Scope and controller
Fodla Media (“Fodla Media,” “we,” “us,” or “our”) publishes MindCrest: Brain Games (“MINDCREST”). This Privacy Policy applies to the MINDCREST mobile application, mindcrest.app, support communications, and related services collectively called the “Services.” Fodla Media is the controller of personal information it determines how and why to process.
You can contact us at support@mindcrest.app. Please include “Privacy request” in the subject line for access, correction, deletion, or other privacy requests.
Age and general audience
MINDCREST is a general-audience service intended for people aged 13 and older. It is not directed to children under 13. If you are under the age of legal majority where you live, you may use the Services only with permission from a parent or legal guardian. Where local law requires a higher age for a person to consent to data processing, parental or guardian authorization is required.
We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided information, contact us and we will take appropriate steps to investigate and delete it.
Information we collect
Account and profile information
When you first use online features, MINDCREST registers an anonymous player account with a random player identifier. Signing in is optional. If you sign in with a one-time code sent to your email, with Sign in with Apple, or with Google, we receive your email address (with Apple this may be a private relay address) and the provider’s account identifier. If you share your name through Sign in with Apple, we may use it as your initial display name. You can choose a public display name and cosmetic profile elements, and you may optionally provide an age group, education level, and training goals for personalized coaching. For players under 18, we do not store education level or goals.
Gameplay and progress information
We process game identifiers, levels, scores, session results (including durations, answer counts, reaction times, and answer sequences used for fair ranking and anti-cheat checks), streaks, achievements, coach workouts, Power Points, virtual items, equipped cosmetics, active powers, leaderboard and competition entries, language preferences, and premium entitlement status. Leaderboards can display your chosen display name, avatar, cosmetics, and score to other users.
Device and security information
We process an installation identifier, a per-device signing key used to sign app requests, platform, app version, language, and IP address. To protect the Services against fraud and modified apps, the app may request a device attestation (Google Play Integrity on Android, Apple App Attest on iOS); we verify it with Google or Apple and keep only the verdict. MINDCREST does not include an analytics SDK or a crash reporter. We do not ask for precise GPS location, contacts, photos, microphone recordings, or camera content. Reminder notifications you enable are scheduled locally on your device. Read-aloud in Spelling Bee uses your device’s built-in text-to-speech engine; on Android the system speech service may process the word being read. No personal data is spoken.
Advertising and consent information
For users of the free version, Google AdMob may process advertising identifiers, IP address, coarse location derived from it, device and app information, ad interactions, diagnostics, and consent or opt-out signals to provide, measure, limit, or personalize advertisements where permitted. Rewarded ads are shown only after you choose to watch one for the stated in-app reward.
Purchases and subscriptions
Apple or Google processes your payment. We do not receive your full payment card number. We and RevenueCat process an app user identifier, product, transaction or receipt information, subscription status, and entitlement history to activate and restore purchases.
Communications and website data
If you email us, we process your email address and message. If you use Send diagnostics in the app, a local log (app version, operating system, recently opened screens, language, and theme) is attached to the support email you send; it is sent only when you choose to. When you sign in or delete your account, we send transactional emails such as one-time codes and confirmations. When you visit mindcrest.app, our servers process basic network and request data (such as IP address, requested page, and browser type) needed to securely deliver the site and prevent abuse. The website does not set advertising or analytics cookies.
How we use information
- Provide accounts, gameplay, progress sync, achievements, leaderboards, competitions, rewards, coaching, and localization.
- Authenticate users, link sign-in methods, merge eligible anonymous progress, and send one-time sign-in codes.
- Process and restore premium subscriptions and entitlements.
- Provide ads, rewarded experiences, and legally required privacy choices.
- Diagnose problems, improve performance, and protect the Services.
- Prevent fraud, abuse, cheating, unauthorized transactions, and security incidents, including device attestation and rate limiting.
- Respond to support, legal, data-protection, account deletion, and data export requests.
- Comply with law and enforce our Terms of Service.
Legal bases for processing
Where laws such as the GDPR, UK GDPR, or Türkiye’s Law No. 6698 on the Protection of Personal Data (KVKK) apply, we rely on the following bases as appropriate: performance of our contract with you to provide the Services; your consent for personalized advertising where required; our legitimate interests in securing, supporting, and improving the Services and preventing fraud; and compliance with legal obligations. You may withdraw consent at any time without affecting earlier lawful processing.
Advertising and your choices
MINDCREST uses Google’s User Messaging Platform to request consent or present opt-out choices where required. You can revisit available controls through Settings → Ad privacy in the app. Depending on your region and decision, ads may be personalized, non-personalized, limited, or unavailable. On iOS, the advertising identifier is used only if you allow tracking. You can also limit ad tracking through your iOS or Android device settings.
We do not sell personal information for money. Some privacy laws may define interest-based advertising as “sharing,” “targeted advertising,” or a “sale.” Where applicable, use the in-app Ad privacy control to opt out. SUPER subscribers receive an ad-free app experience while their entitlement remains active.
International transfers
Our own servers and database are located in Germany. We distribute MINDCREST globally, and some of the providers listed above (for example Apple, Google, RevenueCat, Resend, and Cloudflare) may process information in other countries, including the United States. Where required, we and these providers rely on recognized safeguards such as adequacy decisions or standard contractual clauses.
Retention, deletion, and data export
We retain account and progress data while your account is active. Detailed per-answer session data is kept for 90 days and session results for up to 400 days. Full IP addresses in our security event log are kept for 90 days. Some records may be retained longer where legally required or necessary for security, fraud prevention, or transaction records. Local app data may remain on your device until you clear it or uninstall the app.
You can delete your account at any time in the app (Settings → Account → Delete account) or on the web at mindcrest.app/account/delete. Deletion takes effect immediately: your profile is anonymized, your sign-in methods and device credentials are removed, you are signed out on every device, and any Sign in with Apple authorization is revoked. Remaining account data, including your finalized leaderboard results, is permanently purged within 30 days. Anonymous aggregate statistics may be kept. When you merge an anonymous profile into a signed-in account, the merged-away profile is kept as an anonymized record without personal data so your other devices can be pointed to your account; its device records are removed after 180 days. When you delete your account, profiles previously merged into it are deleted with it, and we ask RevenueCat to delete its subscriber record for your account. Device bans for rule violations are kept for 12 months; administrator records about a deleted account keep only the action and its time.
You can download a copy of the data stored about your account in the app (Settings → Account → Download my data), which produces a machine-readable JSON file. If you cannot use these tools, email support@mindcrest.app from the address connected to your account. We may need to verify the request.
Your privacy rights
Depending on where you live, you may have rights to access, correct, delete, restrict, or receive a portable copy of personal information; object to certain processing; withdraw consent; or opt out of sale, sharing, or targeted advertising. You may also complain to your local data-protection authority. We will not discriminate against you for exercising a privacy right.
Submit requests to support@mindcrest.app. We may ask for reasonable verification and may decline or limit a request where permitted by law. More help is available on our support page.
Security
We use technical and organizational safeguards designed to protect information, including encrypted network transport, signed app requests, device attestation, restricted administrative access with audit logging, and server-authoritative controls for sensitive rewards and entitlements. No method of storage or transmission is completely secure, so we cannot guarantee absolute security.
Policy updates
We may update this policy as the Services, providers, or laws change. We will post the revised policy here and update its effective date. If a change materially affects your rights, we will provide additional notice where required.
Contact
Fodla Media
Privacy and support: support@mindcrest.app
Website: mindcrest.app