🧠 CogSmith — Privacy Policy
CogSmith is a set of cognitive-training puzzles. This policy describes exactly what the app collects, why, where it is stored, and how to get rid of it. It is written to match what the code actually does — not to cover things the app might do one day.
The short version
- You can play every game without an account. Choose “Play as Guest” and nothing leaves your device.
- If you sign in, we store your email or phone number — solely to identify your account — and your game scores, so they follow you to a new device.
- Your contact details are never shown on a leaderboard. Only a display name and a score are public.
- We do not sell your data, run advertising, or use third-party analytics or tracking cookies.
What is collected, and why
| Data | Why | Where it is stored |
|---|---|---|
| Email address or phone number | To identify your account and send you a one-time sign-in code | Google Firebase Authentication and a private Firestore record only you can read |
| Display name | Shown on leaderboards next to your score | Firestore — this field is public by design |
| Game scores, times, streaks, difficulty settings | To show your progress and rank entries on leaderboards | Your device, and Firestore when signed in |
| Sign-in verification codes | To confirm you control the address or number you entered | Stored only as an unreadable hash, and deleted the moment the code is used or expires (5 minutes) |
| Sound, difficulty and accessibility preferences | To keep the app set up the way you left it | Your device only — these are never uploaded |
What is not collected
- No location, contacts, photos, microphone or camera access — the app requests none of these permissions.
- No advertising identifiers, and no advertising.
- No third-party analytics or behavioural tracking.
- No passwords in readable form. Passwords are hashed and we cannot read yours.
Playing as a guest
Guest play stores everything in your browser or app’s local storage on your own device. Nothing is transmitted to us. Clearing the app’s data — or uninstalling it — erases that history permanently, and we have no copy to restore.
Leaderboards
When you set a personal best, one row is published for you per game containing your display name, score, time, move count, difficulty and a timestamp. That is the complete list. This is enforced on the server, not just in the app: the database rejects any leaderboard entry containing any other field, so a contact detail cannot reach a public record even if the app were modified. If you would rather not appear, set a pseudonym as your display name, or play as a guest.
Who else sees your data
Three service providers process data on our instructions in order to run CogSmith:
- Google Firebase — accounts, sign-in, and the database holding your profile and scores.
- Cloudflare — serves the website and app files. It handles your network requests; it does not receive your account data.
- Resend — delivers sign-in codes to your email address.
There are no other recipients. Your data is never sold, and never shared for marketing.
How long it is kept
Account and score data is kept until you delete your account. Sign-in codes are deleted within five minutes. Deletion is immediate and permanent — there is no recovery window.
Deleting your data
Open your profile in the app and choose Delete account. This erases your profile, your saved scores and every leaderboard entry belonging to you, then removes the account itself. You can also email privacy@cogsmith.org and ask us to do it.
Your rights
Depending on where you live — under the EU/UK GDPR, India’s Digital Personal Data Protection Act, or the CCPA — you have the right to access, correct, export or delete your data, and to withdraw consent. Contact privacy@cogsmith.org to exercise any of them. We respond within 30 days.
Children
CogSmith is not directed at children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
Changes
If this policy changes materially, the date at the top changes and the app shows a notice on next launch. Continued use after that constitutes acceptance.