Privacy Policy
Version 3 · Effective 2 October 2026
The short version
- Players stay anonymous.No account, email or phone number. Just a team name for one game.
- Hosts give us an email.Only to sign in, send sign-in codes and security alerts. Never marketing.
- No ads, no tracking.No analytics, no advertising cookies. We never sell or share personal data.
- You're in control.Download or delete everything from your dashboard, any time, instantly.
1. Who we are
Know Brainer (knowbrainergame.com) is a party trivia game. The operator of this site is the data controller (under the EU and UK GDPR), the data fiduciary (under India's Digital Personal Data Protection Act, 2023) and the business (under California law) for the personal data described here. You can reach us, including our grievance officer, at support@knowbrainergame.com.
This policy applies wherever you are. Where a law gives you stronger rights, those rights apply.
2. What we collect, why, and for how long
| Information | Purpose | Legal basis (GDPR) | Kept for |
|---|---|---|---|
| Host email address | Sign-in, sign-in and reset codes, security alerts about your account. | Contract (Art. 6(1)(b)) | Until you delete your account |
| Host password | Sign-in. Stored only as a salted one-way hash (PBKDF2-SHA-256). Nobody, including us, can read it. | Contract | Until you delete your account |
| 6-digit email codes | Confirm your email, verify new sign-ins and reset passwords. Stored hashed. | Contract; security (Art. 6(1)(f)) | 10 minutes |
| Your games, setups and custom quizzes | Show your history and let you replay games. Includes team names players chose. | Contract | Until you delete them or your account |
| Consent record | Proof that you accepted this policy and confirmed you are 18 or older (date and policy version). | Legal obligation (Art. 6(1)(c)) | Until you delete your account |
| Invite code used | Hosting is invite-only. | Legitimate interests (Art. 6(1)(f)) | Until you delete your account |
| IP address and request counts | Only to block abuse, such as password guessing. Never used to profile you. | Legitimate interests (security) | Deleted within 24 hours |
| Team names in a live game | Run the game on the screen and phones. | Legitimate interests (providing the game) | Only while the room is in use, plus the host's history |
What we never collect
Real names, phone numbers, addresses, payment details, location, contacts, photos, microphone or camera access, device fingerprints, or any special category of personal data. Players never give us personal data; please choose team names that don't identify anyone.
We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
3. Cookies and device storage
We use only what is strictly necessary for the service, so we don't need a cookie banner:
- vlt_sess: keeps a host signed in for up to 30 days. Secure, HttpOnly (page scripts can't read it), same-site only.
- vlt_dev: remembers a device you have verified with an email code, so you aren't asked again on that device for 90 days.
- Browser storage on phones remembers your team in the current room so a dropped connection can rejoin.
There are no analytics, advertising or third-party cookies. Our fonts and images are served from our own domain, so loading a page does not contact any other company. We honour Global Privacy Control and Do Not Track by default, because we don't track you at all.
5. International transfers
Our providers operate globally, including in the United States and Asia. When personal data leaves the EU, UK or India, we rely on the safeguards the law provides, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum and the EU-US Data Privacy Framework where the provider is certified. Transfers from India follow the DPDP Act and any countries the Government of India restricts.
6. How we protect your data
- Encryption in transit (HTTPS with HSTS) and encryption at rest by our hosting provider.
- Passwords and email codes are stored only as salted hashes.
- Two-step sign-in: a new device needs a code sent to your email as well as your password.
- Failed sign-ins lock the account for 15 minutes; every sign-in, code and sensitive action is rate-limited.
- Strict browser security headers that block clickjacking, mixed content and unauthorised scripts.
- Each host can only see and change their own data. Sign out of all devices at any time.
- Email alerts when your password changes, is reset, or your devices are signed out.
- Expired codes, security logs and old pairing records are deleted automatically every day.
If a personal data breach puts your rights at risk, we will notify the relevant authority within 72 hours where required (GDPR), notify the Data Protection Board of India and affected people as the DPDP Act requires, and tell you without undue delay.
7. Your rights
Most rights work instantly from your dashboard. For anything else, email support@knowbrainergame.com from your account's email address. We reply within one month (GDPR), 45 days (California) or the period set under the DPDP Act, and never charge you or treat you differently for using your rights.
| Right | How |
|---|---|
| Access and a copy (portability) | Dashboard, Account, Download my data: a machine-readable JSON file with everything we hold. |
| Correction | Rename teams, edit or delete setups and quizzes yourself. To change your email, contact us. |
| Erasure ("right to be forgotten") | Dashboard, Account, Delete my account. Everything is erased immediately and permanently. Single games, setups and quizzes can be deleted one by one. |
| Restriction and objection | Email us. We process data only to run the service and keep it secure, never for marketing. |
| Withdraw consent | Delete your account, or email us. Withdrawal doesn't affect what happened before. |
| Know, delete, correct; opt out of sale or sharing (California) | As above. We don't sell or share personal data, so there is nothing to opt out of. |
| Grievance redressal and nomination (India) | Email our grievance officer. You may nominate someone to exercise your rights if you die or become incapacitated. |
8. Children
Host accounts are only for people 18 or older; you confirm this when you sign up. Anyone, including children, can play as part of a team without giving any personal data. We don't knowingly collect personal data from children. If you believe a child has created a host account, email us and we will delete it.
9. Contact and complaints
Questions, requests or complaints: support@knowbrainergame.com. If you're not satisfied with our answer, you can complain to your local data protection authority, for example your EU supervisory authority, the UK Information Commissioner's Office (ico.org.uk), or the Data Protection Board of India.
10. Changes
We will post any change here with a new version number and date. If a change materially affects how we use your data, we will email hosts before it takes effect and ask for consent again where the law requires.