BrainBox Academy
BrainBox Academy is developed and operated by Rahil Gulaliyev (referred to as "we" or "us" in this policy), who is the data controller for the purposes of the GDPR. You can reach us at any time at rahil.gulaliyev@gmail.com.
The service runs on our own servers. Learner data is stored in our own databases, not on a third-party platform.
When you create an account we ask for:
We do not ask for an email address, a phone number, a home address, or any payment details. The app is free and there is nothing to pay for inside it.
You may optionally add a display name, an emoji avatar, a profile colour, a short bio and a grade level to your profile. These are visible to other learners on leaderboards and in matches, so please do not put personal details in them.
Using the app produces learning records tied to your account:
This is the data that makes the profile page, leaderboard and match history work. Leaderboards and match results show your username, display name and avatar to other learners using the app.
httpOnly, secure and sameSite=strict, expires after 24 hours,
and its server-side record stores the IP address the session was last used from, to help detect
account hijacking. We set no advertising, tracking or profiling cookies.
Study Rooms let you talk to classmates over video, voice and text chat. The app asks for camera and microphone permission only at the moment you join a room, and only then.
Code you write in the Python lessons is sent to our own sandboxed execution container, run there, and the output returned to you. The code is not stored after it runs and is not sent to any third party.
The app contains no advertising networks, no analytics SDKs and no tracking SDKs. We do not sell or rent personal data, and we do not share it for anyone else's marketing.
Some pages load fonts and open-source code libraries from public content delivery networks — Google Fonts, jsDelivr, cdnjs and unpkg. When your device fetches those files, the network serving them receives your IP address and browser user-agent, as it would for any website. They receive nothing about your account or your learning data.
If you installed the app from Google Play, Google collects information about the download and installation itself under its own policy, which is between you and Google: policies.google.com/privacy.
Under the GDPR we rely on performance of a contract — we cannot give you an account, save your progress or run a match without it — and on our legitimate interest in keeping the service secure and working, for the activity log and security records. Where a child is the user, we rely on the consent of a parent or guardian, given as described below.
BrainBox Academy is built for school-age learners, and children under 13 do use it. It is not a no-data app: creating an account stores a name, an age and school details, and using it creates learning records.
If you are under the age of digital consent where you live (13 in most places, up to 16 in parts of the EU), a parent, guardian or teacher must set up and approve the account on your behalf. We ask parents and guardians to read this policy before letting a child register.
We collect no more from a child than from any other learner, we show children no advertising, and we never use anyone's data to build a marketing profile. A parent or guardian may contact us at rahil.gulaliyev@gmail.com at any time to see what we hold about their child, correct it, or have the account and all its data deleted. We will act on such a request within 30 days.
You can delete your account yourself, at any time, in two ways:
Deletion is immediate and permanent. It removes your account, your profile (XP, level, badges, avatar and bio), your learning history and per-subject progress, and your activity log. You can also still email rahil.gulaliyev@gmail.com from an address you can be reached at, telling us your username, and we will delete the account within 30 days and confirm when it is done.
Deleting your account removes your learning data. Where you appear as an opponent in another learner's past match record, your username in that record is anonymised rather than the other learner's history being erased.
You have the right to access the data we hold about you, to have it corrected, to have it deleted, to receive a copy in a portable form, to object to or restrict our processing of it, and to withdraw consent where consent is what we relied on. Write to rahil.gulaliyev@gmail.com and we will reply within 30 days, free of charge.
If you are in the EU or UK and you think we have handled your data badly, you can also complain to your national data protection authority.
All traffic to the site and app is encrypted with HTTPS/TLS. Passwords are stored only as bcrypt hashes. Session cookies are httpOnly, secure and same-site restricted. Sign-in and registration are rate limited to slow down guessing attacks, the server runs behind a firewall with an AppArmor confinement profile, and administrative access is restricted. No system is perfectly secure, but if a breach ever affects your personal data we will tell affected users and the relevant authority without undue delay.
Our servers are located in Türkiye. If you use the service from elsewhere, your data is transferred to and stored there.
If our data practices change we will update this page and revise the "Last updated" date above before the change takes effect. Significant changes will be announced inside the app.
Questions, requests and complaints about this policy or about your data: rahil.gulaliyev@gmail.com. We aim to reply within a few business days and always within 30 days.