Privacy Policy

1. Who is responsible for processing your data?

FotBrain is operated by Jørgen Sigvartsen, contact: contact@fotbrain.com. This is currently a private hobby project with no registered company.

2. What information do we collect?

In short: we collect the minimum needed to let you play and track your progress, plus your email if you create an account. Specifically:

• Anonymous game state. On your first visit you get a random, anonymous session ID (the fq_session cookie). It isn't linked to a name or email, and is only used to remember which guesses you've made and whether you've solved today's challenges.
• Account (optional). If you sign in with Google or email (magic link), we store your email address, plus your name and profile picture if you sign in with Google.
• Play history and streak. If you have an account, we store which daily challenges you've completed, which game mode, how many guesses each took, and your current and longest streak - so this carries over across devices instead of resetting.
• IP address. Used temporarily to prevent abuse (e.g. automated attempts to guess your way to today's answer, or spamming sign-in links to an email address). Not stored in any user profile - just a short-lived counter that resets automatically.
• Local browser storage (localStorage). We store a few technical preferences locally on your device - e.g. your theme preference (dark or light), whether you've seen a game's how-to-play guide, or your streak before you sign in. This is never sent to us and isn't used for tracking.
• Analytics (PostHog) - built, not yet collecting anything. The app is wired up to send a handful of named events (e.g. that a daily challenge was completed) to PostHog, gated entirely behind the cookie banner below - but we haven't finished setting up our own PostHog account yet, so no analytics code loads and no event has actually been sent to anyone, regardless of your cookie choice. This section will be updated the moment that changes.
• Error reports (Sentry) - built, not yet active. The app is wired up to send crash/error reports (e.g. technical details about what broke, your browser, and your IP address) to Sentry so we can find and fix bugs - but we haven't finished setting up our own Sentry account yet, so nothing is currently being sent there either. This section will be updated the moment that changes.

3. What do we use the information for?

Solely to (a) let you play and remember your progress, (b) prevent abuse of the games, (c) find and fix bugs, once error reporting is active, and (d), if you consent, understand overall usage patterns to improve the app. We do not sell information to third parties, and do not use it for ad targeting - the app currently has no ads or payments.

4. Legal basis

Necessary cookies/session data: legitimate interest in delivering the service you're requesting (the game itself). Account information: performance of a contract when you choose to create an account. Error reports: legitimate interest in keeping the service working correctly. The analytics cookie: consent, obtained via the cookie banner - can be withdrawn at any time (see section 5).

5. Cookies

You can change your choice at any time by clearing your browser data for this site, or (once we add it) via a link at the bottom of the page.

6. Who do we share information with?

We use the following data processors to run the service - they only get access to what's needed to deliver their part of the service, and don't use it for their own purposes. For each: what they receive, and why.

• Vercel (hosting). Receives every request to the app, since it runs their servers - the most fundamental processor here, everything passes through them.
• Neon (database). Stores all app data at rest: session state, account info, play history and streaks.
• Better Auth (sign-in). Not a separate company - this is the open-source software our own server runs to handle Google/magic-link sign-in. It doesn't send your data anywhere by itself; everything it handles is stored in our own Neon database above.
• Google (sign-in). Only if you choose "Continue with Google": Google receives your authentication request, and sends back your email, name and profile picture to let us create/recognize your account.
• Resend (magic-link email delivery). Receives your email address and the sign-in link, in order to actually deliver the email to your inbox when you request a magic link.
• Upstash (rate-limit storage). Receives short-lived, non-personal counters (derived from your IP or session, not your identity) to enforce the rate limits in section 2.
• PostHog (analytics) - not active yet, see section 2. Would receive anonymous usage events, only if you consent via the cookie banner.
• Sentry (error tracking) - not active yet, see section 2. Would receive technical crash reports, including your IP address and browser details, to help us fix bugs.

AI/machine learning: to the best of our knowledge, Sentry and PostHog both offer AI-assisted features on top of the data they process (e.g. Sentry's AI-assisted error grouping and root-cause suggestions, PostHog's AI-assisted analytics/querying tools) as part of their own product, not something we configure ourselves. This only becomes relevant once we actually activate either service (see section 2) - we'll review each provider's current terms before that happens, since these features can change over time.

Some of these may process data outside Norway/the EEA (e.g. in the US) as part of their infrastructure - if so, this happens under the provider's own standard transfer safeguards.

7. How long do we keep information?

Anonymous game data isn't linked to an identity, and is kept for as long as the session cookie is valid. Account information and play history is kept until you delete your account or request deletion (see section 8) - we haven't built a self-service delete button yet.

8. Your rights

You have the right to access, correct and delete your personal data, and to withdraw consent to the analytics cookie at any time. Email contact@fotbrain.com to request this until a self-service option exists. You can also file a complaint with Datatilsynet (the Norwegian Data Protection Authority, datatilsynet.no).

9. Children

FotBrain is not specifically directed at children under 13, and we don't knowingly ask for information from children. Contact us if you believe a child has created an account without a parent's or guardian's consent.

10. Changes

We may update this policy as the app changes (e.g. if analytics or error reporting actually go live, or payments are enabled). The date at the top shows when it was last changed.