Back to arcade

01 Privacy Statement

Privacy Notice

How Brainbunk handles information when you play, use an account, or choose analytics.

1. Who is responsible

Brainbunk is independently operated in Finland by Peter Lindroos, who is responsible for the personal data described in this notice.

Questions and privacy requests can be sent to support@brainbunk.com.

Effective date and version: 11 September 2026, version 2026-09-11.

2. Information Brainbunk handles

Playing without an account

All seven games can be played without an account. Their game saves, settings, and statistics can be stored in your browser. This includes one local Stockfish Chess game in brainbunk_chess_stockfish_game_v1, the last-used Chess mode in brainbunk_chess_last_mode, one local Gomoku game in brainbunk_gomoku_game_v1, and the current Nonograms puzzle and statistics in brainbunk_nonograms_game_v1 and brainbunk_nonograms_stats_v1. Nonograms data is not synchronized. The Stockfish and Gomoku computer engines run in your browser; their local positions and histories are not sent to Brainbunk, Supabase, OpenAI, or another move-selection service and are not synchronized.

Optional Brainbunk account

If you create or use an account, Brainbunk and Supabase handle your email address, authentication method, session information, user identifier, last sign-in information, and account-linked game saves and statistics. This can include active Sudoku, Merge Grid, and Block Fit saves and statistics for the four games supported by the generic synchronization service.

Signed-in users can separately play Luna. Brainbunk stores each account’s active, completed, and abandoned Luna games, including positions, ordered move history, results, status, selected opponent and model, and account-linked AI-game allowance information, including whether an account has a server-managed exemption from the ordinary weekly start limit. The server validates and records Luna moves so that game can be restored. The browser-local Stockfish save remains separate and is never uploaded. Email-account passwords are handled by Supabase Auth and are not visible to the Brainbunk operator.

When you play against Luna, Brainbunk sends OpenAI the current chess position in FEN notation and the server-generated list of legal move codes so that OpenAI can select one reply. The request does not include your name, email address, Brainbunk user identifier, authentication information, or complete move history. Brainbunk retains each OpenAI Response so the service operator can inspect and diagnose Luna turns in the OpenAI project console. Under OpenAI’s default data controls, those stored Responses are retained for at least 30 days; this period can differ if OpenAI-approved organization or project-level data-retention controls apply. Brainbunk validates the returned move before recording it and does not use the AI response for a separate chat or profile.

Optional Google and Microsoft sign-in

If you choose Sign in with Google, Google authenticates you and provides Supabase with basic profile information: your Google account identifier, verified email address, name, and profile image. Brainbunk uses this information only to create or sign in to your Brainbunk account and provide synchronization. Brainbunk does not receive your Google password or request access to Gmail, Drive, Calendar, contacts, or other Google services.

If you choose Sign in with Microsoft, Microsoft authenticates you and provides Supabase with your Microsoft account identifier, email address, and basic profile information used for sign-in. Brainbunk uses this information only to create or sign in to your Brainbunk account and provide synchronization. Brainbunk does not receive your Microsoft password or request access to Outlook, OneDrive, calendars, contacts, or other Microsoft services.

Optional Google Analytics

Google Analytics is disabled by default. If you select Accept analytics, Google Analytics receives information about visits and interactions, device and browser characteristics, and approximate location derived from network information. Brainbunk uses the resulting statistics to understand how the site is used and improve it. Google sign-in and Google Analytics are separate features.

Technical and support information

The web server and infrastructure providers may process IP addresses, requested URLs, timestamps, browser details, and security events in technical logs. If you email support, Brainbunk also handles your email address, message, and any information you choose to include.

3. Purposes and legal bases

  • Games and requested browser features: to provide the game, saves, statistics, and privacy settings you choose.
  • Accounts, synchronization, and Luna Chess: to provide the optional Brainbunk account service, synchronize supported game data, validate and restore signed-in Luna games, generate an opponent move, enforce game allowances, and perform the Terms of Use agreed with you.
  • Security and reliability: for Brainbunk’s legitimate interest in operating, protecting, diagnosing, and preventing misuse of the service.
  • Support: to respond to your request and, where necessary, manage the Brainbunk account service.
  • Google Analytics: only with your consent. You may withdraw it at any time through Cookie settings.

4. Service providers

  • Supabase, Inc.: account authentication, sessions, account deletion, storage of synchronized game data, and authoritative Luna positions and move history. Stockfish and Gomoku games are not sent to Supabase. Each Supabase project has a primary hosting region, while Supabase and its subprocessors may also process service data where needed to provide and secure the service.
  • OpenAI: generation of a legal move for the optional Luna Chess opponent. OpenAI receives only the current FEN position and legal move codes described above, not Brainbunk account or authentication details. OpenAI may process limited request and response information in provider-managed safety and abuse-monitoring logs according to its API data controls.
  • Google services: Google sign-in when you choose it, Google Analytics after consent, and delivery of the site’s web fonts. Google services may be provided by Google Ireland Limited, Google LLC, and their affiliates.
  • Microsoft services: Microsoft Entra ID authenticates personal, work, or school Microsoft accounts when you choose Microsoft sign-in. Microsoft services may be provided by Microsoft Ireland Operations Limited, Microsoft Corporation, and their affiliates.
  • Hetzner Online GmbH and Hetzner Finland Oy: VPS hosting in Finland, including web delivery and technical logs.
  • OVH SAS: domain, DNS, and email services based in France. Support messages sent to Brainbunk are delivered through this email service.

These providers process only the information needed for their role and may use their own approved subprocessors. Google, Microsoft, Supabase, and OpenAI may process some information outside the European Economic Area. Where required, they state that they use recognized transfer safeguards such as adequacy decisions or standard contractual clauses.

5. How long information is kept

  • Browser game data and privacy choices remain until replaced, deleted in the game, or cleared through browser controls.
  • Active account data, synchronized game data, and active, completed, or abandoned Chess games remain while the account is used. Accounts with no sign-in or recorded account activity for more than 12 months may be removed during an account review, which is performed at least once a year.
  • Brainbunk does not retain a separate OpenAI conversation. The selected AI move becomes part of the stored Chess history. OpenAI-managed safety or abuse-monitoring records, if created, expire under OpenAI’s API data-control and legal-retention rules.
  • Ordinary Brainbunk web-server access and security logs are normally kept for up to 30 days. Relevant records may be kept longer while investigating a security or abuse incident.
  • Support messages are normally kept for up to 12 months after the matter is resolved, and longer only when reasonably needed for an ongoing dispute or legal obligation.
  • Brainbunk keeps Google Analytics user and event data for up to 14 months. Aggregated reports may remain available for longer.

Deleting an account immediately removes the live Supabase account and its linked Brainbunk cloud data. Provider-managed logs and backup copies may remain until their normal rotation periods expire. They are not used to restore a deleted account to the live service, except if a general disaster recovery process temporarily restores an earlier system state.

6. Your choices and rights

You can play all seven games without an account, including local Chess against Stockfish and local Gomoku against the TypeScript Computer Opponent. Those local game records remain in the current browser and are not synchronized. Gomoku does not use an LLM for move selection. Playing Chess against Luna is optional, requires sign-in, and sends the limited chess-position request described above to OpenAI. Cookie settings in the footer let you change your analytics choice at any time.

Under the GDPR, where applicable, you may request access to, correction of, deletion of, restriction of, or a portable copy of your personal data, and you may object to certain processing. You may withdraw consent without affecting processing that occurred before withdrawal. Send a request to support@brainbunk.com; Brainbunk will normally respond within one month.

If a privacy concern cannot be resolved directly, you may contact the Office of the Data Protection Ombudsman in Finland or the data protection authority where you live.

Brainbunk does not use personal data for advertising and does not make decisions that produce legal or similarly significant effects through automated processing.

7. Deleting a Brainbunk account

Signed-in users can open Account Information and choose Delete Brainbunk Account. Email-password users re-enter their current password directly with Supabase Auth. Google and Microsoft users verify the same social sign-in again and then confirm deletion of the Brainbunk account.

Deletion removes the Supabase account record, Brainbunk’s stored Google or Microsoft sign-in identity links, account-linked cloud saves and statistics, stored Luna positions and move history, and any account-linked AI-game allowance exemption through database deletion cascades. It does not delete the Stockfish or Gomoku game saved in the current browser. It also does not delete or change the user’s Google Account, Microsoft account, or data held by those services. Limited provider records may remain until their normal retention period ends.

Google or Microsoft may continue to list Brainbunk among the user’s applications or third-party connections. Google authorization can be reviewed in Google Account third-party connections; Microsoft authorization can be reviewed in the user’s Microsoft account or organization application settings. Brainbunk account deletion cannot be cancelled, and the on-screen success message confirms completion.

Game information stored only in the current browser remains on that device and can be removed through the game or browser’s site-data controls. If deletion cannot be completed, contact support@brainbunk.com.

8. Changes and questions

This notice will be updated when Brainbunk’s handling of personal data materially changes. The effective date above identifies the current version. Questions can be sent to support@brainbunk.com.