Privacy Policy

The controller responsible for processing personal data in the Lets Brain app and on this website is:

If you have questions about data protection or want to exercise your rights, you can reach us at any time using these contact details.

This privacy policy applies to the Lets Brain app for iPhone, iPad and Android and to this website. In older versions, in the Firebase project and in some store listings, the app still bears its former name MagDenken or Magister Denken; it is the same app.

The services of Apple (App Store, Game Center) and Google (Google Play, Play Games) are additionally subject to their own privacy policies, over which we have no control.

This website is purely informational. It has no user accounts, contact forms, cookies, analytics or tracking services. Fonts and images are loaded from our own server; no third-party content is embedded.

Hosting and server logs

The website is provided via AWS Amplify Hosting by Amazon Web Services EMEA SARL, 38 Avenue John F. Kennedy, L-1855 Luxembourg, and delivered through the Amazon CloudFront network. Whenever a page is requested, AWS processes technically necessary data:

• IP address of the requesting device
• date and time of access
• requested address (URL) and amount of data transferred
• status code of the response
• browser type and version, operating system (user agent)
• previously visited page (referrer), if your browser sends it

This data is needed to deliver the site, to ensure its stability and security and to fend off attacks. This is our legitimate interest. We do not combine it with other data and only analyse access logs when there is a reason to, such as malfunctions or attacks. AWS acts as our processor under a data processing agreement. Because CloudFront caches content worldwide, processing may also take place outside the EU (see section 11).

Links to the App Store and Google Play

The store buttons are simple links. Only when you click them are you taken to Apple or Google; from then on, their privacy policies apply.

Lets Brain can be played completely offline and without an account. The app stores the following data exclusively on your device; it is not transmitted to us:

• game progress: rank, XP, stars, best scores, level progress, solved brainteasers, achievements, streaks, missions and history
• settings such as language, sounds, vibration, “Reduce motion”, color-blind mode, favorites
• your age, if you choose to enter it, so that “Next brainteaser” starts on the right shelf
• for online features, your age group and country of residence to check the age limit, as well as your choices regarding sign-in and permissions

You can correct your age group and country of residence under Settings → Online account → Change age and country of residence. You can delete your local progress under Settings → Reset progress. Removing the app also removes the app data stored on the device. Any device backups (e.g. iCloud or Android backup) depend on your device settings.

QR codes for joining a room are generated directly on the device.

Online games with friends and the leaderboards are optional. Before using them, you choose your age group and country of residence in the app and tap Agree and start. With this single consent you

• sign in via Apple Game Center (iOS) or Google Play Games (Android),
• enable online games and participation in the leaderboards, and
• turn on automatic sign-in when the app starts.

Online features are available from age 14 if you live in Austria, and from age 16 in Germany, in other countries or if no country is given.

What data is processed

After a successful sign-in, Firebase Authentication links your Game Center or Play Games ID to an internal Lets Brain account ID. In our database we store:

• your player name from Game Center or Play Games
• the internal Firebase account ID and your Game Center or Play Games player ID
• the platform (iOS or Android)
• the time you were last online

We need this data to recognise you and to provide you with multiplayer games and leaderboards. During sign-in, Firebase also processes your IP address to protect against abuse. The Firebase SDKs transmit technical information such as device type, operating system and SDK version, which according to Google is not linked to you as a person.

We do not collect email addresses, phone numbers, advertising IDs for the online account. Your Apple or Google account itself stays with Apple or Google.

Legal basis

Use of the online features and visibility in leaderboards are based on your consent (Art. 6(1)(a) GDPR). Processing that is necessary to operate the online features you have chosen is additionally based on Art. 6(1)(b) GDPR. Processing IP addresses to prevent abuse is based on our legitimate interest in secure operation (Art. 6(1)(f) GDPR).

Signing out and withdrawing consent

Under Settings → Online account you can withdraw your consent at any time with effect for the future and sign out. Sign out ends the session and turns off automatic sign-in on this device until you sign in again yourself. Existing leaderboard entries remain when you sign out; to find out how to remove them, see section 8 and section 13.

When you open or join a room, we store:

• the room code and the account IDs of the host and the participants
• player names, platform and player ID of the participants
• the selected game and its settings (e.g. duration, starting difficulty, word language, random seed so everyone gets the same tasks)
• join times, ready status, timestamps and a heartbeat from the host
• results such as points, stars, duration and whether a round was given up
• for party games and duels, the moves, drawings (strokes), guesses and hidden votes, each with account ID and server time

Everyone in the room can see the other participants’ player names, platforms, moves and results.

Public rooms

New rooms are private. If the host turns on Public room, the room is shown to all signed-in players under “Public rooms” – with the host’s player name as the room name, the selected game and the number of players.

Storage locations

Room data is stored in Cloud Firestore in Frankfurt am Main, Germany. Live data of ongoing rounds (moves, party game actions, drawings, presence) is exchanged via the Firebase Realtime Database in Belgium. The app deletes this live data when the next round starts or when the last person leaves the room; leftover data is removed from 25 hours after it was created. Rooms and their member entries expire after 24 hours. Automatic deletion after expiry may take some time.

In fast-paced online duels such as Ping-Pong, Air Hockey and Light Snakes, the app tries to establish a direct connection between the two phones (WebRTC) so that ball, puck and paddles are transmitted without delay. Only game state such as positions and hits is sent over this connection.

To set up the connection, the two devices exchange technical connection details via the round’s live channel. In the process, the other player’s device learns your public and, where applicable, local IP address. To determine its own public address, the app also queries a Google STUN server (stun.l.google.com), which sees your IP address. If no direct connection can be established, the duel runs through our server as before.

We use the direct connection because it is required for smooth real-time duels (Art. 6(1)(b) GDPR) and significantly reduces server load and latency (Art. 6(1)(f) GDPR). The connection details are not stored permanently.

With your consent you take part in the leaderboards – worldwide and per country, for each game and overall, all time and weekly. For each entry we store:

• Firebase account ID, player name and platform
• country as a country code – from your device’s region setting or your choice in the app; the app does not use location services for this
• best scores (points or level and level stars) and XP
• the time of your last improvement

If you already have best scores on your device, the app may upload them when you sign in. Only results achieved without hints count.

You can turn off participation under Settings → Online account → Play online and appear on leaderboards. The app then stops uploading best scores, online games are paused until you enable them again, and your existing entries are deleted as soon as your account is online. You can keep playing offline as usual.

You download Lets Brain from Apple’s App Store or from Google Play. Apple and Google process data such as your account and the download under their own responsibility. From the stores we only receive aggregated statistics and crash reports that cannot be traced back to you, insofar as you have agreed to share with developers on your device.

After you have played for a while, the app may show the operating system’s rating prompt once. Whether it appears is decided by Apple or Google. Your rating goes directly to the respective store; we only see the rating published there.

Links in the app, for example to this privacy policy, open in your browser or the corresponding app.

We do not sell data and do not share it for advertising purposes. The only recipients are:

More about Firebase: Privacy and security in Firebase · Firebase data processing terms · Apple privacy · Google privacy · AWS privacy

According to Google, Firebase Authentication processes sign-in data exclusively in data centres in the USA. Google Analytics for Firebase, Google’s STUN server and the AWS CloudFront network may also process data outside the EU. We base these transfers on

• the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR), under which Google LLC and Amazon.com, Inc. are certified, and
• the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which form part of Google’s and AWS’s data processing terms.

We store profile, room and leaderboard data within the EU (Frankfurt am Main and Belgium). Data is always transmitted in encrypted form.

In the app

Open Settings → Online account → Delete online data. The app leaves any open rooms, deletes your online profile, all your leaderboard entries and your Firebase account, and signs you out. The app will not create a new account on its own afterwards. Game Center or Play Games may ask you to sign in again for the deletion. Your Apple or Google account and your local game progress remain. Room data that cannot be removed immediately expires with the room; security data held by Google is subject to the periods in section 12.

Without the app

If you no longer have access to the app, request deletion by email. Please state your player name and whether you used Game Center or Google Play Games. If we need further details to identify you securely, we will get in touch.

Deleting leaderboard entries only

Turn off “Play online and appear on leaderboards” under Settings → Online account (this also pauses online games) – or request deletion by email and let us know that your online account should be kept. On request and after verification, we also remove entries from earlier app versions that cannot be matched to an account on your device.

Lets Brain is suitable for all ages. Offline – and therefore without any transfer of personal data – children can also use all games. Online features and leaderboards are only available from age 14 (residents of Austria) or 16; this corresponds to the age from which young people can give consent themselves under Section 4(4) of the Austrian Data Protection Act (DSG) and Art. 8 GDPR. Age group and country of residence stay on the device.

If you are a parent and find that your child has nevertheless transmitted online data, please contact us – we will delete the data immediately.

All connections between the app, the website and the servers are encrypted (TLS). Security rules restrict database access so that each account can only change its own data and only read the data of others that is needed for the game. Direct duel connections (WebRTC) are encrypted as well (DTLS). Only authorised persons have access to the administration consoles.

Under the GDPR – in each case subject to the statutory requirements – you have the right to

• access the data we process about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests (Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR) – in the app under Settings → Online account or, for statistics, under Profile → Settings → Share usage statistics.

To do so, contact office@c2cagent.com. If you believe that the processing of your data violates data protection law, you can lodge a complaint with a supervisory authority. In Austria, this is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb@dsb.gv.at. You can also contact the supervisory authority in your country of residence.

Providing data is neither a legal nor a contractual requirement. Without online data, you simply cannot use the online features. There is no automated decision-making, including profiling; the “brain profile” in the app is calculated exclusively on your device from your game results.

In app versions with the switch Profile → Settings → Share usage statistics, you can opt in to usage statistics on Android and iOS. The switch is off by default. This choice is separate from your online account and leaderboard participation. It is available from age 14 if you live in Austria and from age 16 elsewhere. The app checks the age group and country of residence saved on your device. You can review and correct those details in the settings.

We use Google Analytics for Firebase to understand how people use the app and which games they complete. Google processes usage events such as session start and duration, the game identifier for a completed round, a randomly generated app instance identifier and technical details such as the app version, operating system and device model. At collection, Google can derive a coarse location from the IP address, such as the country, region or city. Google says Analytics then discards the IP address. The game identifier refers to the game played. Player names, account IDs, scores and age details are excluded from these statistics. The app keeps advertising features of the analytics service switched off.

The legal basis is your consent under Art. 6(1)(a) GDPR and Section 165(3) of the Austrian Telecommunications Act 2021. You can withdraw your consent for the future at any time using the same switch. The app then stops collection and clears local data held by the analytics service. The periods in section 12 apply to individual records already sent. Aggregated standard reports are exempt from those periods. Contact office@c2cagent.com for enquiries about usage statistics.

Regional data collection at Google · Google Analytics data retention · Data processing terms for Google Analytics

We update this privacy policy when the app, this website or the legal situation changes. The version published here applies. Last updated: 9 November 2026.