Draft pending legal review. It accurately describes what data the game processes today, but the controller's details and a professional review are still needed before the public launch.
Privacy policy
1. Who is the controller
The data controller is [name or company name], with tax ID [tax ID] and address at [address]. You can write to us at [contact email] about anything related to your data.
2. What data we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email address and password (encrypted) | Creating your account, logging in and confirming your email | Performance of the contract (the game's terms) |
| Neuron name, colors, vocation and your progress (level, faculties, ranks, synapses, Batches, Epoch Points, badges, votes) | Making the game work and saving your game | Performance of the contract |
| Games, purges, contributions to the Core and invitations | Validating games on the server (preventing cheating) and calculating the brain's collective state | Performance of the contract and legitimate interest (fair play) |
| One “heartbeat” per minute while you play online (session start and end time) | Measuring sessions and retention in aggregate to improve the game. No third-party trackers or advertising | Legitimate interest |
| Blocks and reports you make or receive | Moderation and community safety | Legitimate interest and enforcement of the terms |
| IP address and technical browser data | Processed by our providers to serve the website, protect sign-up against bots and maintain security | Legitimate interest (security) |
Your neuron name, points and badges can be seen inside the game (leaderboards, Hall of Fame, Weights Dome). Your email is never shown.
3. Storage in your browser
We don't use third-party advertising or analytics cookies. The game stores in your browser's local storage your session (so it doesn't ask for your password every time), your offline-mode game and some preferences (sound, graphics quality, notices already seen). They are necessary for the game to work or chosen by you, so we don't ask for separate consent. You can delete them from your browser.
4. Who we share data with
Only with the providers we need to deliver the service, who act as data processors:
- Supabase (database, accounts and real time).
- Vercel (website hosting).
- Cloudflare (Turnstile anti-bot verification, if enabled).
Some may process data outside the European Economic Area with the safeguards provided for in the GDPR (standard contractual clauses or the EU-US Data Privacy Framework). [Confirm the region of the Supabase production project]. We don't sell your data or use it for advertising.
5. How long we keep it
For as long as you have your account. If you ask us to delete it, we will delete or anonymize your data within 30 days at most, except for data we are legally required to keep. Session heartbeats are kept for a maximum of 24 months.
6. Minimum age
You must be 16 or older to create an account. If we find an account belonging to someone younger, we will close it.
7. Your rights
You can request access, rectification, erasure, objection, restriction and portability of your data by writing to [contact email]. If you believe we haven't handled your request properly, you can file a complaint with the Spanish Data Protection Agency (aepd.es).
8. Rewards program
If a rewards program linked to a wallet opens in the future, it will have its own terms and its own privacy information, and only those who voluntarily activate it will take part.
9. Changes
If we change this policy significantly, we will let you know inside the game.