Braindoki privacy

Braindoki is a feed of brain puzzles by Snega AS. This page says what the game stores about you, why, how long, who can see it, and how to see or delete it. Last updated 29 October 2026.

Our promise to parents

Under 18, your child is never tracked, and never sees an ad picked from what anyone knows about them.
We ask only for a birth month and year, or the age range Apple shares, and it stays on the phone. Nobody types a name: leaderboard names are picked from a list.
Under 13, every purchase and every link out of the app goes through a grown-up.
The game tells them when to stop. A daily limit, and no ad, reward or offer ever waits on the other side of it.

Who is responsible

Snega AS, Oslo, Norway, is the data controller for Braindoki. Contact us at post@agens.no. The game data is hosted by Supabase in the EU and analysed, under a pseudonym, with PostHog in the EU. Nothing is sold, and nothing we store is used for advertising or combined with data from other companies. Adults see ads from Google, which works as described under Ads below.

What we store

Playing creates a guest account on our servers (Supabase, EU region) once the age question below has been answered. It has no name, email or password; it is a random id kept on your device. If you sign in with Apple or Google, the same account is linked to your Apple ID or Google account. The web game at app.braindoki.com works the same way and keeps its id, progress and settings in your browser's local storage. It sets no cookies.

Puzzle results: which puzzles you solved, your stars, time and mistakes.
Hearts (favorites) and their order.
Play history: one event per puzzle you looked at (solved, skipped, time spent, mistakes) and a per-puzzle-type profile of skill and taste. Each event also notes the platform, app version, language, device type (phone, tablet or desktop) and input (touch, mouse or keys), which app session it belongs to, where in the feed the card sat and what came before it, how the feed chose the card, your estimated skill at that type when it was shown, the target time, how long until your first tap, and whether you used a hint. The feed uses it to pick your next puzzle. Events are kept for 180 days.
Level ledger: XP, level, day streak and mind age.
Display name, if you pick one. It is made of our own words, like “Swift Otter 42”, chosen from a list; nobody types a name. Other players see it next to your fastest times only when you turn on Show my name to other players, which the game offers from age 16. Any player can report a name, and a reported name is hidden until we have looked at it.
Email address, only for accounts signed in with Apple (Apple may give us a private relay address). Signing in with Google gives us no email address and no name.
Public id: an 8-character handle (shown as Player id on your You screen). Other players can see your stats through it only if you turn that on.

We also keep anonymous totals per puzzle (how many people solved, skipped or hearted it, the fastest time). Your contribution to those counts is not tied to you and stays after you delete your data.

The Brainly asks one question a day about what you like, such as cats or dogs. We keep a count for each answer with no player on it, and those counts stay after you delete your data. Your own answer is kept on your device only. So that each account counts once, we keep a mark that your account has answered that day’s question. The mark does not say which answer you gave. It is deleted after three days, or at once when you delete your data.

Reports you send from Report a problem: the kind of problem you picked, your note if you wrote one, a picture of the game screen if you left it on, and details the app adds so we can find the puzzle (which card, puzzle type and difficulty, the app version, iOS version, device model and language). Players under 13 cannot write a note, and the app does not say how old you are. The report goes to our team chat (Slack) and to our bug tracker (GitHub), and our replies to you are kept with it. If you let us, we thank you in the release notes by your display name. Reports stay until you delete your data. Then the report, its picture, the chat post and the bug-tracker entry are removed.

Crashes and freezes: when the app crashes or freezes, iOS gives it a technical report on the next launch: where in the app’s code it stopped, the app and iOS version, and the device model. The app adds which card and puzzle type were on screen and sends the report to our servers with your account id. It contains no name, email, age or picture of the screen. Reports are kept for 90 days, or deleted sooner when you delete your account. Our team chat gets a daily count grouped by where the app crashed, without account ids.

Runs and ads: when a run ends, the game notes the run's score and solves, what it offered to keep you going (an ad, a break, Plus or nothing) and why, which button you pressed, and how the run ended. For adults, the app also notes whether the ad software started, whether Google's consent form was needed and answered (not what you answered), whether each ad loaded, with Google's error number if it did not, and whether an ad was shown and watched to the end. These notes carry your account id, the platform, the app version and the app session, but never your age. We use them to check that the second chance and the ads work. Run notes are kept for 180 days and ad notes for 90 days, or deleted sooner when you delete your account.

Notifications, on iPhone and iPad, only from age 13 and only when you turn reminders on. The daily reminders are made on your phone, and nothing is sent to us for them. So that we can tell you when someone beats your fastest time (only while your name is shown to other players) or when we answer a report you sent, the phone also gives us the address Apple uses to deliver a notification to it, your time zone, the reminder time you picked and the last day you opened the game. Because younger players cannot turn reminders on, this tells us that you are 13 or over, and nothing more about your age.

Braindoki Plus, the subscription, is sold through the App Store. Apple handles the payment and we get no card or payment details. The app asks Apple whether your subscription is active and keeps the answer on the device. It is not sent to our servers.

Why, and on what basis

Results, hearts, the level ledger and the play history are what the game is: keeping them for you and using them to pick your next puzzle is our legitimate interest in running the service you asked for (GDPR art. 6(1)(f)). The play history is pseudonymous.
Studying how the game is played, to fix puzzles that are too hard and improve the feed, is also our legitimate interest (art. 6(1)(f)). For that, a pseudonymous copy of your results, play-history events and level ledger is analysed with PostHog (see Third parties).
Reports you send are used to find and fix the problem you reported and to answer you, our legitimate interest in keeping the game working (art. 6(1)(f)). We thank you by your display name only while Thank me by name in the release notes is on. It starts on, you can turn it off before you send, and players under 13 are never named (art. 6(1)(f)).
Crash and freeze reports are used only to find and fix what broke, our legitimate interest in keeping the game working (art. 6(1)(f)).
Run and ad notes are used to check that the second chance in a run and the ads work, our legitimate interest in keeping the game working (art. 6(1)(f)).
Notifications from our servers are sent because you asked for them, by turning reminders on and allowing notifications (art. 6(1)(a)). Turn reminders off, or notifications off in iOS Settings, any time.
Showing your name and stats to other players happens only with your consent, the toggle in the game (art. 6(1)(a)); turn it off any time.
Your email is processed only to sign you in with Apple (art. 6(1)(b)).

The game is rated for ages 9 and up. Guest accounts are pseudonymous. Under 16 the game does not offer to show your name and stats to other players.

Age

On first launch the game asks for an age range (Apple's Declared Age Range, on iPhone and iPad) or, if that is not shared, a birth month and year. The web game always asks for the birth month and year. The answer stays on your device, or in your browser on the web. It is never sent to us or anyone else, and it is used only to decide which features run (a phone with reminders on tells us only that you are 13 or over, see Notifications above): under 13, for example, every link out of the game first shows a multiplication for a grown-up to solve. Delete all my data clears it.

Ads (adults only)

Players aged 18 and over see an ad from Google AdMob every 12 to 15 puzzles, and can watch a short ad for 5 Noodles, three times a day. In a run they can also watch a short ad to keep going after the run would end, at most twice per run. Players under 18, and adults who get no ads, take a 15-second break from the game for the same second chance instead. Braindoki Plus has no ads. Under 18 the ad software is never started. The web game shows no ads from other companies. From a month after launch, a share of new adult players sees no ads for their first 30 days, so we can tell whether ads make the game worse.

Google receives what it needs to show an ad: your device's advertising identifier if you allow it, your approximate location from your IP address, device and app details, and how you interact with the ad. Google is a separate data controller for this; see how Google uses information from apps that use its services. Google's consent form lists the other ad companies that may take part in showing an ad; in the EEA, the UK and Switzerland they get this data only if you agree in that form.
Ads are personalized only if you say yes every time you are asked: to Apple's tracking prompt, to Google's consent form in the EEA, UK and Switzerland, and to the Personalized ads switch in the app. Otherwise you still see ads, just not personalized ones.
Change your choice in the app: menu (☰) → Privacy & Data → Ads & privacy. Tracking can also be turned off in iOS Settings → Privacy & Security → Tracking.
Ads are limited to content suitable for a general audience with parental guidance (Google's PG rating), and alcohol, gambling, dating and social casino ads are blocked.
In the EEA, UK and Switzerland, Google's consent form asks before any ad is requested (GDPR art. 6(1)(a)). If you decline, Google shows limited ads, which it chooses without personal data.

Third parties

Braindoki is an iPhone and iPad app and a web game at app.braindoki.com. The app talks to our servers, to Apple for sign-in, purchases and notifications, and, for adults only, to Google for ads. Reports you send go from our servers to Slack, our team chat, with your account id so we can match a report to your replies, but no email, name or age. GitHub, our bug tracker, gets only the kind of problem and the card and device details, with no account id, note or picture. Slack also gets a daily count of crashes and freezes, without account ids. No analytics or social SDKs are included, and apart from those ads and the script below, the game downloads no images or other content from other companies at runtime.

The web game is served by Amazon Web Services (CloudFront), which sees your IP address in order to deliver the page. We have not turned on its access logs. The page loads one script from another company: the Supabase client, from jsDelivr, a public code delivery network, which also sees your IP address. Its fonts and pictures are our own. Once loaded, the page talks only to our servers, and to Apple or Google if you sign in with one of them. It has no ads and no analytics, and it sends no crash reports.

PostHog, on its EU cloud in Frankfurt, is our analytics processor. Once a day it copies your puzzle results, play-history events (each with the skill estimate it was shown with, but not the full per-type profile), run and ad notes and level ledger from our database, and about your account only whether it is signed in with Apple or Google, when it was created, and whether it plays a TestFlight test build or the App Store build. Each row carries a key computed from your account id with a secret that stays in our database, so PostHog cannot link the rows to your account. It gets no display name, email, Player id, hearts or age, and nothing is sent to PostHog from your device. The copy covers players of every age, because our servers never learn anyone's age. Each daily copy replaces the one before, so anything deleted here, by you or by the 180-day limit, is gone from PostHog after the next copy, normally within a day.

How long

Guest accounts that have not played for 30 days and hold no results are deleted automatically every night.
Play-history events are deleted after 180 days.
PostHog keeps only the latest daily copy, so what is deleted here is gone there within about a day.
Crash and freeze reports are deleted after 90 days, or when you delete your account.
Run notes are deleted after 180 days and ad notes after 90 days, or when you delete your account.
The notification address is deleted when you turn reminders off, sign out, or delete your account, and when Apple tells us it no longer works, or after 90 days without opening the game. A notification waiting to be sent is deleted after 14 days.
Everything else stays until you delete it.

Delete your data

You can delete everything yourself, at once, from inside the game. Deletion removes your account and every row it owns from our servers and clears the game on that device. It cannot be undone. PostHog's copy loses those rows at its next daily copy.

In the app (iPhone, iPad)Open the menu (☰) → Account → Delete all my data (guests) or Delete account (Apple sign-in; you confirm with Apple first and we revoke the Apple sign-in for the game).

On the web (app.braindoki.com)Open the menu (☰) → Privacy & Data → Delete all my data (guests) or Delete account (Apple or Google sign-in; with Apple you confirm with Apple the same way). It also clears the game in that browser.

Without the appEmail post@agens.no from the address you signed in with, or quote your Player id (You screen). We delete the account within 30 days and confirm by email.

A guest account is only known to the device it was created on. If that device is gone and you never signed in or noted your Player id, there is nothing left for us to identify, and the account is removed by the 30-day clean-up.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to its processing, and withdraw consent (the toggle). Deletion you can do yourself, below; for a copy or anything else, email post@agens.no from the address you signed in with or quote your Player id, and we answer within 30 days. You can also complain to the Norwegian Data Protection Authority (Datatilsynet).

Reset is not deletion

Reset all progress clears your results, flow profile and level so you can start over, but keeps your account, hearts and display name. Use Delete all my data to remove everything.

Contact

Snega AS, org. no. 915 967 000, Trondheimsveien 184, 0570 Oslo, Norway · post@agens.no