Privacy Policy

Below we provide information about the processing of personal data when using the website brainrotkiller-website.vercel.app and the mobile app Brainrot Killer (Android and iOS). Personal data is any data that can be related to a specific natural person, such as a name or IP address.

1. General

1.1 Controller

The controller within the meaning of Art. 4 no. 7 GDPR is:

A data protection officer is not legally required and has not been appointed. For privacy questions, you can reach us at the email address above.

1.2 Scope, purposes and legal bases

We detail the scope, purposes and legal bases of processing below. In principle, the following come into consideration as a legal basis:

• Art. 6 (1) (a) GDPR serves as the legal basis for processing for which we obtain consent.
• Art. 6 (1) (b) GDPR applies where processing is necessary for the performance of a contract, e.g. when you create an account, play puzzles or purchase a premium feature. This also applies to pre-contractual measures.
• Art. 6 (1) (c) GDPR applies where we fulfil a legal obligation, such as under tax law.
• Art. 6 (1) (f) GDPR serves as the legal basis where we can rely on legitimate interests, e.g. for the security and technical operation of the website.

1.3 Data processing outside the EEA

Where we transfer data to providers or third parties outside the European Economic Area (EEA), the security of the data during transfer is ensured by adequacy decisions of the EU Commission, where these exist (Art. 45 (3) GDPR). For transfers to providers in the USA, the legal basis is an adequacy decision if the provider has additionally certified under the EU-US Data Privacy Framework. In other cases, that is, unless we state otherwise, the legal basis is standard contractual clauses adopted by the EU Commission, which ensure the security of the transfer pursuant to Art. 46 (2) (c) GDPR.

1.4 Storage period

Unless expressly stated in this privacy policy, the data stored by us is deleted as soon as it is no longer required for its purpose and no legal retention obligations prevent deletion. If data is not deleted because it is required for other legally permitted purposes, its processing is restricted, i.e. the data is blocked and not processed for other purposes.

1.5 Rights of data subjects

Data subjects have the following rights against us with regard to their personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object to processing based on legitimate interests (Art. 21 GDPR)
• Right to withdraw a given consent with effect for the future (Art. 7 (3) GDPR)

To exercise your rights, an informal message to tetik.labs@gmail.com is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority. A list of the competent supervisory authorities is available at bfdi.bund.de.

1.6 Obligation to provide data

When using the app, you need to provide the personal data that is necessary for the establishment, performance and termination of the usage relationship or that we are legally obliged to collect. Without this data, we will generally have to refuse to provide the corresponding functions. Mandatory data is marked as such.

1.7 No automated decision-making in individual cases

As a matter of principle, we do not use fully automated decision-making within the meaning of Art. 22 GDPR. Should we use such procedures in individual cases, we will inform you separately if this is required by law.

1.8 Making contact

When you contact us, e.g. by email or via the website contact form, the data you provide (e.g. name and email address) is stored to answer your inquiry. The legal basis is our legitimate interest in answering inquiries (Art. 6 (1) (f) GDPR). We delete this data once storage is no longer necessary, or restrict processing where legal retention obligations exist. Note: the website contact form sends no data to our server, it opens a pre-filled email in your own mail program.

2. Data processing on our website

2.1 Cookies and access to devices

This website sets no cookies, uses no analytics or tracking tools and loads no external fonts or trackers. Fonts and all scripts are served locally from the same server. No access to information on your device takes place that is not strictly necessary for technical operation (§ 25 (2) TDDDG). A cookie banner is therefore not required.

2.2 Informational use and server logs

During purely informational use of the website, i.e. when you do not actively transmit information to us, we collect the personal data that your browser transmits to our server in order to ensure stability and security. The legal basis is Art. 6 (1) (f) GDPR. This data is:

• IP address
• Date and time of access
• Requested URL and HTTP status code
• Amount of data transferred
• Website from which the request comes (referrer)
• Browser, operating system and language used (user agent)

This data is stored in server log files. It is deleted as soon as storage is no longer necessary, at the latest according to the host's specifications.

2.3 Web hosting (Vercel)

Our website is hosted by Vercel Inc., 340 Pine Street, Suite 500, San Francisco, CA 94104, USA. The provider processes the technical data transmitted via the website (e.g. IP addresses) in the USA. It is our legitimate interest to provide a secure and available website, so the legal basis is Art. 6 (1) (f) GDPR. The legal basis for the transfer to a country outside the EEA are standard contractual clauses (Art. 46 (2) (c) GDPR). Further information: vercel.com/legal/privacy-policy.

3. Data processing in the mobile app

3.1 Account data (registration and login)

A user account is required to use the app. We process:

• Email address (via Google Sign-In or Sign in with Apple)
• Display name / username (initially imported from the login provider where applicable, then freely changeable; public in the ranking)
• Profile picture and profile-picture URL (if provided by the login provider; public in the ranking)
• Account role (e.g. Free / Premium, where offered)

When you sign in with Google, Google may provide us with the display name stored in your Google Account and the URL of your profile picture in addition to your email address. The profile-picture URL is stored by Supabase as part of your account data; we currently do not store a separate copy of the image file in our own storage.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).

3.2 Game data

When you play, data is stored to save your progress and enable the ranking: scores achieved, solution times per puzzle, number of hints used, and favorited and completed puzzles. Legal basis: Art. 6 (1) (b) GDPR.

3.3 Usage quotas

To enforce plan limits, we store daily and weekly usage counters (number of generated puzzles) as well as reset times. Legal basis: Art. 6 (1) (b) GDPR.

3.4 AI generation of puzzles

To generate puzzles we use external AI services (such as OpenAI, USA, or Google, Gemini). Only technical parameters are transmitted (chosen category, difficulty and language), no personal user data and no reference to your name, email address or profile. Legal basis: Art. 6 (1) (b) GDPR. Any transfer to the USA takes place on the basis of the EU standard contractual clauses.

3.5 Public ranking

After you complete an AI-generated puzzle that qualifies for the ranking, your best weekly result is automatically transferred to the public game ranking. The ranking can also be accessed without signing in. The display name, profile picture, position, score, solution time, number of correctly solved and total words, category, difficulty and ranking week are published. The technical ranking interface also provides an internal user and entry identifier as well as the language, number of hints used and creation time of the ranking entry. The email address is not published. You can change your displayed name at any time in the settings.

The profile picture provided by the login provider is stored by Supabase as an external URL. When it is displayed in the ranking, the image file is retrieved directly from the servers of the login provider, in particular Google. In this process, the IP address, time of retrieval and technical device and request data in particular may be transmitted to Google. Further information is available in the Google Privacy Policy.

The legal basis is Art. 6 (1) (b) GDPR (provision of the contractual game and ranking function).

3.6 Advertising in the app (Google AdMob)

The app uses Google AdMob (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) to display ads. Before the first ad is shown, a consent banner is displayed via the Google User Messaging Platform (UMP), where you can choose between personalized and non-personalized advertising. You can revoke your choice at any time in the app settings. Data processed may include: device advertising ID (IDFA on iOS, GAID on Android), IP address, device information, approximate location (via IP) and ad interactions.

The legal basis is Art. 6 (1) (a) GDPR (consent) for personalized advertising and Art. 6 (1) (f) GDPR (legitimate interest in refinancing) for non-personalized advertising. A third-country transfer to the USA takes place on the basis of the EU standard contractual clauses. You can reset the advertising ID at any time in your device settings or disable tracking (iOS: “Allow Tracking" OFF, Android: “Reset / delete advertising ID"). Further information: Google Privacy Policy.

3.7 Push notifications (planned)

Push notifications are planned for a later version but are not yet active. Once introduced, you can, after your explicit consent, receive notifications, e.g. to remind you of daily puzzles. Technical delivery depends on the platform, via the Apple Push Notification Service (APNs, Apple Distribution International Ltd., Ireland) or Firebase Cloud Messaging (FCM, Google Ireland Ltd., Ireland). A device push ID (token) is processed for this. Legal basis: Art. 6 (1) (a) GDPR (consent). You can revoke consent at any time in your device or app settings.

3.8 Anonymized analysis of game data

We analyze score and time data exclusively in anonymized form in order to calibrate the difficulty of AI-generated puzzles, detect technical problems and improve the game mechanics. No personal attributes such as name, email address or username are used. There is no profiling within the meaning of Art. 22 GDPR. The legal basis is our legitimate interest in improving the app (Art. 6 (1) (f) GDPR).

4. Processors and third-party providers

We use the following service providers:

• Supabase Inc. (hosting of database, authentication and edge functions, EU region Frankfurt), Privacy
• AI services (generation of puzzles, such as OpenAI or Google/Gemini, partly based in the USA), transfer on the basis of the EU standard contractual clauses, only technical parameters without any personal reference
• Google Ireland Ltd. (Google Sign-In, provision and direct retrieval of profile pictures, Google AdMob, possibly Firebase Cloud Messaging), Privacy
• Apple Distribution International Ltd. (Sign in with Apple, APNs for iOS push), Privacy
• Vercel Inc. (website hosting, USA), Privacy

Data processing agreements pursuant to Art. 28 GDPR have been concluded with providers where this is required under data protection law.

5. Storage period in the app

• Account data including the profile-picture URL: until you delete your account
• Other game data: until account deletion
• Current public ranking: until the next weekly ranking reset
• Archived top-three positions: for a further two days after the weekly ranking reset
• Anonymized raw analysis data: a maximum of 24 months, then deletion or further aggregation
• Website server logs: according to the host Vercel's specifications

6. Account deletion

You can delete your account yourself at any time in the app under Settings, Account, Delete account. On request, deletion is also carried out via an email to tetik.labs@gmail.com. We confirm deletion within 30 days. Note: Apple requires that app accounts can be deleted directly within the app, so this function is available to you there.

7. Minimum age

The app is intended for persons aged 16 and over. Persons under 16 may only use the app with the consent of their legal guardians (Art. 8 GDPR).

8. Changes to this privacy policy

We reserve the right to adapt this privacy policy with effect for the future when features or legal situations change. The current version is always available here; the date above shows the current status.