Privacy Policy - BrainBaton

Plain-language summary: BrainBaton uses a user-chosen arena nickname and a random anonymous Firebase account for online rooms, shared daily challenges, and skill ratings. It does not request an email address, phone number, password, or legal name. Local Arena uses Nearby Connections to exchange match data directly with devices that the user chooses to connect to.

1) Who we are

BrainBaton is provided by Saifullah Ahad ("we", "us", "our").

2) What BrainBaton does

BrainBaton is a cognitive-training game with Solo Daily, Local Arena, and Online Arena modes. It presents six types of timed cognitive exercise, calculates in-game scores and skill ratings, and can show selected room information to the people a user chooses to play with. Ratings are game-performance measures, not a medical, psychological, or intelligence assessment.

3) Information used for accounts and online play

• Arena nickname: a 3-20 character display name chosen by the user. It need not be a legal name.
• Anonymous account identifier: Firebase Authentication creates a random UID. BrainBaton does not request an email address, phone number, password, or social sign-in.
• Room activity: room membership, mode, team/connection state, module, score, and reconnect state.
• Training activity: raw answers, answer timing, correctness, normalized score, six skill ratings, completed rounds, daily results, and percentile.
• Preset reactions: one of four developer-written reactions, processed only when a user chooses to send it.
• Safety reports: reporter and reported anonymous IDs, room, selected category, and time, processed only when a user reports another player.
• Technical identifiers: Firebase and Google services may process installation and standard network identifiers needed to authenticate, route, and protect requests. BrainBaton does not request the advertising ID.

4) Information stored on the device

BrainBaton can keep the following in Android app-private Room/DataStore storage:

• arena nickname and preferences;
• reduced-motion, haptic, and reminder choices;
• six skill ratings and recent training-session history;
• a cached daily challenge seed and result; and
• the local blocked-player list.

Android cloud backup and device-transfer extraction are disabled for BrainBaton data. Local data can be removed through the in-app deletion action, Android Settings, or by uninstalling BrainBaton.

5) Local Arena and Nearby Connections

Local Arena uses Google Play services Nearby Connections. Devices that a user deliberately connects can exchange the arena nickname, a temporary reconnect token, and the challenge, timing, input, score, and connection state needed for that match. The token exists only for the running app session and lets the same player reclaim a slot after a brief connection drop. The developer's Firebase backend does not receive Local Arena match traffic merely because Nearby mode is used.

Depending on Android version, discovery can require Bluetooth, Wi-Fi, nearby-device, or legacy coarse/fine location permission. BrainBaton does not call location APIs, derive or keep physical-location history, or show physical location to players or the developer.

6) Services and how information is shared

BrainBaton uses these Google services:

• Firebase Authentication: anonymous account creation.
• Cloud Firestore: profiles, rooms, participants, ratings, daily challenges, and safety reports.
• Firebase Realtime Database: low-latency online room state and preset reactions.
• Cloud Functions for Firebase: room operations, challenge generation, answer validation, scoring, rating updates, reports, and account deletion.
• Google Play services Nearby Connections: direct Local Arena discovery and connectivity.

Google processes cloud and Nearby data as a service provider. Read the Firebase privacy information and Google Privacy Policy.

Chosen room members can see an arena nickname, team/connection state, scores, and preset reactions. Raw answers are not shown to other players. Safety reports are restricted to backend/admin access. We do not sell personal information or share it for advertising or marketing.

7) Permissions

• INTERNET and ACCESS_NETWORK_STATE: Firebase rooms, shared daily data, profiles, and connection state.
• Bluetooth, Wi-Fi state, and nearby-device permissions: Local Arena discovery/connectivity.
• Legacy coarse/fine location on older Android versions: required by the Android/Nearby permission model for nearby discovery; not used to collect physical location.
• POST_NOTIFICATIONS: optional daily reminder on supported Android versions.
• VIBRATE: optional haptic/reminder feedback.
• WAKE_LOCK, RECEIVE_BOOT_COMPLETED, and FOREGROUND_SERVICE: Android WorkManager support for the optional scheduled reminder.
• com.google.android.c2dm.permission.RECEIVE and com.google.android.providers.gsf.permission.READ_GSERVICES: Firebase and Google Play services plumbing for authenticated cloud connectivity; BrainBaton does not read personal messages or Google account content.
• An app-scoped dynamic-receiver permission prevents other apps from sending protected internal broadcasts to BrainBaton.

BrainBaton does not request camera, microphone, contacts, SMS, call log, calendar, media/storage, health, accessibility, all-files, advertising-ID, or payment permission. Advertising-ID and AdServices permissions contributed by dependencies are explicitly removed from the merged manifest.

8) Information we do not collect

BrainBaton does not collect email address, phone number, postal address, physical location, contacts, photos, videos, audio, files, calendar information, health data, financial/payment data, web-browsing history, advertising ID, analytics events, or crash reports. There is no advertising, analytics, billing, open-ended chat, private messaging, public feed, or media upload.

9) Feedback and external links

Send Feedback opens the user's installed email app with BrainBaton's public support address. BrainBaton does not transmit an email or its contents automatically. The user's email provider controls information they choose to send. Fixed portfolio, developer, privacy, and Play Store links open only after a user action.

10) Security and retention

Cloud traffic uses encrypted transport. Authentication and security rules restrict access, and backend functions control profile, authoritative-score, and report writes. Raw answer keys and authoritative outcomes are not readable by other clients. No storage or transmission method can be guaranteed perfectly secure.

Local records remain until cleared or uninstalled. Cloud profile/rating data remains until profile deletion or operational removal. Room records are retained only as needed for multiplayer operation, security, and abuse handling. Safety reports may be retained as needed to investigate a concern or meet legal/safety obligations.

11) Deletion and user choices

• Delete the cloud profile and local records: open BrainBaton Settings, choose Delete cloud profile, confirm, then choose Delete profile.
• Clear local storage: use Android Settings > Apps > BrainBaton > Storage > Clear storage.
• Uninstall: removes BrainBaton's local app data.
• Request help or deletion: copy the Deletion request ID shown in BrainBaton Settings, then email it to www.saifullah.ai@gmail.com.

The in-app deletion function removes the Firebase anonymous Authentication account, cloud profile and ratings, room participation, submissions, private challenges, daily attempts, and local records. Safety reports authored by the deleting account are removed. Reports about that account may be retained only when reasonably necessary to investigate abuse, protect users, or meet a legal obligation; retained target IDs are irreversibly replaced with a deletion tombstone. The deletion request ID is needed to locate an anonymous account when handling an email request; the in-app path remains the fastest option when the app is installed.

12) Children's privacy and safety

BrainBaton is intended for users aged 13 and over and is not directed to children under 13. We do not knowingly seek personal information from children under 13. BrainBaton prohibits child sexual abuse and exploitation (CSAE), grooming, sexual solicitation, threats, harassment, and impersonation. Read the separate BrainBaton Child Safety Standards.

13) International processing

Google may process Firebase and Nearby service data in countries outside the user's own country, subject to Google's terms and safeguards. BrainBaton's Cloud Functions are deployed in the United States region.

14) Changes to this policy

We may update this policy when BrainBaton's behavior or legal requirements change. The current version will remain available at privacy.saifullah.ai/BrainBaton.html, with the effective date updated above.

15) Contact

Privacy questions and deletion requests can be sent to Saifullah Ahad at www.saifullah.ai@gmail.com.