Privacy Policy | Brainura

This Privacy Policy explains how Brainura ("Brainura", "we", "us", "our") collects, uses, shares, and protects personal information when you use our mobile application and related services (collectively, the "Service"). We designed Brainura with privacy in mind: we collect only what we need to run the product, we never sell your data, and we do not display third-party advertising.

1. Who is responsible for your data

The data controller is Hanna Kravchenko, the developer of Brainura, based in Ukraine. For any privacy-related question or to exercise the rights described in this policy you can reach us at krv4art.dev@gmail.com.

2. Data we collect

2.1 Information you provide

Account information— if you sign in, we store your email address and the display name you choose. Sign-in is optional; the app can be used anonymously.
Onboarding answers— goals, focus areas, age group, and preferences you select during onboarding so we can personalise your training programme.
Support messages— if you write to us, we keep the conversation so we can follow up.

2.2 Information generated by your use of the Service

Exercise results— scores, accuracy, duration, per-exercise details, streaks and Brain Age estimates.
App interactions— which screens you visit, which features you use, and basic preferences (language, theme).
Device and diagnostic data— device model, OS version, app version, locale, time zone, anonymised crash logs and performance metrics.
Approximate location— derived from your IP address at the country/city level for regional content and analytics. We do not request or use precise GPS data.
Identifiers— an anonymous Supabase user ID, a OneSignal player ID for notifications, and Apple/Google purchase identifiers. None of these can be used to identify you outside of Brainura.
Purchase data— subscription status, transaction receipts and renewal information returned by Apple App Store, Google Play and RevenueCat.

3. How we use this data

To provide and personalise the training experience.
To track your progress and estimate your Brain Age.
To deliver push notifications you have explicitly opted in to.
To detect, investigate and fix crashes and performance problems.
To process subscriptions and prevent fraudulent purchases.
To respond to support requests.
To comply with applicable law and enforce our terms.

4. Legal basis (EEA/UK users)

We rely on the following legal bases under the GDPR:

Contract performance— running the Service you requested (exercise scoring, subscription management).
Legitimate interest— improving the product, security, anonymised analytics, and fraud prevention.
Consent— push notifications, optional account creation, and any feature requiring an explicit opt-in.
Legal obligation— tax records related to purchases, responding to lawful requests.

5. Sharing with third parties

We share data only with the processors below, each under a written data protection agreement. We do not sell data and we do not share it for third-party advertising.

Apple App Store / Google Play— payment processing for in-app subscriptions.
RevenueCat— subscription state management across stores.
Supabase— database hosting and authentication.
Firebase(Google LLC) — anonymised crash reporting, performance metrics, remote configuration.
OneSignal— push notification delivery.
Groq— AI inference for the optional in-app support chat. Your support messages are sent to Groq only when you use that feature.

6. Advertising and tracking

Brainura does not display third-party advertisements, does not use the iOS App Tracking Transparency framework, and does not share any data with advertising networks or data brokers. We perform first-party analytics only.

7. Data retention

We keep your data while your account is active and for as long as needed to provide the Service. After deletion, anonymised aggregate statistics may be retained indefinitely for product improvement; they cannot be linked back to you. Crash logs are deleted after 90 days. Purchase records are retained for the period required by tax law (typically up to 7 years).

8. Your rights

Depending on where you live (EEA, UK, California, and several other jurisdictions) you have some or all of the following rights:

Access the personal data we hold about you.
Request correction of inaccurate data.
Request deletion ("right to be forgotten").
Object to or restrict certain processing.
Receive your data in a portable, machine-readable format.
Withdraw consent for any processing based on consent.
Lodge a complaint with your local data protection authority. For EU residents you may also contact your national DPA directly.

To exercise any of these rights, email us at krv4art.dev@gmail.com. We respond within 30 days.

9. International transfers

Our processors operate servers in the United States and the European Union. When data is transferred outside the EEA, we rely on Standard Contractual Clauses approved by the European Commission to ensure an adequate level of protection.

10. Children

Brainura is rated 4+ on the App Store but is designed for adult users. We do not knowingly collect personal information from children under 13 (or under 16 in the EEA) without verifiable parental consent. If you believe a child has provided us with personal information, contact krv4art.dev@gmail.com and we will delete it.

11. Security

We protect your data with industry-standard measures: encryption in transit (HTTPS/TLS), encryption at rest, principle-of-least-privilege access controls, and routine security reviews. No system is perfectly secure; in the unlikely event of a breach affecting your personal data we will notify you within 72 hours where required by law.

12. Cookies and similar technologies

The Brainura mobile app does not use HTTP cookies. The marketing website at brainura.app uses only the technical cookies set by Vercel for hosting (load balancing, security). We do not use analytics cookies, advertising cookies, or any cross-site tracking on the website.

13. Brainura extension for Chrome

The Brainura extension for Google Chrome (the "Extension") is a separate product with a smaller set of free brain games and optional break reminders. It follows a stricter rule than the app: the Extension does not collect, transmit, or sell any data.

No account, no sign-in, no analytics, no crash reporting, and no advertising identifiers.
Reminder settings (days, hours, times per day, session length), the time of your last session, exercise levels and results are stored only in your browser (chrome.storage and IndexedDB) and are never sent to us or to third parties.
Permissions: alarms — to schedule reminders; notifications — to show them; storage— to keep your settings. The Extension does not read the pages you visit and requests no access to websites.
To display text, the browser may download standard font files from Google Fonts (fonts.gstatic.com). No personal data is sent with these requests beyond what any web browser sends when loading a file.
Removing the Extension from Chrome deletes all of its data.

14. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be announced inside the app and at the top of this page at least 14 days before they take effect. The "Last updated" date at the top of this page reflects the latest revision.

15. Contact

For any privacy question, data request, or complaint, please email krv4art.dev@gmail.com. We aim to reply within one business day.