Privacy Policy

Introduction

Happy Brain Games ("we", "our", or "us") operates the website happybrain.games and related game services. We are committed to protecting your privacy and being transparent about how we handle your data.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using our services, you agree to the practices described in this policy.

Age Requirement

You must be at least 13 years old to use our services. If you are between 13 and 16 years old and located in the European Economic Area (EEA), you may only use our services with the consent of a parent or legal guardian. We do not knowingly collect personal information from anyone under the age of 13. If we become aware that we have collected data from a child under 13, we will delete that information promptly. If you believe a child under 13 has provided us with personal data, please contact us at hello@happybrain.games.

We may provide a Child Mode for users who are minors or who choose a more privacy-restricted experience. Child Mode may be enabled based on a saved date of birth or from an account/game setting. When Child Mode is active, optional analytics and third-party analytics are disabled, and we limit collection to data needed to run the service, save progress, provide support, protect accounts, and understand aggregate product health without tracking an individual child profile.

Information We Collect

When you create an account, we may collect:

Username
Email address
Profile information (such as display name and avatar)
Date of birth, if you provide it, to determine age-appropriate privacy settings
Child Mode status, if enabled or required by age settings
Email communication preferences

If you sign in through a third-party provider (Google, Discord, Facebook, or similar), we receive limited profile information such as your name, email address, and profile picture URL. We do not receive or store your social media password. All social account identifiers are encrypted at rest using AES-256-GCM encryption.

If you purchase a Premium subscription, we collect and store:

Subscription plan (monthly, 6-month, annual, or family)
Subscription status (active, trialing, past due, cancelled, expired)
Purchase source (web/Stripe, iOS/Apple, or Android/Google)
Subscription start, renewal, and expiry dates
Transaction reference IDs (for support and dispute resolution)

We do not store full payment card numbers or bank account details. Payment instruments are held by Stripe, Apple, or Google respectively.

We collect gameplay information to provide our services, including:

Puzzle completion times and scores
Game progress and statistics
Achievements and streaks
Leaderboard rankings

We collect certain technical and usage information to operate the service, measure reliability, and improve the games. Optional analytics are controlled by your consent and profile settings, and are disabled in Child Mode.

Device type and screen size
Browser type and version
Anonymous session identifiers
General usage patterns (pages visited, features used)
Aggregate gameplay metrics such as starts, completions, difficulty, hints, mistakes, and performance buckets

We do not collect precise geolocation, we do not use fingerprinting techniques, and we do not use IP addresses for product analytics.

Legal Basis for Processing (EEA Users)

If you are located in the European Economic Area, we process your personal data under the following legal bases:

Contract performance: Processing necessary to provide our services to you (account management, gameplay features, leaderboards).
Legitimate interests: Analyzing usage trends to improve our services using privacy-protective aggregate data, detecting fraud and abuse, and ensuring platform security — where these interests are not overridden by your rights.
Consent: Optional analytics, non-essential cookies, and promotional or game-related emails. You may withdraw consent at any time through your preferences or by unsubscribing from promotional email.
Legal obligation: Where we are required by law to process or retain certain data.

How We Use Your Information

We use the information we collect to:

Provide, maintain, and improve our games and services
Authenticate your identity and manage your account
Process and fulfil Premium subscription purchases via Stripe, Apple, or Google
Grant and verify Premium entitlements across web, iOS, and Android via RevenueCat
Send subscription lifecycle emails (receipts, trial reminders, renewal notices, cancellation confirmations)
Enable social features like friends lists and leaderboards
Send transactional emails (e.g., verification codes, password resets)
Send promotional emails about new games, features, and updates (with your consent)
Respond to bug reports and support requests
Analyze aggregate usage trends to improve the player experience
Detect and prevent fraud, abuse, or security incidents

We do not sell your personal information to third parties. We do not serve advertising. We do not use your data for purposes unrelated to providing our services.

Email Communications

We send two types of emails:

Transactional emails: These are essential messages like verification codes, password resets, and security alerts. You cannot opt out of these while your account is active, as they are necessary for account operation and security.
Promotional emails: These include updates about new games, features, challenges, and other content we think you may enjoy. You can opt out at any time by updating your email preferences in your profile settings or by clicking the unsubscribe link in any promotional email.

We will never share your email address with third parties for their marketing purposes.

Cookies & Local Storage

We use essential cookies and browser local storage to keep you signed in, remember your preferences, and protect against cross-site request forgery (CSRF). These are strictly necessary for the operation of our services and do not require consent.

We may use optional analytics cookies or local storage after consent to understand aggregate usage and improve our games. We do not use advertising cookies, retargeting cookies, IDFA/GAID, or data-broker tracking. You can choose essential only, and Child Mode disables optional analytics regardless of prior consent.

Data Sharing & Third Parties

We may share limited data with the following service providers (sub-processors):

Email delivery — Mailjet (Sinch): We use Mailjet to send transactional and promotional emails. Your email address and name are shared with Mailjet solely for delivery. Mailjet is GDPR-compliant and processes data under Standard Contractual Clauses.
Web payments — Stripe, Inc.: If you purchase a Premium subscription on the web, payment is processed by Stripe. Stripe receives your payment details, billing email, and subscription plan. We do not store full card numbers. Stripe is PCI DSS Level 1 certified. See stripe.com/privacy.
iOS in-app purchases — Apple, Inc.: If you subscribe via the iOS app, the purchase is processed by Apple's App Store under their terms and privacy policy. We receive a notification of the purchase result but do not handle your payment instrument. See apple.com/legal/privacy.
Android in-app purchases — Google LLC: If you subscribe via the Android app, the purchase is processed by Google Play under their terms and privacy policy. We receive a notification of the purchase result but do not handle your payment instrument. See policies.google.com/privacy.
Subscription management — RevenueCat, Inc.: We use RevenueCat to unify subscription entitlements across web, iOS, and Android platforms. RevenueCat receives your account identifier, subscription status, platform, and transaction events. RevenueCat does not receive your payment instrument. RevenueCat is GDPR-compliant and processes data under Standard Contractual Clauses. See revenuecat.com/privacy.
OAuth providers: When you link a social account, authentication data flows through the provider (Google, Discord, Facebook, etc.) under their respective privacy policies.
Infrastructure: Our services are hosted on secure servers. We do not share your data with hosting providers beyond what is necessary for operation.
Analytics: We may use analytics providers, such as Google Analytics, only after consent and only to understand aggregate product usage. Advertising features and ad personalization are not used.

We will never sell, rent, or trade your personal information. We may disclose data if required by law or to protect the rights and safety of our users.

International Data Transfers

Our servers are located in the United States. If you are accessing our services from outside the United States, please be aware that your data may be transferred to, stored, and processed in the United States. By using our services, you consent to the transfer of your data to the United States. We take appropriate safeguards to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

Data Security

We take the security of your data seriously and implement industry-standard protections, including:

All connections are encrypted with TLS (HTTPS)
Passwords are hashed using Argon2id (never stored in plaintext)
Social account data is encrypted at rest with AES-256-GCM
Authentication tokens are short-lived with secure refresh mechanisms
Rate limiting and brute-force protection on all authentication endpoints

No system is 100% secure, but we continuously work to protect your data and promptly address any security concerns.

Data Retention

We retain your account data for as long as your account is active. Raw or linkable analytics and diagnostic records are kept only while they have a useful product, reliability, support, or security purpose. We may keep aggregate or anonymized metrics for longer when they cannot reasonably identify you and remain useful for understanding product health, gameplay quality, reliability, privacy operations, or long-term trends.

We maintain backend retention and purge controls so old data can be removed by category. If you delete your account, we will remove or anonymize your personal information within 30 days, though aggregate data such as total games played, completion rates, or daily reliability counts may be retained if it is no longer linked to you.

Your Rights

All users have the right to:

Access your personal data — view your profile and connected accounts at any time
Correct inaccurate information — update your username or email in your profile settings
Delete your account — request account deletion from your profile settings or by contacting us
Disconnect social accounts — unlink any connected social login from your profile page
Opt out of promotional emails — manage your email preferences in your profile settings
Control optional analytics — choose essential-only analytics settings where available
Enable Child Mode — use age or account settings to apply stricter privacy protections where available
Export your data — request a copy of your personal data by contacting us

If you are located in the European Economic Area, you also have the right to:

Restrict processing of your personal data in certain circumstances
Object to processing based on legitimate interests
Data portability — receive your personal data in a structured, commonly used, machine-readable format
Withdraw consent at any time where processing is based on consent
Lodge a complaint with your local data protection authority if you believe your rights have been violated

To exercise any of these rights, contact us at hello@happybrain.games. We will respond to your request within 30 days.

If you are a California resident, you have the right to:

Know what personal information we collect and how it is used
Request deletion of your personal information
Non-discrimination for exercising your privacy rights

We do not sell personal information as defined under the California Consumer Privacy Act. We do not use or share sensitive personal information for purposes beyond what is necessary to provide our services.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users through our services and update the "Last updated" date at the top of this page. Your continued use of our services after any changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy, your data, or wish to exercise any of your rights, please contact us at:

hello@happybrain.games