Privacy Policy
Last updated 4 November 2026
Introduction
Braineey is a quiz game you play in your browser. This policy says what we keep about you when you play or use this website, why we keep it, who else sees it, how long we keep it and what you can ask us to do with it.
Who we are: Braineey is run by its operator, called "we" and "us" on this page. We decide how your data is used, which makes us responsible for it under Kenya's Data Protection Act, 2019.
Information we collect
- Your game, with or without an account. Your nickname (we make one up until you choose your own), your answers, your scores, how long each answer took and your streaks. Also the Daily 10s, Sudden Death runs, practice games, duels, live games and live shows you play, and the sides you pick in rivalries. Before you sign in, all of this is tied to your browser by a cookie.
- If you sign in with an email address. The address, when you last signed in, and a password if you set one, stored only as a one-way hash that cannot be turned back into the password.
- If you sign in with Google or Facebook. Your email address, whether they confirmed it, and the identifier they give us for you, stored encrypted, so the same account opens next time. Your account takes its name from your email address until you change it. We do not keep your profile photo, and we never see your password, your contacts or your posts. If we need to email you a code to confirm the address, we keep the waiting sign-in, with your IP address and browser, until the time set out below.
- What you add in your account settings. A name, a username and a phone number, all optional. If the phone number is an M-Pesa number, we fill it in for you when you buy lives.
- Lives and payments. How many lives you have and every change to them: bought, used in a run, or given by us. For each purchase: the pack, its price, what happened to it and the masked phone number M-Pesa shows (like 25471****678). For each M-Pesa payment: the phone number you paid from, the amount, the M-Pesa receipt number and Safaricom's replies. If we send you money by M-Pesa, such as a refund, we keep the same details of that payment.
- Emails and notifications. We email you sign-in links, codes and messages about your account. In the app, we keep what we sent you and whether you opened it. If you allow push messages, we keep the address your browser gave us for them, its keys, which messages you want and when we last sent one.
- Feedback. The message you send us and the screen you sent it from.
- How the game is used. The days you open the game, and the days a sponsor's banner was shown to you. Everything else we count (games finished, screens viewed, shares, taps on a sponsor's link) is kept as a total that names nobody.
- Fair play. In live shows, which answer you chose and how fast. When the answers look like cheating, we keep a note of why, for a person to review.
- Security records. The IP address and browser of each sign-in and each failed sign-in, Google or Facebook sign-ins linked to or removed from your account, and activity that looks like abuse, such as too many attempts.
- Error reports. When something breaks, a record of the fault. It can include the page you were on and technical details of the request.
We do not ask for your ID number, your date of birth or your phone's location.
How we use it
We use your data only for these purposes, each on a legal ground the Act allows.
- To run the game you asked for. Your games, scores, streaks, history and places on leaderboards; keeping your game when you sign in on another device; selling you lives and adding them to your balance; sign-in links and messages about your account. The ground: our agreement with you, the Terms of Service.
- To keep the game safe and fair. Protecting accounts, telling people from bots, limiting how often something can be done, spotting cheating and fixing faults. The ground: our legitimate interest in a safe and fair game, which we weigh against your rights.
- To understand how the game is played. How many people play, come back and finish games, and how many saw or tapped a sponsor's banner. The ground: our legitimate interest in improving the game and paying for it.
- To keep payment records. The ground: the law, which requires us to keep them.
- To send push messages. Only if you allow them in your browser. The ground: your consent, which you can withdraw at any time in your browser's settings.
We do not sell your data and we do not use it for targeted advertising. Sponsor banners are the same for every player on a screen and day; they are not chosen from your data. No decision about you is made by a computer alone: when the game flags possible cheating, a person reviews it before anything is decided.
Where your data is stored
Our servers are run by OVHcloud. Your data, and the services listed under Sharing, may be stored and processed outside Kenya. When your data leaves Kenya, we rely on the safeguards the Data Protection Act, 2019 requires for such transfers.
How long we keep it
- Your account, your game, your lives, your notifications and your feedback: for as long as you keep them. Delete my data, on Me, deletes them at once.
- A guest game: until it is deleted. If your browser loses the cookie that ties the game to you, we can no longer tell that it is yours.
- Sudden Death: a finished run is kept only as your record (your best and last scores, and how many runs). A run left unfinished is deleted after 7 days.
- The days you opened the game and saw a sponsor's banner: 13 months, then deleted. The daily totals worked out from them name nobody and are kept.
- A Google or Facebook sign-in waiting for its emailed code: 24 hours, then deleted.
- Payment records: for as long as Kenyan tax and financial law requires, which can be longer than your account. If you delete your data, they stay without your account.
- Security records: for as long as they are needed to protect accounts and look into abuse, which can be longer than your account.
- Error reports: 30 days, then deleted, except the latest report of a fault we are still fixing, which is deleted once it is fixed and that time has passed.
Copies of deleted data can remain in our backups until those backups are deleted in turn.
Data security
- Every connection to the game is encrypted (HTTPS).
- Passwords are stored only as one-way hashes. The identifiers Google and Facebook give us are stored encrypted, and so is your session cookie.
- Security records are kept in a log that shows if any entry was changed.
- In our console, each part needs its own permission. Returning an M-Pesa payment needs a second person to approve it.
No system is perfectly secure. If a breach puts your data at risk, we tell the Data Protection Commissioner and, where the Act requires it, we tell you.
Children
Kenya's Data Protection Act treats anyone under 18 as a child. If you are under 18, you need a parent's or guardian's consent to create an account, and buying lives is for adults or for players with a parent's or guardian's consent.
We do not knowingly keep a child's data without that consent. If you are a parent or guardian and think your child has an account without it, use Delete my data on their device, and we delete it.
Your rights
Under Kenya's Data Protection Act, 2019, you have the right to:
- be told how we use your data, which is what this page is for;
- see the data we hold about you, and have a copy of it in a common, machine-readable format;
- have it corrected: change your nickname on Me and your details in account settings, or ask us;
- have it deleted, as set out in Deleting your data;
- object to how we use it, or ask us to limit it;
- withdraw a consent you gave, such as for push messages, at any time;
- not be subject to a decision made by a computer alone.
We may ask you to show that the request is yours, and we answer within the time the Act and its regulations set: a request to delete your data is carried out within 14 days, free of charge.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Office of the Data Protection Commissioner (ODPC), Kenya's regulator, at odpc.go.ke.
Changes
When this policy changes we update this page and the date at the top. If a change affects how we use what we already hold, we tell signed-in players in the app first.