Gizlilik bildirimi

Son güncelleme: 11 Ekim 2026

Bu sayfa İngilizcedir. Bağlayıcı olan İngilizce sürümdür.

The short version

You can use Brainlag without an account. We never ask for your name.
If you make an account, we keep your email address, a scrambled (hashed) password and the study data you choose to sync. You can delete it all from the account page.
We count visits with our own simple tool. It sets no cookies, stores nothing on your device and does not keep your IP address.
If you switch it on, you can share your learning numbers (lessons finished, first-try results, test scores before and after a unit) to help us check that Brainlag helps people learn. It is off unless you turn it on, and turning it off deletes them.
We do not sell your data, we do not build advertising profiles and we do not show personalised ads.
Payments go through Stripe. We never see your card number.
In a class, your teacher sees only the name you chose and your work for that class (what you finished, your scores and attempts), never your email address unless you choose to show it. There is no messaging between students.
You can ask to see, correct or delete your data by emailing [email protected]. You can also complain to the Information Commissioner's Office (ICO).

The rest of this page gives the full details.

Who we are

Brainlag (brainlag.space and code.brainlag.space) is run by Nicholas Huaman, a sole trader in the United Kingdom. Postal address: 16 Cappers Lane, Trent Valley Road, Lichfield, WS14 9TU, United Kingdom. Email: [email protected].

This notice covers brainlag.space and Brainlag Code (code.brainlag.space). "We" and "us" means Brainlag. We are the controller of your personal data, which means we decide how it is used, except where a school uses Brainlag under a written agreement with us (see Classes).

Questions about privacy: [email protected]. Help with your account or a payment: [email protected].

When you visit without an account

Server logs. Like every website, our server records each request: your IP address, the date and time, the page asked for, the website that sent you there and your browser type. We use these logs to keep the site working and safe, for example to block attacks. They are deleted after 14 days.

Visit counting. We count visits with our own analytics, which runs on our server. It records the page, the time, your language and a visitor code. The visitor code is made from your IP address and browser type mixed with a secret that changes every day, so we can count visitors without being able to recognise anyone from one day to the next. Your IP address itself is not stored. If your browser sends a Global Privacy Control signal, we count the page view without any visitor code. Counts are deleted after 180 days. Nothing is stored on your device for this.

Country. Our network provider, Cloudflare, tells our server which country a visit comes from. We use it only to show prices in the right currency. We do not store it.

What we do not do. We do not use Google Analytics or any other outside analytics service, we do not use your location, and we do not track you across other websites.

If you create an account

An account is optional. One account works on both brainlag.space and Brainlag Code. When you create one we store:

your email address and a hashed password (we cannot read your password);
when the account was created and when you last signed in;
the study data you sync: flashcards, notes, planner, grades, essay outlines, reading log, vocabulary lists, citations, research checklists, mind maps, presentations, converter favourites, study playlists, focus timer settings and history, typing test results, maths practice, revision plans, game saves, streaks, the site colours you have earned, your colour theme and which tools you have opened;
your Brainlag Code progress (see Brainlag Code);
any classes you have joined and any plan or purchase on the account (see Classes and Payments).

When you sign in, a sign-in cookie keeps you signed in for up to 30 days after you last use the site. If you forget your password, we email you a reset link that works once and runs out after 30 minutes. We store only a scrambled copy of the link's code.

Emails. We send emails only when they are needed: a link to confirm your email address when you sign up, a password reset link, a notice when your password changes, and a gift code if you buy one. We do not send newsletters or marketing. Our own mail server sends them. We keep a short log of what was sent, with the address scrambled, so we can fix delivery problems.

Deleting your account. You can delete your account at any time from the account page. This deletes your email address, password, synced data, Brainlag Code progress and class memberships straight away. If you have a paid plan that is still set to renew, we ask you to cancel it first, so that you are not charged for an account that no longer exists. Order records that the law makes us keep are kept on their own (see How long we keep data).

About you. After you create an account we ask a few questions. Your month and year of birth are needed; the rest is optional and you can change it at any time on the account page, under Profile.

What we should call you: a first name or nickname, never a surname. We use it to greet you on the site and at the start of our emails. Leave it empty and we just say hello.
Your month and year of birth: we use them to work out your age group (13 to 17, or 18 and over) and your likely school year, counting your birthday from the end of that month. We keep the month and year and the age group. We never ask for the day. We use the age group for the rules that depend on age: plans and packs can be bought only by someone 18 or over (a parent or guardian can give one as a gift instead). Accounts are for ages 13 and up: if the date says you are under 13, we do not keep the account or the date. We do not check the date you give.
Who is studying (a student, a parent or guardian, or a teacher), and for students the year group, which starts from your month and year of birth and which you can change. We use these to suggest courses and to put the right ones first.

Only you can see these answers on the site. They are never shown to a teacher, a class, or anyone else. They are deleted straight away when you delete your account.

Profile picture. You can choose one of our drawings or upload a photo; neither is needed. Only you can see it: Brainlag has no public profiles, and the picture never appears on share links, in the calendar link, to a teacher or to anyone else. When you upload a photo, our server makes a new small square copy of it (256 by 256 pixels) and throws the original away. The new copy holds no hidden details from the original, such as where or when it was taken or the camera used. It is stored on our server outside the public website, under a random name, and only your signed-in account can load it. You can remove it at any time from the account page, which deletes it straight away, and deleting your account deletes it too.

Learning numbers and feedback

Learning numbers (only if you switch them on). On My learning and on your account page there is a switch: "Help us check that Brainlag helps people learn: share your learning numbers". It is off unless you turn it on, and you need an account to turn it on. It is not offered to anyone under 13. If you are 16 or over, you can switch it on yourself. If you are 13 to 15, you give us the email address of a parent or guardian, we send them one email explaining what is shared, and it switches on only if they agree using the link in that email. We keep their address only until they answer, and for no more than 14 days. When it is on, your browser sends us numbers from your Learn progress, only for what you do after it was switched on:

which lessons you started and finished;
for each practice question, whether it was right first time (and which kind of question it was);
your topic test scores, and whether you took the test before or after the unit's lessons;
whether a topic you got secure was still secure 30 days later;
the date (not the time) of each of these.

We never receive the questions' text, your answers, anything you type, your name or your email address with these numbers. They are stored apart from your account, under a code made from your account number with a secret key, and the key changes every six months, so numbers from different half-years cannot be joined together. We look only at totals for groups of at least 10 learners, on a page only the site owner can open. We use them to check whether lessons get finished, whether people come back, and whether scores and accuracy improve, so we can improve the courses. We do not use them to make decisions about you, to show you ads or to profile you, and we do not share them. Your teacher never sees them.

You can turn the switch off at any time, in the same place. When you do, we delete all the numbers you shared, straight away, and any request still waiting for a parent. Deleting your account deletes them too. Otherwise we keep them for 13 months. A parent or guardian who agreed can ask us to delete them at any time at [email protected].

Feedback questions. Sometimes we ask a one-tap question: "Was this lesson helpful?" at the end of a lesson, "How likely are you to recommend Brainlag to a friend?" on My learning (at most once a month, and never during a lesson), and "What made you choose Brainlag?" after you buy a plan. We do not ask these if your account says you are under 13. You can ignore or close them. You can only tap the answers given: there is no box to type in. We store each answer with the date and, for the lesson question, the lesson, and nothing that identifies you. To stop the recommend question being asked twice in a month, we note on our server, for 30 days, that your account has answered it. If you cancel a plan in the Stripe billing page, Stripe may ask you why; we read only the reason you picked from Stripe's list, never anything you typed there.

Calendar link and share links

Both are off until you turn them on in the Weekly Planner, and only with an account.

Calendar link. A private web address that Google Calendar or Apple Calendar can subscribe to. It shows the titles, dates and times of your planner events, exams and due dates, and nothing else: no name, email address or notes. Your calendar app (Google or Apple) fetches it from our server on its own schedule, so they receive those titles and times under their own privacy terms. We keep a scrambled (hashed) copy of the link's secret part, your time zone and language, and when a calendar app last fetched it.
Share links. A read-only page for one week or for your weekly timetable, with the same titles and times and nothing else. Anyone who has the link can open it, so share it only with people you trust. We keep a scrambled copy of the link, which week it shows and, for a snapshot, a copy of those titles and times.

Pages behind these links are hidden from search engines. You can reset or turn off any link in one click in the Weekly Planner; it stops working at once. Deleting your account removes them all.

Weekly summary for a parent or guardian

Off until you turn it on. On the account page you can give the email address of a parent or guardian. We send them one email asking whether they want a short summary of your week each Sunday; nothing more is sent unless they say yes.

What the summary says: how many lessons you did that week, roughly how long you studied, which topics are now secure and which are due for review, and one suggestion. It never includes your answers, mistakes, marks or grades, notes, or anything about other learners. It uses the first name on your profile if you gave one, never your email address; the invite email shows that only partly (for example s***@example.com), and only when there is no name. The account page shows exactly what is shared and has a preview of this week's email.
A line about Plus: if you are on the free plan, the email ends with one line for the parent about Brainlag Plus and giving it as a gift, with its prices. It is never sent to you.
What we keep: their email address and when they said yes (until then, when the invite was sent), the language of the emails and which week was last sent. Not their name, and nothing about who opens the email.
Stopping it: you can stop it at any time on the account page, and they can stop it from any email in one click. Either way their address is deleted straight away. Deleting your account deletes it too.

We rely on your choice to share and on their consent to receive the emails.

Brainlag Code

The code you write on code.brainlag.space runs in your own browser. It is saved in your browser's storage on your device. It is not sent to us.

Share links. When you share code from the playground, the code is put inside the link itself, after the # sign. Browsers do not send that part of a link to any server, so the code is not stored by us. Anyone who has the link can see the code, so do not put anything private in code you share.

Progress. If you sign in, we store your progress so it follows you between devices: which lessons and exercises you have finished, how you did on the quick checks (passed or not yet, not what you typed), the days you were active, which courses you have started, lessons you tested out of or skipped, and where the placement check suggests you start. We do not store your code.

Running Python and SQL. The first time you run Python or SQL, your browser downloads the free open-source engines that do it (Pyodide and sql.js) from jsDelivr, a public network for open-source files. Like any website you visit, jsDelivr receives your IP address and browser type when it sends the files. The C compiler and the code editor come from our own server.

Classes

A teacher with a Brainlag teacher account can create a class with a join code. When you join a class you choose the name your teacher will see, and you agree to share your work for that class with that teacher. Joining is not possible without that agreement.

Your teacher sees: the name you chose, the work they set for the class and, for that work only, whether you finished it, your scores, how many attempts you made and a red, amber or green mark for each spec point. This comes from your own Brainlag Learn and Brainlag Code progress and the flashcard decks they set, worked out on our server for that class only. Your teacher never sees your email address (unless you turn on "Show my email address to this teacher", which you can turn off again), your notes, your planner, your other study data or your code.

There is no messaging and no chat. Other students in the class never see your name, your work or that you are in the class. You see the class name, your teacher's name and the work set.

You can leave a class at any time from the Your classes page, and your teacher can remove you. When you leave, your teacher can no longer see your work, and the "done" marks you made for that class are deleted.

Teacher accounts. Teachers are adults. To set one up, a teacher gives the name their students know them by and their school, and confirms they are a teacher aged 18 or over. We check this by hand. We keep a log of what teachers and our staff do with classes (for example creating a class, setting work, viewing or downloading results, removing a student), with the date and a scrambled form of the internet address, so we can investigate misuse. The log holds no student notes or messages. A teacher can download a class's results as a CSV file for their markbook; once downloaded, that file is the school's responsibility.

Who is responsible. If your school has signed a data processing agreement with us, your school is the controller of class data and we handle it only on the school's instructions. Otherwise we are the controller, and we share your progress with your teacher because you agreed to it when you joined. You can take that agreement back at any time by leaving the class.

Payments

Paid plans (Brainlag Plus, Brainlag Code, Brainlag Music Theory, All access and Supporter), gift codes, printable packs and classroom licences are paid through Stripe. Stripe collects your card or other payment details on its own secure page and uses them under its own privacy policy (stripe.com/privacy). For the payment itself Stripe works for us. For things like fraud checks and the records the law requires, Stripe decides on its own and is responsible itself. We never see or store your full card number.

You can pay by card, Apple Pay, Google Pay or PayPal. If you choose PayPal, you sign in to PayPal and PayPal handles that payment under its own privacy policy (paypal.com/legalhub/privacy-full). If you choose Apple Pay or Google Pay, Apple or Google pass your card details to Stripe under their own privacy terms.

To know whether your plan is active and to fulfil orders we keep: your Stripe customer and subscription IDs, the product, its status and renewal or end date, and Stripe's notices about payments. For each order we keep the email address, what was bought, the amount, the currency, the date, the language and, where you gave it, the time you agreed to start straight away. For gift codes we keep the code, whether it has been used and by which account.

Paid plans are for adults. The checkout asks the buyer to confirm that they are 18 or over, or a parent or guardian paying for their child, and we remember that answer on the account so we do not ask again. A teacher buying a classroom licence buys for their class.

Brainlag shows no ads today. Some pages have a space for one, and those spaces show only Brainlag's own suggestions, such as a link to the focus timer. No ad network code runs on Brainlag.

If we add ads later, they will never be personalised: for anyone, they will not be chosen using a profile of you or what you do online. There will be no ads in games, on account or payment pages or on this page, and none for anyone with a paid plan. Before any ad cookie is set we will ask you first, and saying no will be as easy as saying yes. Before any ad appears, we will update this notice and name the ad company.

Games and videos from other developers

Most games on Brainlag were made by other developers. We host them on our own server and remove the advertising and analytics code we find in them. A few online games connect to their own game servers so you can play with other people. Those servers are run by the game's developer, who receives your IP address and anything you type into the game, under their own privacy terms. Some online games show other players' names and one has chat with people you do not know. Each game page says when a game is online.

The study playlists and the focus timer show videos from YouTube. The preview pictures load from YouTube's servers. A video only starts loading from YouTube (youtube-nocookie.com) when you press play, and YouTube's privacy policy then applies.

Links to other websites, for example in the library, take you to sites with their own privacy policies.

Read aloud and voice answers

Read aloud in Brainlag Learn uses the voices built into your device (your browser's speech synthesis). The text is read out on your device and is not sent to us or anyone else. You can turn it off in Account, Preferences, or in the lesson player.

Voice answers are off until you turn them on, and we explain how they work before you first use the microphone. Your browser turns what you say into text with its own speech recognition. Depending on the browser, the recording may be sent to its maker to do this: Google for Chrome, Microsoft for Edge and Apple for Safari, under their own privacy terms. Brainlag never receives the recording. We only get the words, which go into the answer box for you to check, and they are treated like an answer you typed. Browsers that cannot do this do not show the microphone.

Cookies and browser storage

A cookie is a small file a website keeps in your browser. Browser storage (local storage) is similar. We use only those needed for the site to work or to remember a choice you made. We do not use advertising or tracking cookies.

Cookies

lang: remembers your language. Kept for 1 year.
bl_hide_mature: set only if you switch on "Hide mature themes" on the games page. Kept for 1 year.
blsess: keeps you signed in. Set only when you sign in. Kept until 30 days after you last use the site, or until you sign out.
PHPSESSID: keeps you in your room in the Oddword party game. Deleted when you close the browser.
cbl_access: on Brainlag Code, used only by the site owner for testing. Visitors never get it.

Browser storage

Your work in the study tools and Brainlag Code (notes, flashcards, planner, code, progress and so on), so it is still there when you come back.
Settings such as your colour theme, sound on or off, and layout choices.
Whether read aloud and voice answers are on, your reading speed, and that you have seen the note about voice answers.
Small notes for sync if you have an account, such as when your data last synced.
bl_measure_v1: whether learning numbers are on, and which numbers this browser has already sent, so they are not sent twice. Only if you switch learning numbers on. Removed when you switch them off.
bl_fb_v1: which lessons you have already answered "Was this lesson helpful?" for, and when the recommend question was last shown, so we do not ask again.

You can delete cookies and browser storage at any time in your browser settings. If you do, work that was only saved in the browser is lost, so export it or sync it with an account first.

If we ever add cookies that are not needed for the site to work, such as ad cookies, we will ask first and you will be able to change your mind at any time.

Why we are allowed to use your data

Data protection law (UK GDPR and the Data Protection Act 2018, and the EU GDPR for visitors in the European Union) says we need a reason, called a lawful basis, for each use of personal data.

Providing what you asked for (contract): your account, sync, Brainlag Code progress, password emails, your plan and your orders.
Applying the rules that depend on age (legal obligation and our legitimate interests): using your age group to decide who can buy plans and packs, and that accounts are for ages 13 and up. The name, who is studying and the year group are used to provide what you asked for (contract): tailoring what we show you and greeting you by name.
Our legitimate interests: server logs and rate limits to keep the site safe, and visit counting to see which pages and tools are used, and reading the cancellation reason you pick in Stripe's billing page, to understand why people leave. We have checked that these uses are small and expected, and that they do not override your interests, taking extra care because many of our visitors are young.
Your consent: sharing learning numbers if you switch them on (with a parent's or guardian's consent if you are 13 to 15), sharing your class work with a teacher when you join a class, showing your email address to a teacher if you turn that on, and any ad cookies if we ever use them. You can take consent back at any time.
Legal obligation: keeping order and tax records.

Children and young people

Brainlag is made for students, mostly aged 13 to 18. We follow the UK Age Appropriate Design Code (the Children's Code). That means:

everything works without an account, and an account needs only an email address and a password;
the most private settings are the default, and sharing with a teacher happens only when you choose to join a class;
we do not profile you, use your location or show personalised ads;
we do not use tricks to get you to share more data or to keep you on the site;
sharing learning numbers is off unless you switch it on, a parent or guardian must agree if you are under 16, and nothing on the site rewards you for switching it on;
there are no public profiles and no chat on Brainlag itself.

If you are under 13, please do not create an account or join a class. You can still use the tools without an account.

We ask for your month and year of birth when an account is made so we can apply these rules: if they say you are under 13, we do not keep the account or the date. Otherwise we keep the month and year and the age group (see If you create an account).

Age of digital consent. Where we rely on consent, the law sets an age from which you can give it yourself: 13 in the UK, and between 13 and 16 in European Union countries, for example 14 in Spain, 15 in France and 16 in Germany. For sharing progress with a teacher (and ad cookies, if we ever use them), if you are younger than that age where you live, ask a parent or guardian to agree before you join a class. For learning numbers we use one rule everywhere: you can agree yourself from 16; from 13 to 15, a parent or guardian must agree by email first.

Parents and guardians can contact us at [email protected] about their child's data.

We do not sell personal data. We share it only with these service providers, and only as much as they need:

OVHcloud hosts our server in a data centre in France. Our databases and our email server run there.
Cloudflare carries all traffic to our sites and protects them from attacks. It sees your IP address and the pages you request.
Stripe takes payments (see Payments).
PayPal, Apple and Google, only if you choose to pay with them (see Payments).
jsDelivr sends the Python and SQL engines on Brainlag Code (see Brainlag Code).
YouTube, and the servers of online games, when you choose to use them (see Games and videos).
Your teacher, if you join a class (see Classes).

We may also share data if the law requires it, for example with the police under a court order, or to protect someone's safety.

Where your data is kept

Our server is in France, in the European Economic Area. The UK recognises the EEA as protecting personal data properly, and the EU recognises the UK in the same way. Cloudflare, Stripe and PayPal are international companies and may handle data in the United States and other countries. When they do, they protect it with the safeguards the law requires, such as the UK International Data Transfer Addendum, EU standard contractual clauses or the UK-US data bridge.

How long we keep data

Server logs: 14 days.
Visit counts: 180 days.
Learning numbers: 13 months, or until you switch them off or delete your account, whichever is first.
A parent's or guardian's email address for a learning-numbers request: until they answer, and at most 14 days.
Feedback answers: 13 months.
Account and synced data: until you delete the account.
What we call you, your birth month and year, your age group, who is studying and your year group: until you change them or delete the account. We never ask for the day of birth.
Password reset codes: until used, or at most 30 minutes.
Class memberships and the work set for a class: until you leave, the teacher removes you or deletes the class, or one of you deletes the account. Teacher account details: until the teacher deletes the account. The class activity log: 2 years.
Weekly summary for a parent: their email address until you or they stop it, or the account is deleted; an invite nobody answers, 14 days.
Oddword rooms and the names typed into them: 2 days.
Order and payment records: 6 years after the end of the tax year of the purchase, because tax law requires it. If you delete your account, the order record is no longer linked to it.
Email logs on our mail server: about 5 weeks.

We keep backup copies of the server so we can recover from a fault. Deleted data can stay in a backup until that backup is replaced. We do not restore deleted accounts from backups.

Keeping data safe

All traffic to Brainlag is encrypted (HTTPS). Passwords are stored only as hashes. Our databases cannot be reached from the web, only Cloudflare can reach our server, and sign-in and password reset are rate limited. No system is perfectly secure. If a data breach puts your rights at risk, we will tell the ICO within 72 hours where the law requires it, and we will tell you without delay if the risk to you is high.

Your rights

You have the right to:

ask for a copy of the personal data we hold about you;
ask us to correct it;
ask us to delete it (you can also delete your account yourself);
ask us to limit how we use it, or object to a use based on our legitimate interests;
get your data in a format you can reuse (many tools also have their own export button);
take back your consent at any time, for example by leaving a class.

To use any of these rights, email [email protected], if you can from the email address on your account. We may ask you to confirm it is you. We will reply within one month. It is free.

Complaints. If you are unhappy with how we use your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office, the UK data protection regulator: ico.org.uk/make-a-complaint, or phone 0303 123 1113. If you live in the European Union, you can also complain to the data protection authority in your country, such as the AEPD in Spain, the CNIL in France, or the authority for your state in Germany.

Changes to this notice

We update this notice when the sites change. The date at the top shows the latest version. If a change matters for how we use your data, we will say so on the site, and email account holders where that is appropriate.