Privacy Policy

1. The short version

• Playing as a guest: your scores, streaks and settings are stored only on your device (browser storage). We do not receive them.
• With an account (Google sign-in or an email link): we store your profile basics and your training history so you can sync across devices.
• We do not sell or share your personal data, and we do not currently use analytics or advertising cookies.
• Exercise scores are practice metrics. We never use them to diagnose you or to estimate an "IQ" or "brain age".
• You can export or delete your data at any time.

2. Data we process

a) When you browse or play as a guest

• Technical data handled by our hosting and security provider (Cloudflare) and our server: IP address, browser type, requested pages, timestamps and security signals. Used to deliver the site, protect it from abuse and fix errors.
• Data stored in your own browser (not sent to us): exercise results, personal bests, streak, daily-circuit results, breath-counter sessions, and preferences such as language, theme and Kids mode.

b) When you create an account

• From Google sign-in: your name, email address, Google account identifier and profile picture URL. We request only the basic "openid email profile" scopes; we cannot see your Google password, contacts or other Google data.
• From email-link sign-in: your email address.
• An age band (for example "16 or older") from a neutral age question. We do not store your date of birth.
• Settings: language, time zone, reminder preferences, accessibility options.
• Training history: exercise sessions (game, level, scores, response times, trial-by-trial results, device type), streaks, points, achievements, program progress and Daily Circuit results.
• Optional entries you choose to make, such as weekly check-ins or reflection notes (for example focused-work minutes, or sleep hours if you choose to log them). These are optional and you can delete them.
• Records of your choices (consents, policy versions accepted) and account security data (session tokens, sign-in timestamps).

c) When you contact us: your message and contact details.

We do not ask for, and ask you not to provide, health diagnoses or other sensitive information. The Service is not a medical service.

3. Why we use it (and legal bases)

• To provide the Service and your account, sync your progress, show your history and keep your streak — performance of a contract.
• To secure the Service, prevent abuse and cheating, and debug errors — legitimate interests (keeping the Service safe and working).
• To send account emails you need (sign-in links, important changes) — performance of a contract.
• To send optional reminders or newsletters — consent, which you can withdraw at any time.
• To improve exercises using aggregated, de-identified statistics — legitimate interests. We do not build advertising profiles.
• To comply with law and respond to lawful requests — legal obligation.

4. Cookies and browser storage

We use only what the Service needs to work:

• A sign-in session cookie (only if you sign in) — strictly necessary.
• A language cookie and browser storage for your preferences, guest progress and Kids mode — functional; they stay on your device.
• Security cookies set by Cloudflare to protect the site — strictly necessary.

We currently use no analytics, advertising or cross-site tracking cookies. If we introduce analytics or ads, we will update this policy, list the services on our third-party data transmission page, and ask for your consent first where the law requires it (for example in the EEA, UK and Switzerland). We honour the Global Privacy Control signal as an opt-out of any "sale" or "sharing".

5. Who receives your data

We do not sell your personal data. We share it only with service providers that process it for us under contract, and only as needed:

• Cloudflare, Inc. — content delivery, DNS, security and secure tunnelling to our server.
• Google LLC — "Sign in with Google" authentication, only if you choose it.
• An email delivery provider — sign-in links and reminders, only if you use email features.

We may disclose data if required by law, to protect the rights and safety of users or the public, or as part of a reorganisation of the Service (in which case this policy will continue to apply to your data).

6. Where your data is stored

Account data is stored on servers we operate in Vietnam, with encrypted backups on separate storage. Our service providers may process data in other countries, including the United States. Where data protection law requires it, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses offered by those providers.

7. How long we keep it

• Guest data: on your device until you clear it (see Progress → "Clear data on this device").
• Account data: while your account is active. If you do not use your account for 24 months we will email you, and delete it 3 months later unless you sign in.
• Unfinished exercise sessions: deleted after 90 days.
• Server and security logs: about 30 days.
• Backups: rolling 14 days, so data you delete disappears from backups within about 14 days.
• Deleting your account deletes your account and training data immediately from the live database.

8. Your rights and choices

You can access, export (JSON/CSV) and delete your data in your account settings, or by emailing [email protected]. Depending on where you live you may also have the right to correct your data, restrict or object to processing, data portability, withdraw consent, and complain to a data protection authority. We will respond within 30 days (or the period required by your local law).

• EEA / UK / Switzerland: rights under the GDPR / UK GDPR / FADP, including complaining to your local supervisory authority.
• Japan: requests under the Act on the Protection of Personal Information (disclosure, correction, suspension of use, and disclosure of records of provision to third parties). Our name, address and representative are provided without delay on request.
• United States: rights under applicable state laws. We do not sell or share personal data for targeted advertising, and we honour Global Privacy Control.
• Vietnam: rights under the Law on Personal Data Protection.

We will not discriminate against you for exercising your rights.

9. Children

Anyone can use the exercises as a guest — including children — without giving us personal data; guest progress stays on the device. Accounts are available only to people aged 16 or older. If you are under 16, please keep playing as a guest; family profiles managed by a parent may be offered later, with verifiable parental consent. Kids mode turns off ads, outbound links and streak pressure on the device.

If you believe a child under 16 has created an account, contact us at [email protected] and we will delete it.

10. Security

We use encryption in transit (HTTPS), restrict administrative access to a private network, keep the database off the public internet, apply least-privilege access and keep backups on separate storage. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

11. Automated decisions

The Service adjusts exercise difficulty automatically based on your answers. This only changes your practice experience; we make no decisions that have legal or similarly significant effects on you.

12. Changes to this policy

We will post updates on this page with a new effective date. If a change materially affects how we use your data, we will tell you in the Service or by email before it takes effect.

13. Contact

Privacy questions and data requests: [email protected]. Anything else: [email protected]. LaserMind — https://lasermind.org.