Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) for the app “Anti Brainrot: Mental Math” (the “app”) and this website is:

Jasper Slowik
[ADDRESS]
Email: jasper.slowik@icloud.com

We have not appointed a data protection officer because we are not legally required to do so. You can reach us with any privacy question at the email address above.

2. This website

Hosting. This website is hosted on Cloudflare Pages, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (“Cloudflare”). When you open a page, your browser necessarily transmits technical data such as your IP address, the date and time of the request, the requested page, the referrer and your browser’s user agent. Cloudflare processes this data on our behalf to deliver the website and to protect it against attacks. The legal basis is our legitimate interest in a secure and reliable website (Art. 6(1)(f) GDPR). Cloudflare stores log data according to its own policies (Cloudflare privacy policy). Cloudflare is certified under the EU-U.S. Data Privacy Framework, on which transfers to the USA are based (Art. 45 GDPR); we have also concluded a data processing agreement with Cloudflare.

No cookies, no tracking. The website itself sets no cookies, uses no analytics or tracking tools and loads no content from third parties. Fonts are served from our own domain. That is why there is no cookie banner.

Email. If you email us, we process your email address and the content of your message to answer your request (Art. 6(1)(b) GDPR for questions about the app or a purchase, otherwise Art. 6(1)(f) GDPR). We delete the correspondence once it is no longer needed, unless statutory retention periods apply.

App Store link. The App Store links take you to Apple’s website, where Apple’s privacy policy applies.

3. The app: no account, data on your device

You can use the app without an account and without signing in. Your game progress (path, XP, level, gems, streak, quests, outfits), your settings and your answers to problems are stored locally on your iPhone (Apple SwiftData) and are shared only with the app’s home-screen widget on the same device. We have no access to this data.

• Export: Profile › Settings › Your data › Export data creates a JSON file that you can save or share yourself.
• Delete: Profile › Settings › Your data › Delete local data removes progress, streak and answers from the iPhone. Deleting the app also removes this data. Deleting does not cancel a subscription.
• Backups: if you use iCloud or computer backups, the app’s data may be included in your device backup. This is governed by your settings and Apple’s terms.

Processing on your device is necessary to provide the app you have requested (Art. 6(1)(b) GDPR; § 25(2) no. 2 TDDDG).

4. Reminders

If you turn on the daily reminder, the app asks iOS for permission to show notifications. Reminders are scheduled as local notifications on your device only. No push service and no server of ours is involved. You can turn reminders off in the app or in the iOS settings at any time.

5. Purchases and subscriptions

Apple. Purchases of “Anti Brainrot Plus” are made through Apple’s App Store. Apple processes payment and billing data as an independent controller under its own privacy policy. We do not receive your name, payment details or Apple ID.

RevenueCat. To check whether your subscription is active and to restore purchases, the app uses RevenueCat, a service of RevenueCat, Inc., 1032 E Brandon Blvd #3003, Brandon, FL 33511, USA (“RevenueCat”), acting as our processor. The following data is processed: a random, anonymous app user ID generated by the app; purchase and transaction data (product, purchase and expiry dates, price and currency, App Store transaction identifiers, storefront country); device and app information (app version, iOS version, device model); and, for the connection, your IP address. The legal basis is the performance of the contract for your subscription (Art. 6(1)(b) GDPR). RevenueCat processes data in the USA. Transfers are based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR), which are part of our data processing agreement with RevenueCat. We store subscription data for as long as you are a customer and delete it afterwards, unless statutory retention obligations under tax and commercial law (up to ten years) require longer storage. More: RevenueCat privacy policy.

6. Usage analytics (only with your consent)

If you agree when asked in the app, or switch on Profile › Settings › Your data › Anonymous usage data, the app sends usage events to PostHog, a service of PostHog Inc., 2261 Market St., #4008, San Francisco, CA 94114, USA (“PostHog”), acting as our processor. Data is stored in PostHog’s EU cloud in Frankfurt, Germany.

What is sent: a random pseudonymous ID, usage events (for example “break started”, “break completed”, “reward shown”, paywall viewed), the app version, device model, iOS version and language. Never sent: names, contact details, your raw answers or any free text. Your IP address is technically transmitted for the connection; we do not use it to identify you.

Purpose: to understand which parts of the app work and to improve it. Legal basis: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). Consent is voluntary; the app works exactly the same without it.

Withdrawal: you can withdraw your consent at any time by switching off “Anonymous usage data” in Settings. This does not affect the lawfulness of processing before the withdrawal. When you switch it off, no further events are sent and events not yet sent are deleted from the device.

Retention: raw events are deleted after 90 days at the latest. Because PostHog Inc. is based in the USA, access from the USA cannot be completely ruled out; such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More: PostHog privacy policy.

7. Crash and error reports

So that we can find and fix crashes, the app sends crash and error reports to Sentry, a service of Functional Software, Inc. (“Sentry”), 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, acting as our processor. Data is stored in Sentry’s EU data region (Germany).

What is sent: stack traces and error messages, device model, iOS version, app version, an anonymous installation ID and the time of the error. Reports contain no personal content such as names, answers or free text.

Legal basis: our legitimate interest in a stable, functioning app (Art. 6(1)(f) GDPR; § 25(2) no. 2 TDDDG). You can object at any time (see section 10). Reports are deleted automatically after 90 days at the latest. Because Functional Software, Inc. is based in the USA, access from the USA cannot be completely ruled out; such transfers are covered by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). More: Sentry privacy policy.

8. Recipients

We do not sell your data and do not share it for advertising. Beyond the services named above (Cloudflare, Apple, RevenueCat, PostHog, Sentry), data is only disclosed if we are legally obliged to do so. We have concluded data processing agreements under Art. 28 GDPR with our processors.

9. Retention

Data on your device stays there until you delete it in the app or delete the app. Analytics events and crash reports are deleted after 90 days at the latest. Subscription data is kept for as long as necessary to manage your subscription and to fulfil statutory retention obligations. Emails are deleted once your request is resolved, unless statutory retention periods apply.

10. Your rights

You have the right to:

• access your personal data (Art. 15 GDPR),
• rectification (Art. 16 GDPR),
• erasure (Art. 17 GDPR),
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR),
• object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR),
• withdraw your consent at any time with effect for the future (Art. 7(3) GDPR),
• lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the EU member state of your habitual residence, place of work or the place of the alleged infringement.

To exercise your rights, email jasper.slowik@icloud.com. Because the app has no accounts, we usually cannot link data held by our service providers to you by name. If your request concerns analytics, crash or subscription data, it helps to tell us roughly when and on which device you used the app, so that we can find the pseudonymous records together with you.

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. You are not obliged to provide any data; without the data needed for purchases, however, a subscription cannot be provided.

11. Children

The app is not directed at children under 13. Where consent is required (usage analytics), users under 16 may only give it with the approval of a parent or guardian (Art. 8 GDPR). If you believe a child has given us personal data without such approval, please contact us and we will delete it.

12. Changes

We will update this privacy policy if the app, the website or the legal situation changes. The current version is always available on this page. If a change requires new consent, the app will ask you for it.

13. Contact

Questions about privacy: jasper.slowik@icloud.com. A German version of this policy is available at Datenschutzerklärung.