Privacy Policy

Introduction

Happy Brain Games ("we", "our", or "us") operates the website happybrain.games and related game services. We are committed to protecting your privacy and being transparent about how we handle your data.

This Privacy Policy explains what information we collect, how we use it, and the choices you have. By using our services, you agree to the practices described in this policy.

Information We Collect

Account Information

When you create an account, we may collect:

• Username
• Email address
• Profile information (display name, avatar)

Social Login Data

If you sign in through a third-party provider (Google, Discord, Facebook, or similar), we receive limited profile information such as your name, email address, and profile picture URL. We do not receive or store your social media password. All social account identifiers are encrypted at rest using AES-256-GCM encryption.

Game Data

We collect gameplay information to provide our services, including:

• Puzzle completion times and scores
• Game progress and statistics
• Achievements and streaks
• Leaderboard rankings

Device & Usage Data

We automatically collect certain technical information:

• Device type and screen size
• Browser type and version
• Anonymous session identifiers
• General usage patterns (pages visited, features used)

We do not collect precise geolocation. We never ask for GPS or device location permission, and we never record a street-level position. The only location data we hold is the approximate, city-level estimate described below. Device and usage data listed above is used solely for service operation and is never combined to track you across other sites.

Approximate Location

When we record an analytics event, we send the IP address the request came from to ipinfo.io, a third-party lookup service, and ask it for an approximate location. Your IP address is never stored with your activity. What we keep alongside the analytics record is only the answer we get back: country, region, and city — nothing more precise, and nothing that identifies your device or your connection.

Those three fields are automatically cleared 30 days after they are recorded. After that the analytics record carries no location at all.

The lookup result is held in a short-lived server cache for up to 24 hours so that repeat visits do not trigger repeat lookups. The cache is keyed by a one-way cryptographic hash of the address, not the address itself, so the address cannot be read back out of it. Each entry holds only the country, region, and city that were resolved, it is never joined to your account or your gameplay, and it expires on its own.

If Child Mode is active on an account, no location lookup happens at all. Nothing is sent to ipinfo.io, and no country, region, or city is ever recorded.

Campaign & Referral Information

If you arrive from a link we have shared or from an advertisement, we record how you got here so we can tell which campaigns actually work. That means the campaign parameters in the address (any utm_ value, such as utm_source and utm_medium), the website that referred you, the page you landed on, and the ad click identifiers fbclid, gclid, and ttclid. We capture only those parameters — no other part of the address you arrived on is read or stored.

This is collected only if you accepted analytics cookies, and it is never collected for accounts with Child Mode active.

Guest Play

You can play without signing in. Guest gameplay is recorded against the device you are playing on rather than against a person, so that we can see how the game is actually being used and support you if something goes wrong. There is no name, email address, or account attached to it — we cannot tell who a guest device belongs to. Previously this activity was simply discarded.

How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve our games and services
• Authenticate your identity and manage your account
• Enable social features like friends lists and leaderboards
• Send transactional emails (e.g., verification codes, password resets)
• Respond to bug reports and support requests
• Analyze usage trends to improve the player experience
• Measure how our own campaigns and referral links perform
• Detect and prevent fraud, abuse, or security incidents

We do not sell your personal information to third parties. We do not serve advertising. We do not use your data for purposes unrelated to providing our services.

Cookies & Local Storage

We use essential cookies and browser local storage to keep you signed in, remember your preferences, and protect against cross-site request forgery (CSRF). Optional analytics cookies are used only if you accept them. We do not use advertising cookies.

When a page loads, we also copy any campaign parameters from the address into your browser session storage, so that the attribution survives as you move around the site. Only utm_ parameters and the fbclid, gclid, and ttclid click identifiers are copied — no other query parameter is. Session storage is cleared by your browser when you close the tab.

Data Sharing & Third Parties

We may share limited data with the following categories of service providers:

• Email delivery: We use Mailjet to send transactional emails (verification codes, notifications). Your email address is shared with Mailjet solely for delivery purposes.
• OAuth providers: When you link a social account, authentication data flows through the provider (Google, Discord, Facebook, etc.) under their respective privacy policies.
• Infrastructure: Our services are hosted on secure servers. We do not share your data with hosting providers beyond what is necessary for operation.
• Analytics and diagnostics: If you accept analytics cookies, we use Google Analytics and Google Tag Manager to understand aggregate product usage. We also send limited diagnostics, performance metrics, and accessibility preference signals to Happy Brain Games to improve reliability and usability. These reports are not used for advertising.
• IP geolocation: If you accept analytics cookies, we send your IP address to ipinfo.io to resolve it to an approximate country, region, and city. That is the only thing they receive — no account, profile, or gameplay data — and your IP address is never stored with your activity on our side. No lookup is performed for accounts with Child Mode active.

We will never sell, rent, or trade your personal information. We may disclose data if required by law or to protect the rights and safety of our users.

Data Security

We take the security of your data seriously and implement industry-standard protections, including:

• All connections are encrypted with TLS (HTTPS)
• Passwords are hashed using Argon2id (never stored in plaintext)
• Social account data is encrypted at rest with AES-256-GCM
• Authentication tokens are short-lived with secure refresh mechanisms
• Rate limiting and brute-force protection on all authentication endpoints

No system is 100% secure, but we continuously work to protect your data and promptly address any security concerns.

Data Retention

We retain your account data for as long as your account is active. Game statistics and leaderboard data are retained to maintain historical records. If you delete your account, we will remove your personal information within 30 days, though anonymized aggregate data may be retained.

Two categories have their own, shorter retention windows:

• Approximate location (country, region, and city on an analytics record) is cleared 30 days after it is recorded.
• Campaign and referral data (utm_ parameters, referrer, landing page, and the fbclid, gclid, and ttclid click identifiers) is kept for 13 months, then removed. Thirteen months is deliberate: it is the shortest window that still lets us compare a campaign against the same month a year earlier. This data is only collected in the first place if you accepted analytics cookies.

Neither of the above is ever collected for accounts with Child Mode active, so for those accounts there is nothing to retain and nothing to delete.

Your Rights

You have the right to:

• Access your personal data — view your profile and connected accounts at any time
• Correct inaccurate information — update your username or email in your profile settings
• Delete your account — contact us to request full account deletion
• Disconnect social accounts — unlink any connected social login from your profile page
• Export your data — request a copy of your personal data by contacting us

Children's Privacy

You must be at least 13 years old to use our services. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will take steps to delete that information promptly. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at hello@happybrain.games.

Child Mode

Child Mode is a setting you can turn on for an account. It is a hard exclusion, not a preference we merely weigh up. While it is active:

• No IP geolocation lookup is performed. Nothing is sent to ipinfo.io, and no country, region, or city is recorded.
• No campaign or referral data is recorded — no utm_ parameters, no referrer, no landing page, and no fbclid, gclid, or ttclid click identifiers.

These exclusions are enforced when the data would be collected, not filtered out afterwards. For a Child Mode account the data is never gathered in the first place.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify users through our services. Your continued use of our services after any changes constitutes acceptance of the updated policy.

Contact Us

If you have questions about this Privacy Policy or your data, please contact us at:

hello@happybrain.games