Braincell Breakdown privacy policy
Online accounts are optional. Optional web Coin purchases require a signed-in account. Native app purchases remain unavailable.
The short version
- You can play without an account. Your game progress stays on your device; our web host still receives requests for the game files.
- An online account is optional and only for players aged 13 or older.
- With an account we keep a made-up player name and your game progress. We do not keep your email address, real name, photo or birthday.
- No ads, no tracking, no selling your data, no chat, and nowhere to type messages to other players.
- You can download your online account data or delete your account from Settings → Online account. Limited payment verification records and correspondence can remain as explained below.
Who we are
Braincell Breakdown is made by Spinning Monkey Studios, a small studio in Langley, British Columbia, Canada. We are responsible for the information described here. To ask a question, or to ask us to see, fix or delete your information, email support@spinningmonkeystudios.com.
Playing without an account
When you play without an account, your settings, progress and the age you entered when the game first started are saved on your device only. Online accounts send account game progress and an age confirmation to our server, as described below. Clearing your browser's site data, or uninstalling the app, erases them.
Like every website, the computers that send you the game (our web host, Bluehost) keep short technical logs of requests, such as the internet address that asked for a file and when. We use these only to keep the site working and safe.
If you choose an online account (13 and older)
You sign in with Google. Google tells us "this is the same person as last time" and also sends your name, email address and photo. We throw those away straight away. We keep only:
| What we keep | Why | How long |
|---|---|---|
| A keyed, scrambled code made from your Google account number. We do not store the original Google account number. | To recognise you when you sign in again. | Until you delete your account. |
| A random player name, like "Turbo Stapler 42", picked from a word list. You can re-roll it; you can't type your own. | So friends can see who they are playing. | Until you delete your account. |
| Your game progress: Coins, trophies, fighters, power levels, cosmetics, plaques, story progress and the ids of matches already rewarded. | So your progress is safe and follows you to another device, and nothing is paid twice. | Until you delete your account. |
| That you ticked "I am 13 or older", and when. Not your age or birthday. | Accounts are for players 13 and up. | Until you delete your account. |
| The dates your account was made and last used, and your sign-in sessions. A session is stored as a scrambled code. | To keep you signed in, and to tidy away accounts nobody uses. | Sessions end 30 days after last use, or when you sign out. |
| A list of recent progress changes (for example "won a match"). | So a lost connection can't double-count or lose a reward. | 30 days. |
| Short-lived counters keyed by a scrambled form of your internet address. | To stop people flooding the game server or guessing room codes. | They expire within an hour and are then deleted. |
Accounts unused for two years are eligible for deletion during routine cleanup. Their game progress is removed. Limited payment verification records can remain, as explained below. Cleanup happens during server use, so removal may occur after the two-year point.
Playing with friends online
Online matches use private room codes: a friend gives you a code and you type it in. There is no matching with strangers.
During a match, your device connects directly to your friend's device, the way a video call does. That means each device can see the other's internet address, which can show roughly which town or internet provider someone uses. Only share room codes with people you know. Our server helps the two devices find each other. Those connection messages expire after five minutes and are then deleted. Room records and the result each player reports become eligible for cleanup about 30 days after the room expires.
A free Google service (a "STUN" server) helps devices find a route to each other, so it also sees your internet address briefly. If we later add a relay server for connections that can't go direct, this page will say who runs it.
Support messages
If you email us, we receive your email address and whatever you choose to include, such as your name, player name, receipt reference or screenshot. We use this to answer you and resolve the issue. This is separate from Google sign-in: your email is not added to your game profile. Please do not send passwords, sign-in codes or full card details.
Support correspondence may be retained to handle follow-up questions, disputes or legal obligations. Contact us to request access, correction or deletion; we will explain any record we need to keep for a legal or ongoing business reason.
Payment verification records
Stripe handles optional web Coin purchases. Checkout collects your email, name, billing address and payment details to process the payment, prevent fraud and send receipts. We do not receive full card numbers or security codes. Stripe may process information outside Canada. Our server receives payment confirmation and refund or dispute information. We keep event references, event types and dates to recognise repeated deliveries. We do not store the full event payload in this record.
When purchases are available in the Google Play Android version, Google Play processes payment and supplies receipts. Our server verifies the purchase with Google and records its Coin pack, status and dates. We send opaque identifiers linking the purchase to your game account and purchase request; these contain no name or email. Purchase tokens are encrypted while needed for delivery, consumption and refund checks. Deleting your account removes the account link, encrypted token and provider order reference. A non-reversible token hash remains to prevent duplicate delivery. Financial records follow the six-complete-calendar-year retention period below, with longer retention for unresolved debt, holds or legal requirements.
If a payment order exists, its record contains the pack, Coin amount, price, currency, status and dates, and references used to verify payment and refunds. It does not contain your full card details. Using Delete account removes the link to your game account and the stored checkout and payment references from that order, but limited order facts and event records remain. Inactive-account cleanup removes the account link; provider references in payment orders may remain.
Billing order facts and payment-event records are retained for six years after the end of their calendar tax year. Routine, bounded cleanup removes expired records; it may run after the expiry point. Unresolved payment disputes, payment holds or debts and records required for legal proceedings are retained longer until resolved. Support correspondence needed for these matters follows the same requirement; other correspondence is kept only while needed to resolve your request. Deleting your account does not erase records we must retain for these purposes.
What we never do
- No advertising, and no ad or analytics trackers.
- We never sell or rent information about players.
- No chat and no free text. Players communicate only with preset emotes.
- We don't ask for your location, contacts, photos, camera or microphone.
- We do not add checkout contact details to your public game profile.
Companies that help us
- Google, for sign-in, Google Play Android purchase processing and verification, and the connection helper described above. See Google's privacy policy.
- Stripe, for web Checkout, payment verification, receipts, refunds and disputes. Its handling of information is described in Stripe's privacy policy.
- Bluehost, which runs the computers that host the game and its server. Your account information may be stored outside Canada, for example in the United States, where it may be subject to that country's laws.
Your choices
- Download your data: Settings → Online account → Download my data.
- Delete your account: Settings → Online account → Delete account. This removes your account and progress straight away. It cannot be undone. Limited payment verification records and support correspondence may remain, as described above.
- Sign out at any time. Your device goes back to its own offline save.
- Email us to see or correct anything we hold, or with any question. We aim to reply within 30 days.
- If you are not happy with our answer, you can contact the Office of the Privacy Commissioner of Canada or the Office of the Information and Privacy Commissioner for British Columbia.
Players under 13, and parents
Players under 13 can enjoy the whole game offline, but can't make an online account. If we learn that an account belongs to someone under 13, we delete it. Parents and guardians can email us to ask what we hold about their child, or to have it deleted. We don't need your child's name to find the account: the player name shown in the game is enough.
Keeping information safe
Everything travels over encrypted connections (HTTPS). Google account numbers and sign-in sessions are stored only in scrambled form. Only the studio can reach the server, and we keep as little as we can, because information we don't have can't leak.
Changes
If this policy changes, we'll update the date at the top. If a change affects what we keep about you, the game will tell you before it applies.