Privacy Policy

1. Summary

BrainRecally is designed to work without knowing who you are. There is no sign-up, no login for regular visitors, and no user profile.

In practice, that means:

• Browsing and studying decks requires no personal information from you.
• We collect personal data only when you voluntarily send it — for example via the contact form.
• Our servers keep standard technical logs (IP address, browser type) for security and diagnostics.
• Third-party advertising and analytics providers set their own cookies, which you can control.
• We do not sell, rent or trade your personal data.

This summary is for convenience; the sections below are the operative terms.

2. Who we are

Brainrecally ("BrainRecally", "we", "us", "our") operates the website at brainrecally.com. For the purposes of the UK GDPR and EU GDPR, we act as the data controller for personal data processed through the Service.

You can reach us about any privacy matter at support@brainrecally.com.

3. What we collect

3.1 Information you give us voluntarily

When you complete the contact form or email us, we receive:

• Name — so we can address our reply.
• Email address — so we can respond.
• Enquiry type and subject line — to route your message.
• Message content — whatever you choose to write.
• Consent record — confirmation that you agreed to be contacted, plus timestamp.

Please don't include sensitive personal information (health details, financial data, government identifiers) in your message — we have no need for it.

3.2 Information collected automatically

Like virtually all websites, our servers log technical data on each request:

Data	Purpose
IP address	Security, abuse prevention, rate limiting, coarse geolocation
Browser type and version (user agent)	Compatibility and rendering diagnostics
Operating system and device type	Responsive design decisions
Pages visited, timestamps, referring URL	Understanding which content is useful
Error and crash details	Diagnosing and fixing bugs

We also record an aggregate view count per deck. This is a simple counter and is not linked to you or your IP address.

3.3 What we deliberately do not collect

• No passwords or credentials from regular visitors — there are no visitor accounts.
• No payment or card details — the Service is free and we take no payments.
• No precise GPS location.
• No contact lists, photos, files or device storage access.
• No biometric data.
• No stored record of which specific cards you got right or wrong — study progress lives only in your browser for the current session.

4. Why we use your information

• To respond to you — replying to enquiries, corrections and requests.
• To operate and secure the Service — serving pages, preventing abuse, blocking attacks, applying rate limits.
• To improve content — aggregate data on popular decks guides what we write next.
• To fix problems — diagnosing errors and performance issues.
• To fund the Service — displaying advertising, which pays hosting and content costs.
• To comply with law — meeting legal obligations and responding to lawful requests.

We do not use your data for automated decision-making or profiling that produces legal effects for you.

5. Legal basis for processing (UK/EU GDPR)

Processing	Legal basis
Responding to your enquiry	Consent (Art. 6(1)(a)) — given via the form checkbox
Server logs, security, abuse prevention	Legitimate interests (Art. 6(1)(f)) — protecting the Service
Aggregate content analytics	Legitimate interests (Art. 6(1)(f)) — improving the Service
Non-essential and advertising cookies	Consent (Art. 6(1)(a)) — where required by law
Meeting legal obligations	Legal obligation (Art. 6(1)(c))

Where we rely on consent, you may withdraw it at any time — see Your rights.

6. Cookies and similar technologies

Cookies are small text files stored by your browser. We use them sparingly.

Essential cookies (set by us)

Cookie	Purpose	Duration
XSRF-TOKEN	Protects forms against cross-site request forgery	Session
brainrecally_session	Maintains session state and validates form submissions	Session / 2 hours

These are strictly necessary for the site to function securely and cannot be disabled without breaking core features.

Third-party cookies

Our advertising and analytics providers may set their own cookies and similar identifiers. These are governed by their privacy policies, not ours — see the next two sections.

Managing cookies

You can block or delete cookies through your browser settings (Chrome, Firefox, Safari, Edge). Blocking essential cookies may prevent forms from working.

7. Advertising and Google AdSense

BrainRecally is funded by advertising. We use Google AdSense and may work with other advertising networks.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads based on your visits to our site and/or other sites on the internet.
• You may opt out of personalised advertising by visiting Google Ads Settings.
• You may opt out of third-party vendor cookies at aboutads.info/choices or youronlinechoices.com.
• Opting out means you will still see ads — just less relevant ones.

Google's practices are described in the Google Privacy & Terms — How Google uses information from sites that use our services.

We display no advertising inside study mode. Once you open a deck to study, the screen stays clean.

8. Analytics

We may use privacy-respecting analytics to understand aggregate usage — which decks are popular, which pages error, roughly where visitors come from. Where we use Google Analytics, we enable IP anonymisation where available and do not combine analytics data with personal identifiers.

You can opt out of Google Analytics across all sites with the Google Analytics Opt-out Browser Add-on.

We also honour browser Global Privacy Control (GPC) signals where technically feasible.

9. Who we share data with

We share personal data only in these limited circumstances:

• Hosting and infrastructure providers — who store and serve the site on our behalf, under contract.
• Email delivery providers — to transmit contact-form messages and our replies.
• Advertising and analytics partners — as described above, generally via cookies rather than direct transfer.
• Professional advisers — legal or accounting advisers, where necessary and confidential.
• Legal and regulatory bodies — where we are legally required to disclose, or to protect our rights, property or safety, or those of our users.
• A successor entity — in the event of a merger, acquisition or asset sale, subject to this policy continuing to apply.

We do not sell your personal data, and we do not share it for cross-context behavioural advertising beyond the cookie-based advertising described above.

10. International data transfers

Our service providers may process data outside the UK and EEA, including in the United States. Where personal data is transferred internationally, we rely on appropriate safeguards such as UK/EU adequacy decisions, the UK International Data Transfer Addendum, or Standard Contractual Clauses approved by the relevant authority.

11. How long we keep data

Data	Retention period
Contact form messages	Up to 24 months after the matter is resolved, then deleted
Server access logs	Typically 30–90 days
Error and diagnostic logs	Up to 90 days
Aggregate deck view counts	Indefinitely — not personal data
Third-party cookies	Per the relevant provider's policy

We delete or anonymise personal data once it is no longer needed for the purpose it was collected.

12. Security

We apply appropriate technical and organisational measures, including:

• HTTPS/TLS encryption on all traffic.
• Content Security Policy and hardened HTTP security headers.
• CSRF protection on all form submissions.
• Rate limiting and spam filtering on the contact form.
• Restricted administrative access with hashed credentials.
• Regular dependency and framework updates.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority — and you where required — without undue delay.

13. Your rights

Under the UK GDPR and EU GDPR you have the following rights regarding your personal data:

• Access — obtain a copy of the personal data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten") — have your data deleted where there is no overriding reason to retain it.
• Restriction — ask us to limit how we use your data.
• Objection — object to processing based on legitimate interests, including direct marketing.
• Portability — receive your data in a structured, machine-readable format.
• Withdraw consent — at any time, where processing relies on consent.
• Complain — lodge a complaint with a supervisory authority.

To exercise any right, email support@brainrecally.com with "Data request" in the subject line. We respond within one month, extendable by two further months for complex requests (we will tell you if so). There is no charge, unless a request is manifestly unfounded or excessive. We may ask for information to verify your identity.

In the UK you may complain to the Information Commissioner's Office (ICO). In the EEA, contact your national data protection authority. We'd appreciate the chance to resolve matters directly first.

14. US state privacy rights

If you are a resident of California or another US state with comprehensive privacy legislation, you may have the right to know what personal information is collected, to request deletion or correction, to opt out of "sale" or "sharing" of personal information and of targeted advertising, and not to be discriminated against for exercising these rights.

We do not sell personal information as that term is defined under the CCPA/CPRA. Cookie-based advertising may constitute "sharing" for cross-context behavioural advertising; you can opt out via the links in section 7, by enabling Global Privacy Control in your browser, or by emailing us.

To submit a request, email support@brainrecally.com with "Privacy request" in the subject line.

15. Children's privacy

The Service is intended for a general audience and is not directed at children under 13. We do not knowingly collect personal data from children under 13 (or under 16 where local law sets that threshold).

If you believe a child has provided us with personal data, contact support@brainrecally.com and we will delete it promptly. Parents and guardians: because studying requires no account, children can use the Service without disclosing any personal information at all.

16. Changes to this policy

We may update this policy to reflect changes in our practices, technology, or legal requirements. The current version always appears on this page with the effective date at the top.

For material changes we will update that date and, where appropriate, display a prominent notice on the site. Continued use after changes take effect indicates acceptance.

17. Contact us

For any privacy question, request or complaint:

• Email: support@brainrecally.com
• Contact form: brainrecally.com/contact
• Subject line: use "Data request" or "Privacy request" so we can prioritise it

We aim to acknowledge privacy correspondence within 5 working days and to resolve it within one month.