Privacy Policy

Last updated: September 19, 2026

Battle of Brains ("we", "us", "our") is a real-time trivia battle platform. This policy explains what we collect, why, and the choices you have, and it works alongside our Terms of Use. We collect as little as we can to run the game.

The short version

This plain-language summary is here to help — the full policy below is what governs.

You can join a battle with just a room code — no account, and no personal data needed.
We collect the minimum to run the game: your email and a hashed password if you register, your battles and scores, and your purchases.
We never sell your data, run no third-party ad networks, and don't follow you across other sites.
Payments go through Paddle or PayPal — we never see or store your card details.
Optional analytics — anonymous usage counters and Microsoft Clarity session recordings — only run if you choose “Accept all”. “Essentials only” never blocks a feature.
You can view, correct or delete your data anytime from your profile.

What we collect
How we use your data
Why we're allowed to use it
What we don't do
Cookies and local storage
Who we share data with
Where your data is processed
Emails
How long we keep data
Your rights
Security
Children
Changes to this policy
Contact

1. What we collect

Account data — your email address and a securely hashed password when you register. We never store your password in plain text.
Optional profile details — a contact number, birthday, and gender, only if you choose to share them. Your birthday can be set once and is used for a yearly birthday greeting (sometimes with a gift code); your gender is used only in anonymous, aggregate statistics. You can leave all of these empty.
Game data — battles you create or host, team names entered during play, scores, and results.
Billing data — your purchases and subscription status. Payments are processed by Paddle, our merchant of record; we never see or store your card details.
Things you send us — contact messages, question reports, reviews and survey answers.
Anonymous usage counters — if you accept cookies, we count things like announcement views and button clicks. These counters carry no name, email, or identifier that points back to you.
Session recordings (Microsoft Clarity) — only if you choose “Accept all”: how our pages are used (the pages you visit, clicks, scrolling and mouse movement), so we can see what confuses people and fix it. It masks what you type into forms, and it never runs on game screens (host, team and display) or battle results.

2. How we use your data

We use what we collect only to run and improve the game:

to create and secure your account and sign you in;
to run the battles you host or join, and show scores and results;
to process purchases, subscriptions and refunds through Paddle or PayPal, and send your receipts;
to send the account emails you need — verification, password resets, renewal reminders and payment notices;
to keep the service safe by preventing fraud, abuse and bots;
to understand, in aggregate and anonymously, what's working so we can improve.

3. Why we're allowed to use it

Depending on the data, we rely on: performing our agreement with you (running your account and battles), your consent (optional analytics cookies and product emails, which you can withdraw anytime), and our legitimate interest in keeping the service secure and making it better. We handle personal data in line with the Personal Data Protection Law of the Kingdom of Bahrain.

4. What we don't do

We don't sell your data — to anyone, ever.
We don't run third-party advertising or tracking networks.
We don't profile visitors or follow you across other websites.
We don't make decisions about you by automated means alone.

5. Cookies and local storage

Essential (always on): a secure httpOnly sign-in cookie, your language and theme, sound settings, announcements you dismissed, a random id that keeps a team phone on its team, and your cookie choice itself. Optional (only after “Accept all”): the anonymous usage counters and Microsoft Clarity, which sets its own cookies to tell one visit from the next. “Essentials only” keeps every feature working, and you can change your choice at any time from Cookie settings at the bottom of every page. Sign-up, sign-in, and the contact form use Cloudflare Turnstile to block bots; Cloudflare runs this check under its own privacy policy.

6. Who we share data with

We don't sell or rent your data. We share the minimum needed with trusted providers who process it on our behalf, each under their own terms:

Paddle — payments, billing and receipts, as our merchant of record.
PayPal — one-off game pack purchases, when you choose to pay with PayPal.
Google — only if you choose “Continue with Google”: we receive your name and email address to create your account or sign you in.
Cloudflare Turnstile — bot protection on sign-up, sign-in and the contact form.
Microsoft Clarity — usage analytics and session recordings, only if you choose “Accept all”.
Our email provider — delivering account and billing emails.
Our hosting and infrastructure providers — running the website and game servers.

We may also disclose data if the law requires it, or to protect the rights and safety of our users and the service.

People in your game. Battles are social by design: team names, scores and answers are visible to everyone taking part, and the battle's shared big screen opens through a special display link that works without signing in — anyone holding that link can watch the battle screen (team names, scores, questions and results as they are revealed). The display never shows account details or players' personal data, and only the host can produce its link, so hosts should share it only where they're happy for the game to be watched.

7. Where your data is processed

We're based in the Kingdom of Bahrain, but some of our providers — such as payment, bot-protection and email services — process data on servers in other countries. Where data moves across borders, we rely on providers that commit to appropriate safeguards for it.

8. Emails

We send the emails your account needs: verification, password resets, purchase receipts, payment-failure notices, and a reminder shortly before your subscription period ends (since access stops the moment it does). Occasional product emails can be switched off from your profile at any time.

Marketing emails. With your consent (you can opt in at signup), we may email you product news and special offers. Every marketing email includes an unsubscribe link and you can opt out at any time — this never affects important account or transactional emails. We do not sell your email address.

9. How long we keep data

Account and game data is kept while your account is active. A live battle left with no connected devices for an extended period (currently 24 hours) is ended automatically; its team names and scores remain part of your battle history like any finished battle. Anonymous usage counters are deleted after 180 days. If you delete your account, your personal data is removed from active use, except where we must keep limited records (for example a billing record) to meet a legal or accounting obligation.

10. Your rights

You're in control of your data. You can:

See and update your account details from your profile;
Delete your account — and your personal data with it — from the profile page at any time;
Ask for a copy of your data, or for a correction;
Withdraw consent for optional cookies or product emails, without losing any core feature;
Object or complain — contact us first, and you may also raise a concern with the Personal Data Protection Authority in Bahrain.

We respond to requests promptly.

11. Security

Passwords are hashed, connections are encrypted in transit, and admin access to systems is role-restricted and audited. No system is perfectly secure, but if a breach ever affects your data, we'll act quickly and notify you and the relevant authority where the law requires.

12. Children

Battle of Brains is designed for social play in families, schools and gatherings. Players joining a battle with a room code don't need an account and don't give us personal data. The game is intended for players aged 8 and up: creating an account requires that you are at least 8 years old, and younger children take part through a parent's or guardian's account. Purchases require that you are at least 18; a parent or guardian makes purchases on behalf of younger players.

13. Changes to this policy

If we change this policy, we'll update this page and the date at the top. Material changes will be announced on the site.

14. Contact

Questions about privacy? Reach us through the contact page and we'll get back to you.