Privacy Policy

For the purposes of the UK GDPR and related data protection laws, the Data Controller is Neurobuff Limited (Company Number: 16866010).
Registered Address: Green Acres New Hey Lane, Newton, Preston, England, PR4 3SB.
Contact: support@neurobuff.app

This policy applies to Neurobuff's websites, account features, training games, forums, support tools, payment flows, and related services. Neurobuff is not a medical service, and we do not use your information to provide medical diagnosis, treatment, or clinical advice.

We collect the information needed to operate Neurobuff, keep accounts secure, process subscriptions, support community features, and improve the product.

• Account and identity information: email address, name, username, display name, profile icon, passwordless sign-in data, account identifiers, and whether you have accepted our legal terms.
• Third-party sign-in information: if you choose Google or Discord sign-in, we receive the information needed to authenticate your account, such as provider identifiers and basic profile details made available by that provider.
• Eligibility and onboarding information: your minimum-age confirmation, selected age range, goals, preferences, training challenges, and onboarding quiz answers.
• Training and progress information: game sessions, scores, streaks, achievements, module completions, settings, gameplay metrics, progress summaries, leaderboard entries, and related performance data. When you use adaptive mode, this also includes gameplay outcomes, the difficulty decisions made for you, and the version of the adaptive system that made them.
• Community and user-generated content: forum posts, replies, likes, reports, moderation records, public profile summaries, public leaderboard scores, product reviews, review page URL, and review-related device details.
• Billing and subscription information: subscription and trial status, Stripe customer identifiers, checkout attempts, invoice or payment references, refund and cancellation records, and fraud or chargeback signals. To enforce one introductory trial per customer and payment method, we retain keyed cryptographic digests derived from the normalised account email and Stripe's card fingerprint. We do not retain the raw email or fingerprint in this trial record, and full card details are handled by Stripe and are not stored by Neurobuff.
• Support and communications: support request content, query type, page URL, browser details, user agent, account email, customer-service messages, and marketing email preference.
• Technical, security, and usage information: IP-derived security signals, device and browser details, logs, rate-limit events, consent preferences, error reports, performance data, anti-abuse checks, Turnstile verification results, and analytics events where you have consented.
• Local-only browser data: some game settings and Image Streaming audio recordings or review data may be stored locally in your browser using local storage or IndexedDB. Local audio recordings are intended to stay on your device unless a feature clearly tells you otherwise.

Please do not include sensitive personal information in forums, product reviews, or support requests unless it is necessary for your request. If you choose to provide sensitive information, we use it only for the purpose you provided it for and to meet any related legal or safety duties.

Account email, minimum-age confirmation, acceptance of the Terms, acknowledgement of this policy, and information marked as required in a purchase flow are needed to provide the relevant account or paid service. If you do not provide them, we may be unable to create the account, complete the purchase, or provide that feature. Optional profile, marketing, analytics, forum, and review information can be withheld without losing unrelated core features.

We only process personal data where we have a lawful basis under UK GDPR.

• Contract: to create and manage your account, provide training games, save progress, operate subscriptions, deliver paid features, process cancellations, and respond to service requests.
• Legitimate interests: to keep Neurobuff secure, prevent abuse and fraud, debug errors, operate rate limits, improve reliability, moderate forums and reviews, understand product performance, evaluate and improve how adaptive difficulty works, and protect our legal rights. We balance these interests against your rights and expectations.
• Consent: to send optional marketing emails, store non-essential analytics preferences, run consent-based analytics, and enable consent-based session replay or performance tracing where available. You can withdraw consent at any time.
• Legal obligation: to keep records required for tax, accounting, consumer, payment, online safety, company, or regulatory duties and to respond to valid legal requests.

We do not sell your personal data. We do not use third-party targeted advertising cookies. Neurobuff may personalize your product experience using your settings, training history, gameplay outcomes, and adaptive difficulty decisions. We may analyse that information offline to evaluate or improve the system, but released algorithms do not automatically rewrite themselves from your data. We do not make solely automated decisions about you that have legal or similarly significant effects.

Some Neurobuff features are public or community-facing. Your username, display name, profile icon, public profile summary, leaderboard scores, forum posts, replies, likes, and approved product reviews may be visible to other users or visitors.

• Do not post information that you want to keep private.
• We may review, restrict, remove, or preserve content and related metadata to enforce our terms, protect users, investigate abuse, or comply with legal obligations.
• If you delete your account, we remove your active profile and training data from product use, but public forum discussions may be retained with the author detached or anonymized to preserve community context.

We use service providers to operate Neurobuff. They may process personal data only for the services they provide to us, under their own security, privacy, and data-processing commitments.

• Supabase: authentication, database hosting, storage, and Edge Functions.
• Stripe: checkout, subscriptions, billing, customer portal, refunds, tax, fraud prevention, and payment records.
• Sentry: error monitoring, reliability diagnostics, performance tracing, and consent-based replay features.
• Swetrix: privacy-focused analytics where you have consented to analytics.
• Vercel: application hosting, deployment, routing, and server-side runtime infrastructure.
• Cloudflare: Turnstile bot protection and CDN/security services for selected assets or traffic.
• Backblaze B2 and asset CDN services: media and static asset hosting.
• Upstash Redis: security and rate-limiting records for abuse prevention.
• AWS SES and email/support mailbox providers: transactional email, support acknowledgements, and customer communications.
• Google and Discord: authentication only if you choose to sign in through those providers.
• GIPHY: forum GIF search and media delivery. When you search for or view a GIF, GIPHY may receive the search request or technical request information such as IP address, browser details, and the requested media URL.
• Microsoft Azure: restricted server-side link-preview fetching for URLs submitted to community features.

We may also disclose information if required by law, to regulators or courts, to enforce our terms, to protect rights and safety, or as part of a business sale, merger, restructuring, investment, or asset transfer.

We keep personal data only for as long as we need it for the purposes described in this policy, unless a longer period is required or permitted by law.

• Account, profile, settings, and training data: kept while your account is active and removed from active product use when your account is deleted, subject to the exceptions below.
• Billing, tax, and subscription records: retained where needed for accounting, tax, audit, refund, chargeback, fraud-prevention, and legal obligations. Company accounting records may need to be kept for at least 6 years.
• Introductory-trial fraud-prevention identifiers: keyed email and payment-method digests are retained for the lifetime of the trial programme, including after account deletion, so deleting and recreating an account does not reset trial eligibility. These restricted records contain no raw email, card details, Stripe fingerprint, or Neurobuff user ID.
• Support and complaint records: normally retained for up to 24 months after closure, and longer where reasonably needed for an active dispute, safeguarding matter, legal claim, or regulatory obligation.
• Review permissions and testimonial records: retained while the review is displayed or used and for a reasonable period afterwards to demonstrate permission, provenance, disclosures, and withdrawal.
• Moderation, online-safety, security, and audit records: retained according to the seriousness of the matter and while needed to investigate abuse, preserve evidence, meet reporting duties, defend legal claims, or protect users. Restricted records may be retained after visible content is removed.
• Public forum content: may remain available after account deletion with the account association removed or anonymized.
• Backups: deletion from encrypted backups may be delayed until the relevant backup is securely overwritten under the verified backup lifecycle. Backups are isolated from normal product use and are not restored to avoid a valid deletion request.

We use technical and organisational measures designed to protect personal data, including encrypted transport, access controls, database security policies, server-side secrets, rate limits, anti-abuse checks, monitoring, and restricted administrative access. No online service can guarantee absolute security, but we work to reduce risk and respond quickly if we identify a problem.

Depending on the circumstances, you may have the right to:

• access a copy of your personal data;
• correct inaccurate or incomplete data;
• delete your account or request erasure of personal data;
• restrict how we use your data;
• object to processing based on legitimate interests or direct marketing;
• receive certain data in a portable format;
• withdraw consent where processing is based on consent; and
• complain to the UK Information Commissioner's Office at ico.org.uk.

You can delete your account in account settings where available, manage cookie choices below, unsubscribe from marketing emails using the link in those emails, or contact support@neurobuff.app for privacy requests. We may need to verify your identity before completing a request, and some records may be retained where required or permitted by law.

We use cookies, local storage, and similar technologies to keep Neurobuff working, remember preferences, secure the service, and improve the product where you consent.

Our Cookie and Browser Storage Notice lists the main technologies, providers, purposes and retention periods.

We review this policy as Neurobuff and the law change. If we make material changes, we will update this page and, where appropriate, notify users in-product or by email before the new processing begins.