Privacy Policy

This privacy policy provides you with detailed and transparent information in accordance with the legal requirements of the General Data Protection Regulation (GDPR) about the type, scope, and purpose of the processing of personal data within our mobile application "BrainCell" and our website braincell.me. We also explain your rights in relation to the processing of your data.

1. Data controller

Data controller within the meaning of the GDPR:

2. Types of data collected and purpose of processing

2.1 Account registration and authentication

When you register for a user account, we collect your email address and a password of your choice in order to set up your account and to uniquely authenticate you when you use the app. The legal basis for this is Art. 6 (1) lit. b GDPR (performance of a contract).

2.2 Learning and usage data

To optimize the learning functions of our app, we store and process data about your learning progress, such as answer history, flashcards used, ratings, and timestamps. This enables us to offer you personalized learning recommendations and optimized repetition intervals. The processing is based on our legitimate interest pursuant to Art. 6 para. 1 lit. f GDPR.

2.3 Device and telemetry data

In order to prevent fraud and to deliver push notifications, we collect data about your device (device ID, operating system version, push token). The legal basis is also Art. 6 para. 1 lit. f GDPR.

2.4 Payment processing

Payments for premium subscriptions are processed exclusively via the Apple and Google app stores. We do not process payment data directly, but only receive transaction information for verification purposes. The legal basis is Art. 6 (1) lit. b GDPR.

3. Use of external services and service providers

3.1 Supabase (data storage)

We use the Supabase service, hosted within the EU, to store your data securely. Data is transmitted using TLS encryption and stored in accordance with modern security standards. Supabase processes data exclusively on behalf of and on the basis of a data processing agreement in accordance with Art. 28 GDPR.

3.2 WishKit (feedback management)

We use WishKit to receive feedback and feature suggestions. Only data that you voluntarily provide via the feedback form and anonymized usage statistics are processed. The basis for this is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

3.3 External AI service provider

We use an external AI service for the AI-based creation of index cards. This involves processing the text you enter (prompts) and the generated results. The service provider has been carefully selected, meets the requirements of the GDPR, and processes data either within the EU, on the basis of standard contractual clauses, or under the EU-US Data Privacy Framework. The legal basis is Art. 6 para. 1 lit. b GDPR.

3.4 Website Analytics (Umami)

For the statistical analysis of our website, we use Umami, a self-hosted, privacy-friendly analytics software. Umami does not set any cookies, does not store IP addresses, and does not collect any personal data. Only anonymized usage statistics are collected (e.g., page views, time spent, country of origin). All data is processed on our own servers within the EU. The legal basis is our legitimate interest pursuant to Art. 6 (1) lit. f GDPR.

3.5 Cookies

Our website does not use any cookies. No cookies or similar technologies are used for analytics, marketing, or tracking purposes. A cookie banner is therefore not required.

4. No disclosure or sale of personal data

We do not sell personal data to third parties. Data is only disclosed to the external service providers mentioned above if this is necessary for the fulfillment of the contract, for the fulfillment of legal obligations or on the basis of legitimate interests.

5. Storage period and deletion

Personal data will be deleted as soon as the purpose of processing no longer applies or you delete your user account. This does not apply to data for which statutory retention periods exist (e.g., commercial or tax law requirements).

6. Data security

To protect your personal data from loss, destruction, or unauthorized access, we use technical and organizational measures in accordance with current security standards. Data transfers are exclusively encrypted (TLS), and stored data is hashed or encrypted according to established procedures.

7. Your rights as a data subject

You have the right at any time to:

• Information pursuant to Art. 15 GDPR
• Rectification pursuant to Art. 16 GDPR
• Erasure pursuant to Art. 17 GDPR
• Restriction of processing pursuant to Art. 18 GDPR
• Data portability pursuant to Art. 20 GDPR
• Objection to processing pursuant to Art. 21 GDPR

To exercise your rights, please contact privacy@braincell.me.

You also have the right to lodge a complaint with a data protection supervisory authority. The Hessian Commissioner for Data Protection and Freedom of Information is responsible for this.

8. Changes to this privacy policy

We reserve the right to update this privacy policy as necessary, for example if we change our services or to comply with new legal requirements. You can view the current version at any time in the app under "Privacy" or on our website.

9. Publication in accordance with app store guidelines

This privacy policy is clearly published in accordance with Apple and Google guidelines, both in the app and in the store listings, in order to comply with all relevant guidelines.