Privacy policy

On your device

XP, levels, streaks, your riddle answers and your settings are stored on your device. "Delete my data" in Settings deletes them. On iPhone and Android, uninstalling the app deletes them too, unless you signed in (see Accounts).

Accounts

Signing in is optional. If you sign in with Google or with Apple, we get your email address and name from them (with Apple you can hide your email). We then save your progress (XP, levels, streaks, riddle answers and settings) to your account, along with the anonymous id below, so it can be restored on another phone. Sign-in and saved progress are handled by Supabase, in the European Union. We never see your Google or Apple password.

"Delete account and data" in Settings deletes your account, the progress saved in it and everything else listed on this page.

Sent to our server

The app makes a random anonymous id for your device. It isn't linked to your name, email, phone number or any account. With it we keep:

• your skill ratings, for the leaderboard and "Top X%" comparisons;
• your duel name, the duels you play and their results;
• the XP you earn each week and your duel name, for the weekly league table;
• whether you solved each day's riddle (not your answer), to show how many players solved it;
• reports you send about questions or players, and players you block.

Your IP address is used to limit how many requests a device can make per hour. Those counters are deleted within two days. Our database is hosted by Supabase in the European Union.

Only if you turn on Anonymous usage stats in Settings (they are off unless you choose them), the app also sends events such as finishing a workout or the daily riddle, with the app version, language and device type, to PostHog in the EU, under a separate random id that isn't linked to the one above. Your IP address isn't stored with them. You can turn them off at any time.

If the app crashes, it sends a crash report (what went wrong, the device model and the system and app versions) to Sentry so we can fix it. It carries no name, account or answers.

AI

Questions, hints and the daily riddle are written by Claude, an AI made by Anthropic. If you allow AI answer checking, what you type in answers is sent to Claude along with the question and your language, never with your name or an account. Under Anthropic's commercial terms, this data isn't used to train its models. You can turn AI answer checking off at any time in Settings.

Other players

In duels, your opponent sees your duel name, your rating and the score of each answer. You can report or block any player.

Why we use this data

We use the data above only to run the game: to make questions, check answers, match duels, show rankings, handle reports, fix crashes keep the service from being abused and, if you turn on usage stats, see which parts of the game people use. Where the GDPR or similar laws apply, we rely on our legitimate interest in providing the game you asked for, and on your consent for AI answer checking, anonymous usage stats and the waitlist.

Who processes it

• Supabase stores the server data listed above and the waitlist, in the EU.
• Anthropic receives questions and, if you allow it, your typed answers, to generate and check them. Anthropic is based in the United States.
• Sentry receives crash reports, as described above.
• PostHog receives anonymous usage stats, in the EU, only if you turn them on.
• RevenueCat receives your anonymous id and purchase receipts if you subscribe to Pro, to manage the subscription.
• Apple and Google handle downloads, and any purchases, under their own privacy policies. We don't receive your payment details.

We don't sell your data, share it with advertisers or use it to build a profile of you. We'd only disclose it if the law requires us to.

How long we keep it

Server data stays until you delete it with "Delete my data" or ask us to. Rate-limit counters are deleted within two days.

Deleting your data

"Delete my data" in Settings removes everything our server keeps about you, and your progress on the device. If you no longer have the app, email us with your anonymous id (shown in the app's privacy policy) and we'll delete it within 30 days. See how to delete your data.

Your rights

Depending on where you live, you can ask to see, correct, export or delete the data linked to your anonymous id, or object to how we use it. Email us with your id and we'll answer within 30 days. You can also complain to your local data protection authority.

Children

MindBuff isn't directed at children under 13, and we don't knowingly collect personal information from them. Every player can report an offensive duel name, or block another player. If you believe a child under 13 has used duels, contact us and we'll delete the data.

Subscriptions

If you subscribe to MindBuff Pro, Apple or Google handles the payment. RevenueCat, the service we use to manage subscriptions, gets your anonymous id and the purchase receipt so Pro works and can be restored. We never see your card or payment details.

Launch waitlist

If you join the waitlist on this website, we keep your email address, the date you joined, and which link brought you (for example a TikTok or Instagram profile). We use it only to email you when MindBuff launches, never for anything else and never shared or sold. We ask for your consent with a checkbox before saving it. Your IP address is used only to limit sign-ups per hour, and that counter is deleted within two days.

To be removed, email us from that address and we'll delete it within 30 days. We'll delete the whole list once launch emails are sent, and in any case within 12 months.

This website

This website doesn't use cookies, analytics or trackers. The waitlist form sends only what you type, straight to our database. Our hosting provider may keep standard server logs, such as IP addresses and pages requested, for a short time to keep the site secure.

Changes

If we change this policy, we'll update the date at the top and, for important changes, tell you in the app before they take effect.

Contact

Questions about privacy, or a request about your data: