Privacy Policy

Synapgeek is an indie studio based in France, developing mobile puzzle game applications. This privacy policy applies to all Synapgeek applications and services, including Cerebrum (hereinafter "the App").

For any questions regarding the protection of your data, you can contact us at: privacy@synapgeek.com

We collect the following categories of data:

Account data If you create an account via Apple, Google, or Facebook: unique identifier, email address, display name, and profile photo (depending on the provider). You may also use the App without an account (anonymous mode).

Gameplay and progression data Scores, completion times, hints used, mistakes, stars earned, levels completed, difficulty level, attempts, best records, daily challenges, play streaks.

Virtual currency and customization data Gem balance, in-app transaction history, unlocked avatars, monthly trophies, experience points (XP), league/ranking.

Device and usage data Device type, operating system version, language, anonymized usage data, diagnostics, error logs, app performance data.

Notification data To send you notifications and update Live Activities on iOS, we associate the following with your device: your FCM (Firebase Cloud Messaging) token, ActivityKit tokens (push-to-start and Live Activity updates) on iOS, your time zone, language, App version, Live Activities activation status, and platform (iOS or Android). On Android, this feature relies on the notification permission and Firebase Cloud Messaging. This data is deleted along with your account.

Advertising data Advertising identifier (IDFA on iOS, with your consent via App Tracking Transparency; AAID on Android, see "Advertising and tracking technologies"), ad interactions, conversion events, attribution data via SKAdNetwork on iOS. Our advertising partner (Google AdMob) also derives an approximate location from your IP address for ad targeting purposes, and our consent management platform (CMP) uses this approximate location to determine whether you are located in the European Economic Area, the United Kingdom, or Switzerland.

Transaction data In-app purchase and subscription history, processed by Apple via StoreKit 2 on iOS and by Google Play Billing on Android. Synapgeek does not collect or store your payment information.

Data we do NOT collect The App never requests access to your location and does not use any GPS data. An approximate location is, however, derived from your IP address by our advertising partner, as described under "Advertising data" above and "Advertising and tracking technologies" below. We do not otherwise collect any health, contacts, photos, camera, calendar, or microphone data.

In accordance with the General Data Protection Regulation (GDPR), we process your data on the following legal bases.

For the App. We rely on performance of a contract for processing necessary to provide the service (account, progression, purchases, synchronization), on your consent for personalized advertising, the advertising identifier (IDFA on iOS, AAID on Android), and non-essential cookies and tracking technologies, and on our legitimate interest for first-party analytics, App improvement, fraud detection, and security.

For the synapgeek.com website. We rely on your consent for Google Analytics 4 audience measurement, where your agreement is required (see the "The synapgeek.com website" section), on our legitimate interest for cookie-free measurement of traffic and performance via Vercel Analytics and Vercel Speed Insights, reCAPTCHA protection of the contact form, and Google Analytics 4 audience measurement active by default outside the zones where your agreement is required — you can object to it at any time via the consent banner or "Manage cookies" —, and on pre-contractual measures or legitimate interest, depending on your message, for handling messages sent through the contact form, in order to reply to you.

You may withdraw your consent at any time through the App's privacy settings, your device settings, or, for the website, the banner accessible via "Manage cookies".

Your data is used to:

• Provide, maintain, and improve the App and its features
• Synchronize your progress across devices (if signed in)
• Manage your account and preferences
• Process your in-app purchases and subscriptions
• Display advertisements (personalized with consent, or contextual)
• Measure the effectiveness of our advertising campaigns (conversion measurement, with your consent)
• Analyze aggregate usage to improve the user experience
• Detect and prevent abuse, fraud, and technical issues
• Manage leaderboards and the league system

The App displays advertisements served by Google AdMob. Users with a Premium subscription, or a legacy "Ad-Free" subscription, do not see forced advertisements (banners and interstitials); rewarded ads remain available if they choose to watch them.

Advertising consent (EEA/UK/Switzerland) For users located in the European Economic Area, the United Kingdom, and Switzerland, a Consent Management Platform (CMP) is displayed at first launch. You can change your preferences at any time through the App's privacy settings.

App Tracking Transparency (ATT) On iOS 14.5 and later, the App requests your permission before accessing your advertising identifier (IDFA). If you decline, ads are not personalized using your advertising identifier. Declining tracking does not affect any App functionality.

Android advertising identifier (AAID) On Android, the App may access your Google Advertising ID (AAID) to display personalized ads — subject, for users in the EEA, the United Kingdom, and Switzerland, to the consent collected through the consent management platform described above. You can reset this identifier or opt out of personalization entirely at any time from your device settings (see "Opting out of personalized ads" below). Declining does not affect any App functionality.

SKAdNetwork (iOS only) On iOS, the App uses Apple's SKAdNetwork framework for advertising attribution. This mechanism does not allow you to be personally identified.

Opting out of personalized ads You can disable personalized ads at any time via:

• Privacy settings within the App
• iOS Settings > Privacy & Security > Tracking
• Android Settings > Google > Ads
• The Premium subscription, which removes forced ads (banners and interstitials) — rewarded ads remain available if you choose to watch them (see the Terms of Use)

This section covers the synapgeek.com website itself, as distinct from the App described elsewhere in this policy.

Account The website has no sign-up or sign-in: browsing it never requires an email address or password.

Vercel audience measurement We use Vercel Analytics and Vercel Speed Insights to measure the site's traffic and performance. These tools set no cookies and only produce aggregated statistics, with no individual identifier.

Google Analytics 4 We use Google Analytics 4 to understand how the site is used: pages viewed, homepage sections displayed, language changes, clicks through to the App Store and Google Play, and contact form submissions (with the chosen subject). A banner lets you accept or refuse this audience measurement; it stays displayed until you make a choice. Your choice is then remembered for 6 months as a simple indicator in your browser's local storage — never a cookie for the choice itself — and you can change it at any time via "Manage cookies" in the footer. In the European Economic Area, the United Kingdom, Switzerland, the EU's outermost regions, and a few associated territories, the measurement cookie (_ga and _ga_*, kept for a maximum of 13 months) is only set if you accepted; if you refuse, or before you respond, no measurement cookie is set. Outside these territories, measurement is active by default unless you refuse through the same banner, with the same measurement cookie kept for a maximum of 13 months. Regardless of your country, as long as cookie-based measurement is not active — before you consent in the territories listed above, or after a refusal anywhere — cookie-free measurement signals with no persistent identifier (page viewed, action taken, timestamp, browser type) may nonetheless be sent to Google, which receives your IP address in the process and uses these signals in aggregate to model traffic. You can also opt out using Google Analytics' browser opt-out add-on, a content blocker, or by writing to privacy@synapgeek.com. Google Analytics browser opt-out add-on: https://tools.google.com/dlpage/gaoptout This website does not display any advertising and does not use this data for advertising purposes: advertising consent signals (ad_storage, ad_user_data, ad_personalization) remain refused at all times. Google's privacy policy: https://policies.google.com/privacy

Contact form If you use the contact form, we collect your name, email address, chosen subject, and message, solely to reply to you. This information is sent to us by email through our business mailbox and is not kept in a separate database. The form is protected by reCAPTCHA, a Google service whose script only loads once you interact with the form (click, tap, or focusing a field).

Your data may be shared with the following technical partners, strictly for the purposes described above.

For the App. We share data with Google (Firebase Analytics, Firebase Crashlytics, Firebase Performance, Firebase Firestore, Firebase Auth, Firebase Cloud Messaging, AdMob, Google Play Billing, Google Sign-In) for analytics, data storage, authentication, monitoring, notifications, advertising, and in-app purchases on Android: Privacy Policy https://policies.google.com/privacy

We also share data with Apple (Sign in with Apple; StoreKit 2 and SKAdNetwork on iOS) for authentication on iOS and Android, and for in-app purchases and advertising attribution on iOS: Privacy Policy https://www.apple.com/legal/privacy/

Finally, we share data with Meta (Facebook SDK) for authentication via Facebook and, subject to your advertising consent, conversion measurement (App launch, purchase, account creation, first completed puzzle): Privacy Policy https://www.facebook.com/privacy/policy/

For the synapgeek.com website. We share data with Google (Google Analytics 4, reCAPTCHA) for audience measurement on the site, according to the choice you make through the banner described in the "The synapgeek.com website" section, and to protect the contact form against automated submissions: Privacy Policy https://policies.google.com/privacy

We also share data with Vercel Inc., our hosting provider, which processes the technical requests needed to serve the site's pages, as well as Vercel Analytics and Vercel Speed Insights (cookie-free measurement of traffic and performance): Privacy Policy https://vercel.com/legal/privacy-policy

We do not sell your personal data. We do not share your data with third-party artificial intelligence systems for model training purposes.

Some of our technical partners (Google, Meta, Apple, Vercel Inc.) process data outside the European Economic Area, including in the United States — this is the case for Vercel Inc., our hosting provider, based in the United States. These transfers are governed by standard contractual clauses approved by the European Commission, in accordance with Articles 46 and 49 of the GDPR, to ensure an adequate level of protection for your data.

We retain your data for the following periods:

• Analytics data: maximum 14 months
• Account and progression data: as long as your account is active
• Transaction data: we retain a minimal history of your purchases linked to your account (such as the product identifier, type, and date of purchase), for as long as your account is active. Billing records and your payment information are held exclusively by Apple and Google Play as the sellers of record; our accounting obligations cover their aggregated payout statements, which cannot identify you
• Error logs (Crashlytics): 90 days

After account deletion, all your personal data is removed from our servers. Certain aggregated and anonymized data may be retained for statistical purposes.

We implement the following technical measures to protect your data:

• Encryption of data in transit (HTTPS/TLS)
• Firebase Security Rules (access limited to authenticated user)
• Secure authentication via OAuth 2.0 protocols and nonce for Apple Sign-In
• Data stored locally on the device, protected by the operating system's encryption (iOS and Android encrypt app data by default on a device locked with a passcode)

No system is infallible. In the event of a data breach affecting your rights, we will notify you in accordance with applicable legal deadlines.

The App is intended for users aged 13 and older. We do not knowingly collect personal data from individuals under 13 years of age.

If you are a parent or guardian and discover that your child under 13 has provided us with personal data, please contact us at privacy@synapgeek.com. We will delete such data promptly.

Rights under GDPR (EU/EEA) In accordance with the GDPR, you have the following rights:

• Access: request a copy of your personal data
• Rectification: correct inaccurate or incomplete data
• Erasure: request deletion of your data
• Restriction: request restriction of processing
• Objection: object to processing based on legitimate interest
• Portability: receive your data in a structured, machine-readable format
• Withdraw consent: withdraw your consent at any time

You also have the right to lodge a complaint with a supervisory authority (in France: CNIL — www.cnil.fr).

Rights under CCPA/CPRA (California, United States) If you reside in California, you have the following rights:

• Right to know what data is collected and how it is used
• Right to request deletion of your data
• Right to opt out of the "sale" or "sharing" of your data (we do not sell your data)
• Right to non-discrimination for exercising your rights

Exercising your rights To exercise any of these rights, contact us at: privacy@synapgeek.com. We will respond within 30 days.

You can delete your account directly in the App via Profile > Delete Account. This action is irreversible and results in the deletion of all your personal data from our servers: progression, purchases, avatars, and leaderboard entries.

If you no longer have access to the App, you may also request the deletion of your account by email at privacy@synapgeek.com.

This page is directly accessible at: https://synapgeek.com/en/account-deletion

We may update this privacy policy periodically. In the event of a material change, the update date at the top of this page will be revised. We encourage you to review this page regularly. Continued use of the App after any modification constitutes acceptance of the revised policy.

For any questions regarding this privacy policy or your personal data:

Synapgeek Email: privacy@synapgeek.com Website: https://synapgeek.com