Privacy policy

This policy explains what information BrainTally ("we", "us") collects when you take a test, create an account, submit a review, contact us, or subscribe to our newsletter; how we use it, who we share it with, and the choices you have. It applies to braintally.com and every subdomain, and to our test-taking flow, customer account area, and support center.

Information we collect

Account and profile information. Your first and last name, email address, and country when you start a test or create an account; optionally, an age range and interests if you complete the onboarding wizard; and a theme preference.

Test data. Your answers, scores, attempt history, and the certificate we generate for you.

Sign-in and security information. If you set a password, we store it as a salted hash — we never store or have access to the plaintext password. If you sign in with a third-party account (currently Google; Microsoft, GitHub and LinkedIn are supported but not yet enabled), see "Signing in with a third-party account" below. If you enable two-factor authentication, we store an encrypted copy of your authenticator secret and a hash of each backup code — never the plaintext codes themselves. We also keep a record of your active sessions (approximate device/browser, IP address, and last-active time) so you can review and revoke them from Account Settings.

Payment information. If you purchase a membership, billing is handled directly by our payment processor, Paddle — we receive your subscription and payment status, but we never see or store your card number.

Support tickets. The subject, messages, and any attachments you submit through our support center, plus basic technical context (browser, device, and the plan you were on) captured automatically to help us resolve your ticket faster.

Communications. Messages you send through our contact form, and your email address if you subscribe to our newsletter.

Technical information. Your IP address and basic device/browser information, collected automatically for security purposes — for example, rate-limiting sign-in attempts, detecting abuse, and the session list described above.

How we use it

To create and secure your account; to score your test and email you the results and certificate; to process payments and manage your subscription; to respond to support tickets and messages you send us; to send newsletter updates you've confirmed; and to operate, maintain, and improve the service, including detecting and preventing fraud and abuse.

Who we share it with

We don't sell your data, and we don't share it with third parties for their own marketing purposes. We share the minimum information necessary with the service providers that run BrainTally on our behalf:

Paddle (payment processing) receives what's needed to process your purchase and subscription. Resend (transactional email) receives your email address to deliver test results, sign-in links, and account notifications. Cloudflare provides our CDN and security layer and sees standard web request metadata (like your IP address) as a result. If you submit a support ticket with an attachment, the file is scanned for malware and stored in Cloudflare R2. Each provider is contractually restricted to using your information only to provide these services to us.

Signing in with a third-party account (including Google)

If you choose to sign in with Google (or, once enabled, Microsoft, GitHub, or LinkedIn), our application accesses a small, fixed set of data from your account with that provider: your name, your email address, and a stable, unique account identifier used to recognize you on return visits. We do not request or access your files, contacts, calendar, photos, or any other data from your Google Account, and this is the only data we ever access from it.

How we use it. We use this data solely to create or match you to your BrainTally account and sign you in — for example, matching the email address Google gives us to an existing BrainTally account, or displaying your name in your account area. We do not use it to build an advertising profile, and we do not use it for any purpose beyond providing and improving the BrainTally features you're using.

How we share it. We do not sell, transfer, or share the data we receive from your Google Account with any third party, except with the service providers listed in "Who we share it with" above, and only as needed to operate BrainTally itself (for example, our email provider needs your email address to send you your test results). We never share it for another party's independent use, advertising, or research.

How we protect it. Data from your Google Account is transmitted to us over an encrypted (HTTPS/TLS) connection and stored in our database behind access controls limited to the systems that need it to operate your account; it is never logged in plaintext or exported outside those systems.

Retention and deletion. We retain this data for as long as your account is linked to that sign-in method. You can disconnect a linked Google (or other provider) account at any time from Account Settings, which deletes the link and the identifier we stored for it. You can request deletion of the rest of your account data at the same time by contacting us — see "Contact us" below.

What we don't do with it. We do not use data obtained through Google Sign-In for: targeted, personalized, retargeted, or interest-based advertising; selling to data brokers or other information resellers; determining creditworthiness or eligibility for lending; or training generalized (non-personalized) AI or machine learning models. We use it only to provide and improve BrainTally's own functionality for you. BrainTally's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

How we protect your data

All traffic to BrainTally is encrypted in transit (HTTPS/TLS). Passwords are never stored in plaintext — only a salted cryptographic hash. Two-factor authentication secrets are encrypted at rest, and backup codes are stored as one-way hashes. Access to production data is limited to the systems and personnel who need it to operate the service. No method of transmission or storage is perfectly secure, but we design and review our systems with these protections as a baseline, not an afterthought.

Cookies and local storage

We don't use advertising or cross-site tracking cookies. Your sign-in session is stored as a token in your browser's local storage, not a tracking cookie, and Cloudflare sets a small number of cookies strictly necessary to protect the site from abuse.

Data retention

We keep your account and test data for as long as your account is active, or as needed to provide the service (for example, so you can retrieve past results). If you request deletion, we remove your personal information within a reasonable time, except where we're required to retain limited records (such as payment records) for legal or accounting purposes.

Your choices

You can review and revoke individual sign-in sessions, enable or disable two-factor authentication, disconnect a linked third-party sign-in, and set or remove a password, all from Account Settings. You can unsubscribe from the newsletter at any time using the link in any newsletter email. You can request access to, correction of, or deletion of your personal data by contacting us — see "Contact us" below.

Children's privacy

BrainTally is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, please contact us and we'll remove it.

International transfers

We and our service providers may process your information in countries other than your own. Where required, we rely on appropriate safeguards to protect your information when it's transferred internationally.

Changes to this policy

We'll update the date at the top of this page whenever we make changes, and post the updated policy here. If a change is significant, we'll do our best to let you know directly, such as by email.

Contact us

Questions about this policy, or a request about your data? Reach us through our contact page.