Privacy Policy

Brainrot Card Legends — version 1, 30 October 2026. Effective from [À COMPLÉTER : publication date].

In short

• The game does not ask for your email address, a password, your phone number or your name.
• It contains no advertising and no third-party tools (no analytics, no crash reporting, no ad tracking). We do not sell any data.
• Your account is created when you choose a username. What you do online (friends, guilds, messages, matches against other players, online backup of your collection) is stored on our servers, hosted by Cloudflare.
• French law requires us to keep the IP address used to create your account for one year, even if you delete the account sooner.
• You can export your data and delete your account at any time in the game: Settings > Account.

1. Who is responsible for your data

The data controller is:

[À COMPLÉTER : publisher's full name, or company name and legal form]
[À COMPLÉTER : postal address]
Email: [À COMPLÉTER : support email address]

In this policy, "we" means this controller. We answer in French and in English.

We have not appointed a data protection officer: the conditions of Article 37 GDPR are not met. All requests go to the address above.

2. What we process, why, and on what legal basis

The game's online features (username, friends, guilds, messages, matches against other players, online backup) require an account. Here is what is stored on our servers, processing by processing.

2.1 Your account and sign-in

• Data: a randomly generated account identifier; a public key; the account creation date and the date of your last visit; if you enable it, a public key derived from your recovery code; the hash of your session token.
• How it works: when the account is created, your device generates a key pair. The private key stays on your device, in the iOS Keychain (synced by iCloud Keychain if you have turned it on); we only receive the public key, which is used to check that it is really you signing in. There is no password. The optional recovery code is shown to you once and is never stored in clear: we only keep a public key derived from it. The session token is valid for 24 hours and we only keep its hash (SHA-256).
• Why: to create your account, recognise you, and let you recover it on a new device.
• Legal basis: performance of the contract between us (Article 6(1)(b) GDPR).

2.2 The IP address used to create the account

• Data: the IP address used when the account was created, with date and time.
• Why: the law requires a service that hosts content published by its users (a username, a message) to keep the data identifying who created it, and to provide it to a competent judicial or administrative authority on request. We do not use it for any other purpose. [À VÉRIFIER : no other use in the code, e.g. against mass account creation]
• Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR), under Article 6 of French Law No. 2004-575 of 21 June 2004 (LCEN) and Decree No. 2021-1362 of 20 October 2021. [À VÉRIFIER : exact article numbering after Law No. 2024-449 of 21 May 2024]
• Retention: one year from recording, then automatic deletion. This period keeps running if you delete your account: the right to erasure does not apply to data the law requires us to keep (Article 17(3)(b) GDPR).

As with any online service, the IP address of each connection is seen by our host while routing the request and protecting the service. We do not record it in our databases outside the case above. [À VÉRIFIER : technical logs kept by Cloudflare for our account, their content and retention]

2.3 Your username

• Data: the username as you typed it, and a simplified form used to make sure nobody takes a username that is deceptively similar to yours (same letters, different characters).
• Why: to show it to other players and keep it unique.
• Legal basis: performance of the contract (Article 6(1)(b)).
• When you change your username or delete your account: the old username stays reserved for 30 days, so that nobody takes it to impersonate you, then it becomes available again. Legal basis: our legitimate interest in preventing impersonation between players (Article 6(1)(f)).

2.4 Your profile and showcase

• Data: your collection value, your level, the cards you choose to show, your game statistics, your cosmetics.
• Why: to show them to other players, as the game intends.
• Legal basis: performance of the contract (Article 6(1)(b)).

2.5 Your friends, friend requests and blocks

• Data: your friends list, friend requests sent and received, the players you have blocked.
• Why: to run friends and private messages (limited to mutual friends), and to enforce your blocks: a blocked player can no longer write to you or see you in the social features. [À VÉRIFIER : exact effects of blocking, from the code]
• Legal basis: performance of the contract (Article 6(1)(b)); for blocking, also our legitimate interest in protecting players (Article 6(1)(f)).

2.6 Your guilds

• Data: the guild's name and motto, its members, their rank, the guild pot and its transactions.
• Why: to run guilds.
• Legal basis: performance of the contract (Article 6(1)(b)).

2.7 Your messages

• Data: guild messages (read by the guild's members) and private messages (only possible between mutual friends), with their author, recipients and date. A message is at most 300 characters long.
• The filter: when you send a message, an automatic filter rejects it if it contains an insult or contact details (phone number, email address, postal address, etc.). A rejected message is not stored. [À VÉRIFIER : a rejected message is not kept anywhere]
• Who reads them: their recipients. We do not read them, except a message reported to us, in order to moderate it. Messages are encrypted in transit, but not end-to-end: they are stored on our servers.
• Why: to let you write to other players; to protect players, especially younger ones, from insults and from the sharing of contact details.
• Legal basis: performance of the contract for messaging (Article 6(1)(b)); our legitimate interest in protecting players for the filter (Article 6(1)(f)). [À VALIDER PAR L'AVOCAT : legal basis of the filter]
• Retention: 12 months after sending, then automatic deletion.

2.8 Reports and moderation

• Data: when you report a player, a message or a guild: the reason (chosen from a list), the details you write if you wish (at most 500 characters), what is reported, the date, the processing status and the decision. When a report concerns you: the same information.
• Why: to handle reports, take and explain moderation decisions, and let you follow a report and read the statement of reasons for a decision, as required by Articles 16 and 17 of Regulation (EU) 2022/2065 (Digital Services Act, DSA).
• Legal basis: compliance with a legal obligation (Article 6(1)(c)), and our legitimate interest in protecting players (Article 6(1)(f)).
• Who sees them: only us. The reported player is not told who reported them. [À VÉRIFIER : in the code and in the statement of reasons]
• Retention: [À COMPLÉTER : retention period for reports and moderation decisions]. If you delete your account, the reports you filed are kept for moderation, with your identifier replaced by "deleted account"; reports filed against you are kept for moderation.

2.9 Social purse and guild pots

• Data: your social gem purse, your contributions to guild pots and the related transactions.
• Why: to keep these balances reliable: they are decided by the server.
• Legal basis: performance of the contract (Article 6(1)(b)).

2.10 Online matches (Versus)

• Data: your opponents, the result, the move log, invitations, experience earned.
• Why: to organise matches between players, settle their result and credit experience.
• Legal basis: performance of the contract (Article 6(1)(b)).
• Retention: 12 months after the match, then automatic deletion; an expired invitation is deleted.

2.11 Your vault (online backup)

• Data: your collection, your in-game currencies, the log of operations that changed them, your purchases.
• Why: to tie your progress to your account, recover it on a new device, deliver your purchases and prevent cheating (balances are kept by the server).
• Legal basis: performance of the contract (Article 6(1)(b)).
• Purchases: they are made with the App Store or Google Play, which collect the payment. We receive neither your bank card, nor your name, nor your billing address; we only receive what is needed to deliver the purchase and check that it is genuine. [À VÉRIFIER : transaction data actually kept once StoreKit and Google Play Billing are connected]

2.12 Your exchanges with us

• Data: your email address and the content of your messages, when you write to us.
• Why: to answer you and handle your rights requests and reports.
• Legal basis: compliance with a legal obligation for rights requests (Articles 12 to 22 GDPR) and reports (DSA); our legitimate interest in assisting you otherwise (Article 6(1)(f)).
• Retention: [À COMPLÉTER : retention period for support exchanges].

3. What stays on your device

This data is not sent to us (except what you choose to export or send):

• your game save, in the app's documents folder. If you have turned on iCloud Backup, iOS includes it there, in your Apple account and under Apple's terms. [À VÉRIFIER : Google backup behaviour on Android]
• your settings (sound, theme, haptics, rendering), in the app's preferences;
• your profile picture, if you choose one. It is never sent. You pick it with the system photo picker, which only gives us access to the chosen photo, or you take it with the camera: camera permission is requested when you tap the button, and you can withdraw it at any time in your device settings;
• your account's private key, in the iOS Keychain;
• your age declaration, asked before the account is created: you enter your month and year of birth, and the game only keeps the result ("allowed" or "refused") and its date, never the date of birth. Nothing from this declaration is sent to our servers.

This storage is strictly necessary for the game you are using, so it does not require your consent (Article 5(3) of Directive 2002/58/EC, Article 82 of French Law No. 78-17 of 6 January 1978).

4. What we do not do

• no advertising, no third-party analytics, crash-reporting or attribution tools;
• no advertising identifier, no tracking across apps or websites;
• no push notifications, no geolocation;
• no sign-in with Apple, Google or Game Center;
• no sale, rental or transfer of your data;
• no profiling for commercial purposes.

5. Who receives your data

• Other players see your username, your profile and showcase, your guilds' information, guild messages (members), your private messages (their recipient) and the matches you play against them (your opponents). They do not see your IP address; your account's technical identifier is exchanged between guild members and between friends to run the game: it is not a secret and is never enough to prove who you are. They also see whether you are online (date of your last visit) and whether you have read their private messages (read receipts).
• Our host, Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) runs our servers and stores this data (Pages, Functions, D1, Workers, Durable Objects and Workers KV services). It acts as a processor within the meaning of Article 28 GDPR: it processes the data only on our instructions, under its data processing addendum (DPA), incorporated into its subscription terms. [À VÉRIFIER : Cloudflare plan of the account and version of the DPA in force]
• Apple and Google process your purchases as separate controllers, under their own privacy policies. We do not send them your game data.
• Competent judicial or administrative authorities, on lawful request and within its limits.

No one else.

6. Transfers outside the European Union

Cloudflare is a company established in the United States that operates data centres worldwide: your data may therefore be processed outside the European Union, in particular in the United States. [À VÉRIFIER : actual location of the D1 database "brainrot-social" and of the Durable Objects; no EU jurisdiction restriction is declared in the configuration as of 30 October 2026]

These transfers are covered by Cloudflare's certification under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023, upheld by the General Court of the European Union on 3 September 2025, case T-553/23, appeal pending) and, failing that, by the European Commission's standard contractual clauses included in its data processing addendum. [À VÉRIFIER : on cloudflare.com/cloudflare-customer-dpa and dataprivacyframework.gov] You can ask us for a copy of these safeguards at the address in section 1.

7. How long we keep your data

Deletion at the end of the period is automatic. [À VÉRIFIER : the purge runs as the service handles requests; state the maximum delay between the deadline and actual deletion]

When you delete your account, deletion is immediate: friends, requests, blocks, messages (private conversations are deleted in full, on both sides), guilds (if you led one, leadership passes to the longest-standing member), profile, showcase, purse, online matches and vault. Once the server is erased, the game also erases your device: the keychain key, the save, the profile picture and the showcase; the game starts again from scratch. If the server does not respond, nothing is erased and you can try again. Only the following remain:

• a row holding the account's random identifier and its dates, with no key and no username, which prevents the identifier from being reused; [À VALIDER PAR L'AVOCAT : retention of this row]
• the IP address used to create the account, until the end of its legal year;
• the username, reserved for 30 days;
• reports filed against you; reports you filed remain, with "deleted account" in place of your identifier;
• in your former opponents' history, the matches played against you, with your side replaced by "deleted account".

8. Your rights, and how to exercise them

[À VÉRIFIER : exact English labels of "Exporter mes données" and "Supprimer mon compte" in the game's English version]

The export contains neither your account's secret key, nor your session token hashes (they are secrets), nor your profile picture (it never leaves your device), nor the list of players who have blocked you (that is other people's data, Article 15(4) GDPR).

Automated decision. The only automated processing that decides something about you is the message filter (section 2.7): it rejects a message, with no other consequence. Sanctions (removing content, restricting or suspending an account) are decided by a person.

How we identify you. We have neither your name nor your email. In the game, the proof is your device's key: nothing else is needed. By email, we will ask for proof that the account is yours before answering, so that nobody can obtain or erase another player's data (Article 12(6) GDPR). [À COMPLÉTER : chosen means of proof, e.g. the support identifier shown in Settings and attached to messages written from the game] [À VALIDER PAR L'AVOCAT : sufficiency of this means of proof]

Time limit. One month from your request, extendable by two months if it is complex; in that case we tell you within the first month (Article 12(3) GDPR). Exercising your rights is free.

Complaint. You can lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr [À VÉRIFIER : address on cnil.fr], or with the data protection authority of your country of residence (Article 77 GDPR).

9. Minors

The game is intended for players aged 13 and over. Before an account is created, the game asks for your month and year of birth, without saying which age is expected; this declaration stays on your device (section 3). If you are under 13, online features are refused: no account is created and no data is sent to our servers; the game remains playable on the device.

We collect nothing more about a minor than about an adult. Private messages are only possible between mutual friends, and the filter rejects messages containing contact details.

Our processing does not rely on consent, but on the contract, a legal obligation or our legitimate interest (section 2). The rules of Article 8 GDPR on children's consent (15 in France, between 13 and 16 in other EU countries) therefore do not apply as such. [À VALIDER PAR L'AVOCAT : capacity of a 13 to 15-year-old to enter into the contract, information and consent of holders of parental responsibility]

Parents and guardians: you can ask us to delete the account of a child in your care, at the address in section 1, giving the child's username. To control purchases, we recommend the parental controls of the App Store (Family Sharing, "Ask to Buy") and Google Play (Family Link).

10. Security

• No password to steal: your account's private key does not leave your device, and we only keep hashes or public keys.
• All communications use encrypted connections (HTTPS and WSS).
• Balances, entitlements and ranks are decided by the server, not by the app.
• The moderation queue is protected by a secret; the published game sends no diagnostic report.
• Administrative access is limited to [À COMPLÉTER : people with access to the service's administration].
• We keep as little data as possible, each for a limited time (section 7).

If a personal data breach presents a risk, we notify the CNIL within 72 hours of becoming aware of it (Article 33 GDPR), and we inform you in the game if the risk to you is high (Article 34).

11. Changes

We will update this policy if the game changes what it collects or what it does with it. The date at the top changes with each version. For a significant change, the game tells you before it applies. [À COMPLÉTER : address of previous versions, or remove this sentence] Previous versions are available on request.

12. Contact us

[À COMPLÉTER : publisher's full name, or company name]
[À COMPLÉTER : postal address]
Email: [À COMPLÉTER : support email address]

See also: Terms of Use · Legal Notice · Support · Delete your account