Privacy Policy

Last updated: October 12, 2026

This policy explains what Vinci Brain does with your personal information. It is information for you: you do not have to accept it. Version française : vincibrain.com/fr/privacy/ (or set the app language to French in Settings).

1. Who is responsible for your data

Vinci Brain is made by one independent developer, Arnaud Bastin, based in Quebec (Canada), referred to below as “we”.

Address: 2100 avenue Papineau, apt. 307, Montreal (Quebec) H2K 4J4, Canada
Email: [email protected]
Phone: +1 438 365 5607

Arnaud Bastin is also the person in charge of the protection of personal information (Quebec Law 25) and our contact for data protection in Brazil (encarregado, LGPD). Our governance policy for personal information is published at vincibrain.com/privacy-governance/.

2. Where this policy applies

Vinci Brain is available worldwide. This policy applies to every user, wherever they live. Section 10 adds the rights that specific laws give you depending on where you live (Quebec and Canada, European Union and EEA, United Kingdom, Switzerland, United States, Brazil). If the law of your country gives you more rights than this policy describes, you keep them.

3. Data we collect

Your account

Email address: for registered accounts (Google or Apple sign-in). With Apple, it can be a private relay address created by Apple.
Google sign-in: our authentication provider also stores the name and profile photo of your Google account. The app shows that photo as your profile picture.
Apple sign-in: we request your email address only, never your name.
Account identifiers: a random identifier assigned to your account and, if you sign in with Google or Apple, the identifier of your Google or Apple account.
Display name (pseudo): the name you choose so the app can address you. It does not need to be your real name and is not shown to other users.
Guest mode: when you play without signing up, we create an anonymous account with a random identifier, after the age check (section 9).

Your learning

Quiz and learning sessions, the answers you give, your progress per question (used to schedule reviews), your streak and daily activity, and the themes you choose.

Purchases

Our purchase provider receives, for every user, your account identifier (or a random identifier for guests) and device information (model, operating system, language, store country, and on iPhone an identifier your iPhone assigns to our apps, not the advertising identifier), so the app can check whether you have Premium.
If you buy Premium: your entitlement (type and end date) and the purchase records sent by the App Store or Google Play (transaction identifiers, product, dates). We never see your payment details.

Technical data

Sign-in sessions: our authentication provider records, for each session, the IP address and a description of your device and app (user agent) used to sign in.
Time zone: sent to our server so your day and your streak follow your local time. It is not stored.
Diagnostics: app sessions, performance data and crash reports (device model, operating system, app version, a random installation identifier, the error itself). We do not attach your name, email or account identifier to them (identifiers that appear in an error are masked before sending), and your IP address is not stored.
App updates: at each launch, the app asks our app update provider whether a fix is available. The request contains the app version, the installed fix number, the platform and processor type, and a random installation identifier created by the app. It is not linked to your account and changes if you reinstall the app. The provider sees your IP address when the request is made.

If you turn on “Analytics tracking” (offered from age 16, see section 9), the app sends events about how you use it (screens viewed, features used) with device information (model, operating system, language, screen size, network type). For a registered account, they are linked to your account identifier. For a guest, they are linked to a random identifier created by the analytics tool. The IP address is discarded on reception.

Anonymous onboarding statistics

During onboarding, the app counts which steps are completed (for example “age check passed”, “reminder chosen”), with no identifier and with the time rounded to the hour. If you delete your account, the reason you choose in the farewell survey is recorded the same way, with no identifier. Nothing is sent before the age check passes.

What stays on your device

Your age: the app asks your birth month and year to check the minimum age. It never stores them and never sends them. It keeps on your device only the date until which access stays refused (if you are under 14) and the date from which analytics can be offered (16). Uninstalling the app clears them.
Store age signal: where Apple or Google Play provides your age range, the app uses it only to apply our age rules. It is never sent. The app keeps on your device a few settings derived from it, removed when you uninstall the app.
Your preferences, your daily reminder (a local notification scheduled on your device) and the questions downloaded for offline play.

What we do not collect

No location, no contacts, no photos from your device, no advertising identifier. Vinci Brain contains no advertising and does not track you across other apps or websites.

4. Why we use your data, and on what basis

Provide the app (account, guest mode, progress, reviews, streak, sign-in sessions): necessary to provide the service you ask for (performance of a contract).
Manage Premium (entitlement, purchase records): performance of a contract.
Keep the app working (diagnostics, crash reports, app update checks): our legitimate interest in fixing errors. This data contains no direct identifier. Diagnostics are deleted after 30 days; app update checks are kept as described in section 7. On a first launch, the diagnostics and the app update check are the only data sent before the age check.
Improve the app (usage statistics): your consent, which you can withdraw at any time in Settings.
Count onboarding steps: anonymous statistics with no identifier.

Apart from the age check (section 9), we make no automated decisions about you, and we do not profile you.

Under Quebec Law 25 and PIPEDA, we use your information only for these purposes. We ask your consent for anything that is not necessary to provide the service.

5. Who receives your data

We do not sell your personal information and do not share it for advertising. The following providers process it on our behalf, under contracts that require them to protect it at least as well as this policy does:

Hosting and authentication provider: database and sign-in. Servers in Germany (European Union).
Diagnostics provider: diagnostics and crash reports. Servers in Germany (European Union).
Usage statistics provider: usage statistics, only with your consent. Servers in Germany (European Union).
Purchase provider: checking and managing Premium purchases. Data processed in the United States.
App update provider: delivering fixes to the app between store updates. Data processed in the United States.

We give the names of our providers on request ([email protected]).

Apple and Google act as independent controllers when you sign in with their account or buy through their store: their own privacy policies apply to that part.

Emails you send us are handled by our email service providers, in the United States, under their own terms.

6. Transfers outside Quebec and outside your country

Your information is processed outside Quebec, mainly in the European Union, and in the United States by our purchase provider, our app update provider and for the emails you send us. The providers of section 5 are companies established in the United States. Their data processing agreements include the European Commission’s standard contractual clauses for transfers out of the EU; you can ask us for a copy. We assessed each of these transfers as required by Quebec Law 25 (privacy impact assessment).

7. How long we keep your data

Account, learning data, display name, sign-in sessions: as long as your account exists. Deleted immediately when you delete your account.
Guest account: as long as it exists, deletable in Settings in the same way. If you sign in to an existing account from guest mode, your guest progress is moved into that account and the guest account is deleted at the same moment. A guest account cannot be recovered after you uninstall the app: delete it in Settings first, otherwise it stays on our servers.
Premium entitlement and purchase provider record: as long as your account exists, deleted with a registered account. For a guest, the purchase provider’s random identifier is not deleted with the guest account; it is linked to nothing else.
Usage statistics: kept 1 year, then deleted automatically. For a registered account, also deleted when you delete the account (the provider completes the deletion within a few days). For a guest, they are not linked to the account and expire after 1 year.
Diagnostics: deleted automatically after 30 days.
App update checks: the installation identifier is used by the app update provider to count active installations. It is linked to nothing else, and the app forgets it when you uninstall it. The provider keeps it for as long as we use its service and deletes it when our contract ends at the latest. The IP addresses in the provider’s request logs are deleted after 90 days at most.
Technical logs of our hosting provider, including sign-in logs (they can include IP addresses): deleted automatically after 1 day. We keep no backups of the database.
Anonymous onboarding statistics: contain no personal information, may be kept.
Emails you send us: kept as long as needed to answer, then up to 1 year to show that we handled your request.
Purchase receipts: kept by Apple or Google under their own policies. We do not keep any after your account is deleted.

8. Your rights

You can, at any time:

Access and export your data: Settings → Export my data (JSON file, available to guests too). For the data held by our providers (section 5), write to us.
Correct your data: write to us.
Delete your account and its data: Settings → Delete my account (immediate, guests included), or by email from the address of your account (instructions at vincibrain.com/delete-account/). If you signed in with Apple and hid your email, or use a guest account, delete it in the app.
Withdraw your consent to usage statistics: Settings → Analytics tracking.
Object to processing based on our legitimate interest, or ask us to restrict it.
Lodge a complaint with a data protection authority (section 10).

To exercise a right by email, write to [email protected]. We answer within 30 days. We may ask you to write from the email address of your account to confirm it is yours.

9. Age and children

Vinci Brain is for people aged 14 and over, everywhere in the world. Under 14, the app refuses access and no account is created. On a new installation, nothing is sent before the age check except the diagnostics and the app update check described in section 3 (no direct identifier).
Usage statistics are only offered from 16.
The age question is neutral (no pre-filled answer). If you are refused, the app keeps refusing on that installation until you turn 14, even if you answer again.
If we learn that a person under 14 has an account, we delete it. Write to us at [email protected] if you think it is the case.

10. Rights depending on where you live

Quebec and Canada

Quebec Law 25 and PIPEDA apply. You can complain to the Commission d’accès à l’information du Québec (CAI) or to the Office of the Privacy Commissioner of Canada (OPC).

European Union, EEA, United Kingdom, Switzerland

The GDPR (UK GDPR in the United Kingdom, the Federal Act on Data Protection in Switzerland) gives you the rights of section 8, plus the right to data portability. You can complain to the data protection authority of your country (in the United Kingdom, the ICO; in Switzerland, the FDPIC).

United States

We do not sell or share your personal information and do not use it for targeted advertising. The rights of section 8 apply wherever you live in the United States.

Brazil

The LGPD gives you the rights of section 8, including confirmation that we process your data. You can complain to the ANPD.

Other countries

The rights of section 8 apply to every user.

11. Security and incidents

Data is encrypted in transit. Access to the database is restricted by per-user access rules, so that each account can only reach its own data. No system is infallible. If an incident creates a risk of serious harm, we notify the competent authorities and the people concerned, as the law requires. We keep a register of incidents.

12. Changes

When we change this policy, we update the date above and publish the new version in the app and at vincibrain.com/privacy/. If a change requires your consent, we ask for it before applying the change.

13. Contact

For any question about this policy or your data: [email protected]