Privacy policy

Last updated: July 4, 2026

What we collect

Account data — your name, email address, password (stored hashed), and language preference. If you enable two-factor authentication, we also store your 2FA secret and recovery codes (encrypted).
Session data — your IP address, browser user agent, and last-activity time, attached to your login session.
Test results — for each test you take: the test type, when you started and finished, your score, and per-round details (what was shown, how you responded, and your reaction times).

Why we collect it

To provide the service (performance of contract) — your account, saved results, and progress charts.
To keep your account secure (legitimate interest) — sessions, login throttling, and two-factor authentication.
To send you essential email (performance of contract) — email verification and password resets only. No marketing email.

We do not use your data for advertising, we do not build profiles of you, we make no automated decisions about you, and we never sell your data. We rely on a small number of infrastructure providers to run the site (EU-based hosting and a US email-delivery service certified under the EU–US Data Privacy Framework), and we share your data with no one else unless legally required.

Cookies

We set only strictly necessary, first-party cookies: a session cookie and a security token that expire after two hours of inactivity, plus an optional long-lived cookie that keeps you logged in across visits if you tick “Remember me” (removed when you log out). There are no analytics, tracking, or third-party cookies — which is why this site shows no cookie banner.

Retention and deletion

We keep your data for as long as your account exists. You can delete your account at any time in Settings → Profile — this permanently removes your account and all of your test data. Routine server backups are retained for a limited period before being overwritten.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you;
correct it, or delete it (deleting your account does this in full);
receive a copy of it in a portable format;
restrict or object to how we process it;
lodge a complaint with your local data protection authority.

To exercise any of these rights, email support@stupidbrains.com.

Not medical data

stupidbrains is for fun. Test scores are entertainment, not medical or psychological assessments, and we do not treat them as health data. The service is not directed at children under 16.

Changes to this policy

If this policy changes materially, we will update this page and the "last updated" date at the top.