Privacy Policy

Last updated: August 23, 2026

1. Who is responsible for your data

Vinci Brain is operated by Arnaud Bastin, an independent developer based in Quebec (Canada) — referred to below as “we” or “the controller”.

The person responsible for the protection of personal information is Arnaud Bastin. For any question about your personal information, you can reach him at: [email protected]

2. Applicable legal framework

Vinci Brain is available in Canada and the European Union. We process your data in accordance with:

Law 25 (protection of personal information in Quebec) and PIPEDA (Canada);
the GDPR (European Union), for users located in the EU.

3. Data we collect

Data you provide

Email address — for registered accounts, including via Google or Apple sign-in.
Display name (pseudo) — the name you choose so the app can address you. This is not your legal name.
Preferences — such as language.
Age — asked at first launch (onboarding) only to verify that you are 13 or older. We do not store it.

Data generated by your use

User identifier — an account identifier (uid) assigned to your account.
Quiz sessions and progress — for all users, including guest/anonymous users.
Purchase history — if you subscribe.
Interaction events and usage statistics — only if you enable analytics tracking.
Diagnostics and crash reports — device technical information.
Onboarding funnel — anonymously, for internal analytics.

4. Purposes and legal bases

We use your data for the following purposes:

Create and manage your account, personalize your experience (email, display name, preferences) — basis: performance of contract.
Provide core features before account creation (guest progress) — basis: legitimate interest.
Manage your subscription and premium access (purchase history) — basis: performance of contract.
Improve the app (usage analytics) — basis: your consent.
Ensure stability and fix errors (diagnostics, crashes) — basis: legitimate interest.

Under Law 25 and PIPEDA, these activities rely on your consent, except where they are necessary to provide the service you requested.

Vinci Brain contains no advertising. We do not use an advertising identifier and do not track you for targeted-advertising purposes.

We do not sell or share your personal data for advertising purposes. We rely on providers that process data on our behalf:

Supabase, Inc. — database hosting and authentication (servers located in the EU).
RevenueCat, Inc. — subscription and purchase management.
PostHog, Inc. — usage analytics (EU servers, only with your consent).
Sentry, Inc. — diagnostics and crash reports.
Google / Apple — if you choose to sign in via their service (authentication); they then act as independent controllers for that sign-in operation.

6. International data transfers

Your data is hosted on servers located in the European Union (Supabase; PostHog where possible). Some processors are, however, companies established outside the EU and outside Quebec (RevenueCat, Sentry, as well as Supabase as a US company) that may access the data or process it outside Quebec and the EU, notably in the United States. These transfers are protected by appropriate safeguards, in particular standard contractual clauses.

7. Data retention

Account and progress: retained as long as your account is active.
Guest/anonymous data: retained as long as the anonymous session exists; deletable at any time in Settings.
Purchase history: retained as long as necessary to manage the subscription and meet our accounting obligations.
Age: not retained.
Truly anonymized and aggregated data: may be retained indefinitely for improvement purposes; it cannot be linked back to you. (Analytics data, by contrast, remains pseudonymous and is deleted or de-linked when the account is deleted.)
Account deletion: when you delete your account, the associated personal data (email, preferences, progress) is permanently deleted, except for items we must retain for legal or accounting obligations (e.g. certain purchase-history records).

8. Your rights

You have the following rights, under both the GDPR and Law 25 / PIPEDA:

Access to your personal information.
Rectification of your data.
Erasure: delete your account and all associated data — available to all users, including guests, directly in Settings.
Portability: export your data in JSON format — available directly in Settings.
Restriction of processing and objection to certain processing, in particular processing based on legitimate interest.
Withdraw consent to analytics tracking, at any time in Settings.
Lodge a complaint: with the Commission d’accès à l’information du Québec (CAI) or the Office of the Privacy Commissioner of Canada (OPC); or, for EU residents, with the data protection authority of your country of residence.

9. Children

Vinci Brain is intended for people aged 13 and over. We do not knowingly collect information from children under 13. If you believe a child has provided us with data, contact us at [email protected] so we can delete it.

In the European Union and EEA, the digital age of consent varies by country (between 13 and 16). If you have not reached the applicable age in your country, you must obtain the consent of a parent or guardian before agreeing to analytics tracking.

10. California Residents (CCPA/CPRA)

If you are a California resident, California law (CCPA/CPRA) grants you specific rights:

Know which categories of personal information we collect and for what purposes (see §3 and §4).
Delete and correct your personal information (see §8).
Opt out of the “sale” or “sharing” of your data: we do not sell or share your personal data, in particular for cross-context behavioral advertising.
Non-discrimination: we will not discriminate against you for exercising your rights.

To exercise these rights, contact us at [email protected].

11. Security

We apply reasonable measures to protect your data (encryption in transit, restricted access). No system, however, is completely infallible. In the event of a confidentiality incident presenting a risk of serious injury, we will notify the competent authority (the CAI) and the affected individuals, as required by law.

12. Changes

We may update this policy. Significant changes will be notified to you in the app.

13. Contact

For any question about this policy: [email protected]