Privacy policy

1. Who is responsible

The controller of your personal data on BrainBreak (the “Service”) is:

We have not appointed a data protection officer, as we are not required to. Contact us at the address above about anything in this policy.

2. What we collect and why

Visiting the site (everyone)

When you load a page our hosting provider processes technical data that every browser sends: IP address, browser type, the page requested and the time. We use it to deliver the site, keep it secure and stop abuse (for example, rate limiting).
Legal basis: our legitimate interest in operating a secure website (Art. 6(1)(f) GDPR).

We also count page views and plays per game per day. These are plain totals that are not linked to you or your device. While a game is open, our chat service connects with a random, temporary ID to show how many people are playing; it is not linked to you and is gone when you leave.

Your account (if you sign in)

• Email address: to sign you in with a one-time link and to contact you about your submissions or claims.
• Google, Discord or X sign-in: if you choose it, we receive your email address (when the provider shares it) and profile picture from that provider. The picture is only shown publicly if you choose it as your avatar. We never receive your password.
• Avatar: if you add one on your profile page, it is public and shown next to your chat messages. You can remove it at any time.
• Your activity: games you submit, votes you cast, games you add to your favorites, reports you send and ownership claims you make.
• Studios: the studio name, logo, intro, contact email and links that its members enter, which members it has and their roles, and open invite links. The studio page is public and lists its members’ verified games. Other members of a studio see your chat name (if you picked one), your role and when you joined.
• Chat: the chat name you pick and the messages you post. Messages are public: anyone viewing that game’s chat can read them under your chat name. We use the time of your recent messages to limit how often you can post.

Legal basis: performance of our agreement with you, i.e. the Terms of use (Art. 6(1)(b) GDPR).

Developers who claim a game

If you verify ownership of a game we store the verification method and time. Contact details you add to a game page (email address, website) are published on that page because you ask us to show them. You can remove them at any time.
Legal basis: performance of our agreement with you (Art. 6(1)(b) GDPR).

Moderation and safety

We review submitted games and reports, and may restrict accounts that break our rules. For this we keep the content concerned, our decision and its reasons.
Legal basis: our legitimate interest in keeping the Service safe, and our obligations under the EU Digital Services Act (Art. 6(1)(c) and (f) GDPR).

Analytics

We use Google Analytics to understand how the Service is used: pages viewed, games played, searches and the device and approximate location (country/city) derived from your IP address. We do not use it to identify you.
In the EEA, the UK and Switzerland this happens only with your consent; until then Google Analytics runs without cookies and only receives anonymous, aggregated signals.
Legal basis: your consent (Art. 6(1)(a) GDPR).

Advertising

The Service is free and funded by ads from Google AdSense. With your consent Google and its advertising partners may use cookies and similar identifiers to show personalised ads and measure their performance. If you do not consent, Google may still show non-personalised ads, which are based on the page you are viewing rather than on your browsing history, without advertising cookies.
Legal basis: your consent (Art. 6(1)(a) GDPR) for personalised advertising and ad cookies.

3. Cookies

Visitors in the EEA, the UK and Switzerland are asked for consent through Google’s certified consent management platform (CMP), which lists our advertising partners and lets you accept, reject or customise their use of your data. We set non-essential cookies there only after you agree. The full list is in our cookie policy.

4. Who we share data with

We do not sell your personal data. We use these service providers, who process data on our behalf or as independent controllers:

• Supabase Inc.: database, sign-in and file storage (processor).
• Netlify Inc.: website hosting and delivery (processor).
• Google Ireland Ltd / Google LLC: Google sign-in, Analytics, Tag Manager, AdSense and our consent dialog (processor for Analytics; independent controller for sign-in and advertising).
• Advertising partners: the ad technology vendors listed in the consent dialog, only with consent (independent controllers).
• Meta Platforms Ireland Ltd: Meta Pixel ad measurement, only with consent (joint controller for the collection of data via the Pixel).
• Discord Inc.: Discord sign-in, if you choose it (independent controller).
• X Corp.: X sign-in, if you choose it (independent controller).
• Resend, Inc.: sends sign-in links by email (processor).

We may also disclose data where required by law, for example to a court or authority with a valid request.

Games are third-party websites

Games listed here are made and hosted by independent developers. When you play a game, on its own site or embedded in our player, that developer’s website receives your data directly and processes it under its own privacy policy. We are not responsible for how game websites handle data.

5. Transfers outside the EU

Some providers above are based in, or may access data from, the United States. Where that happens the transfer is protected by the EU-U.S. Data Privacy Framework (for certified companies) or by the European Commission’s Standard Contractual Clauses (Art. 46 GDPR).

6. How long we keep data

• Account data, votes and favorites: while your account exists. You can delete your account yourself on your profile page, which erases it right away, or ask us to and we erase it within 30 days.
• Submitted games: while the game is listed. If you delete your account, games you submitted may stay listed but are no longer linked to you.
• Studios: until an owner deletes the studio. Leaving a studio, or deleting your account, removes your membership. Invite links expire after 7 days. A studio page with no verified games left is no longer shown.
• Chat messages: while your account exists, unless a moderator removes them sooner. A reported message and the conversation around it are kept with the report.
• Reports and moderation records: up to 12 months after the case is closed, or longer if needed to defend legal claims.
• Unfinished ownership claims: expire after 7 days.
• Server logs: kept by our hosting provider for a short period, normally no longer than 30 days.
• Analytics data: 14 months.
• Your cookie choice: 6 months, after which we ask again.

7. Your rights

You have the right to:

• access the personal data we hold about you and get a copy of it;
• have inaccurate data corrected;
• have your data erased (including deleting your account);
• restrict or object to processing based on our legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, which does not affect processing before withdrawal.

To use these rights, email hi@giffi.ee from the address linked to your account. We reply within one month.

You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), www.aki.ee, or to the supervisory authority where you live.

8. Children

Anyone can browse and play games without an account. To create an account you must be at least 16 years old, or have consent from a parent or guardian. If you believe a child under 16 has given us personal data without that consent, contact us and we will delete it.

9. Security

We protect data with encryption in transit (HTTPS), strict access controls, sandboxing of third-party games and regular updates. No system is perfectly secure; if a breach affects your rights we will tell you and the authorities as the GDPR requires.

10. Changes

We may update this policy. The date at the top shows the latest version. If we make significant changes we will tell signed-in users and, where needed, ask for consent again.