Privacy Policy

Who operates the service

BrainHunters Academy is operated by BrainHunter Academy LLC, Wyoming, United States. For privacy questions, corrections, or deletion requests, contact info@brainhunters.academy. This policy covers our website and learning application. Providers you visit, such as Google and Creem, also explain their own processing in their privacy policies.

Information we collect

Parent account records include your email address, parent name, language, account creation and consent timestamps, email verification status, email preferences, and protected credentials. Passwords and parent PINs are stored as hashes, not readable text; recovery credentials are also hashed. If you contact support, we receive the information you choose to include in your message.

Child profiles contain a nickname, selected avatar, learning level, daily goal, and profile identifier. Learning records include activity identifiers, submitted answers, correctness, time spent, dates, course language, earned points, and progress. We do not require a child’s email, full name, date of birth, school, address, or photograph. Requests to the service also expose technical information such as an IP address and browser information to the hosting infrastructure; the application uses IP-based rate limits to prevent abuse.

Google sign-in: access and collection

Google sign-in is an optional sign-in method for the adult account holder. Email and password sign-in is also available. We request only the openid, email, and profile permissions. Google supplies a unique account identifier, email address, verification information, and basic profile information in a signed identity token. We use your given name or name for the parent name when creating a new account. We do not save a Google profile photograph.

We verify the identity token to authenticate you. We store the Google account identifier, email address, link to your family account, and connection and last sign-in timestamps. The application does not persist Google access tokens, refresh tokens, or identity tokens. It does not request offline access, Gmail messages, contacts, Drive files, Calendar events, or YouTube data, and never receives your Google password.

How we use information

We use account and Google identity information to create or link your adult account, authenticate you, protect access, and maintain your family’s account. Learning data saves progress, selects available activities, awards points, and produces private parent reports. Membership records determine access to purchased features. Technical records help prevent abuse and investigate faults.

We use the parent email for verification, recovery, account support, and service messages. Learning emails use the account’s email preference and require a verified address; new Google registrations currently enable that preference when Google establishes email ownership. You can turn learning emails off in parent settings or use an unsubscribe link. Google-derived information is not sold, used for personalized advertising, or supplied to external AI systems to train models. Our use of Google data is subject to the Google API Services User Data Policy; the policy link appears below.

Children’s information and narration

An adult manages the family account and the child profiles. Children do not need their own Google account. A parent PIN protects profile changes, reports, billing, export, and deletion. Profiles and reports are private to the family rather than public profiles or public leaderboards. Parents can review, correct, or remove a child profile and its learning history.

Narration reads prepared learning and guide text. The application does not ask children to record or upload their voice and does not send child profile data to an external speech-generation service. Please use nicknames and avoid entering unnecessary personal details. Contact us if you believe a child supplied information without appropriate adult involvement.

When information is shared

The service uses hosting infrastructure, MongoDB Atlas for application records, and Redis for operational caching and safeguards. These services process data needed to store records and operate the application. Google processes sign-in requests when you choose Google sign-in. When email delivery is enabled, the configured mail service receives the recipient address and message content.

When you choose an available Creem checkout, Creem processes payment information and receives the parent email and purchase references needed for checkout. We keep membership status and payment-provider references; the application does not store complete payment-card details. Google Analytics receives browser usage information as described below. We do not sell family records or make child profiles available to advertisers.

Information may also be disclosed when necessary to comply with a legal obligation, address abuse, or protect the service and its users. Support and operational access should be limited to the information needed for the request or incident.

Cookies and analytics

An essential session cookie keeps you signed in. Short-lived Google cookies protect the sign-in flow. Browser storage remembers the selected learner, sound preference, and analytics choice. Blocking essential cookies prevents sign-in from working; clearing browser storage does not delete server-side family records.

When configured on the production site, Google Analytics measures page visits. It receives the page address and title and may process cookie identifiers, device and browser information, and network information. The application does not add your Google account identifier, parent email, or child profile records to analytics events. Analytics is enabled by default and can be disabled for the current browser on the Cookies page. Disabling it does not erase information already collected or existing cookies. Google Analytics is separate from Google sign-in.

Storage, security, and retention

Application records are stored in the service’s database, with operational data in its cache. We use HTTPS on the public site, hashed credentials, restricted account access, and parent-PIN checks. No storage or transmission method can guarantee absolute security.

Account and learning records remain available while you keep the account, until you delete the relevant profile or account. A session expires after 30 days. Temporary Google sign-in and incomplete-registration records expire after 10 minutes and are removed by periodic cleanup. Application email delivery records are eligible for cleanup after 30 days. These periods describe application records, not a guarantee that all infrastructure copies disappear at the same moment.

Account deletion removes active family records, child learning attempts, linked Google identities, sessions, membership and checkout records, and application email records. Separate provider records, security logs, legally required records, and any infrastructure backups are outside that active-record deletion. Contact us for a request concerning those records; payment providers may need to retain transaction records for their own obligations.

Your choices, Google disconnection, and deletion

Use the PIN-protected parent settings to review or edit profiles, export family data, or delete a child profile or the entire account. Account deletion requires confirmation and an account credential. Cancel an active recurring membership through the billing portal before deleting the account: removing application data does not itself cancel provider billing.

To disconnect Google in parent settings, first set an account password, then confirm that password. Disconnection removes the saved Google link, ends other application sessions, and locks the parent area; the family account and its learning records remain. You can also remove BrainHunters Academy from your Google Account connections using the link below. Removing Google access does not automatically delete information already stored by BrainHunters Academy or sign you out of an existing application session. Use account deletion or contact us to request removal of those records.

For access, correction, deletion, or other privacy requests that you cannot complete in the app, email info@brainhunters.academy from your account address. We may need to verify account ownership before acting. Never send your password, PIN, recovery key, or complete card details. Your applicable privacy rights depend on your location.

Changes to this policy

We publish updates on this page and revise the date above. If we propose to use Google user data for a new purpose, we will disclose that change and request consent before using it in that way. Contact the service operator with questions about this policy.