may use infrastructure or service providers in the European Union, United States, Israel, or other locations. When personal information is transferred internationally, we rely on appropriate safeguards such as data processing agreements, standard contractual clauses, provider security commitments, or other lawful transfer mechanisms.

Google Ads information may be processed globally. Depending on the transfer, Google states that it may rely on applicable Data Privacy Framework programs, adequacy decisions, and/or standard contractual clauses. See Google’s Ads international-transfer information.

Retention

We keep information only as long as reasonably necessary:

• account data is retained while your account is active;
• saved progress, preferences, profiles, and game history are deleted or anonymized within 30 days after account deletion is completed, except where retention is needed for security, integrity, dispute resolution, or legal reasons;
• when you delete your account, reporter linkage and optional comment are removed from feedback reports, while structured anonymous feedback categories may remain for aggregate product-quality statistics;
• raw comments and technical or game-state details are removed 90 days after Brainstretch’s review marks the report as linked to an issue or dismissed, while structured classification may remain;
• application and request logs are kept on a 90-day rolling retention period for reliability and troubleshooting;
• security and abuse-prevention logs may be retained for up to 24 months when needed to investigate incidents, protect accounts, prevent cheating, or defend legal rights;
• aggregate or anonymized statistics may be retained because they no longer identify you;
• backup copies may persist for up to 90 days before rotation.

Your Rights

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal information. You may also have the right to withdraw consent where processing is based on consent.

You can delete your account from settings. For other requests, contact privacy@brainstretch.ing. We aim to respond within 30 days.

We may need to verify your identity before fulfilling a rights request.

You may also contact your local data protection authority.

Cookies, Browser Storage, and Visitor Analytics

Brainstretch uses essential first-party cookies for secure sessions, sign-in, and form protection. Brainstretch may use localStorage for display preferences such as theme and for analytics privacy choices, such as disabling visitor analytics in the current browser.

Optional campaign measurement uses the identifier-free brainstretch_campaign_measurement choice cookie. After permission, Google may create _gcl_* measurement cookies and _gcl_ls localStorage where applicable. See the Cookie Policy for names, purposes, durations, and withdrawal steps.

AI

Brainstretch does not currently use AI for game generation, gameplay decisions, generated puzzles, scoring, ranking, personalization, recommendations, opponent behavior, ads, content moderation decisions, user support decisions, or other automated user decisions. See the AI Disclosure for current and future AI transparency.

Security

We use technical and organizational measures intended to protect personal information, including HTTPS, access controls, secure authentication flows, monitoring, and regular updates. No service can guarantee perfect security. If you believe you found a vulnerability, contact security@brainstretch.ing.

If a personal data breach occurs, we will investigate, take appropriate remedial steps, and notify affected users or regulators when legally required.

Children

Brainstretch is for users 18 and older. We do not knowingly collect personal information from anyone under 18.

Changes

We may update this Privacy Policy as Brainstretch evolves. Material changes will be posted on this page and, where appropriate, communicated through the service or by email.

Contact

For privacy questions or rights requests, contact privacy@brainstretch.ing.