Projectellus Studio

Privacy Policy

Mind Derby

How Mind Derby handles your information.

This privacy policy describes how Projectellus Studio (“we”, “us”) handles information in Mind Derby (“the game”) for Android. It applies only to this game. Our website has a separate privacy policy. Please also read the game’s Terms of Use.

1. Who we are

The game is developed and published by Projectellus Studio, a small independent game studio based in Lithuania. The data controller is MB "Projectellus" (company code 308183802, registered office Švitrigailos g. 11K-109, Vilnius, Lithuania). Contact: [email protected].

2. Information the game collects

  • Without an account: your settings (language, sound, music, vibration, motion and text size) and your local progress and statistics are saved on your device only. To show today’s quiz information and the public leaderboards, the game contacts our server api.projectellus.com; this creates only the technical server logs described below.
  • Your account (needed for the official Daily Derby and the leaderboards): your e-mail address, your password (we store only a one-way Argon2id hash, never the password itself), your nickname, your birth year (only to check the minimum age), your language, avatar, chosen title and public-profile setting, and when the account was created, verified and last used.
  • Sign in with Google (only if you choose it, where the game offers it): the Google account ID and the e-mail address that Google confirms to us. We never see your Google password.
  • Your play: your official Daily Derby attempts (date, language, start and finish time, when each question was shown, each answer, whether it was right and the points, and how often you left the game during it), daily results, leaderboard places, medals, streak and active days, achievements, titles, experience points and level, and the adventure progress the game saves to your account.
  • Sign-in sessions: random access and refresh tokens that we store only as one-way hashes, with their times and the app version that created them.
  • Security and fair play: to limit how often requests can be sent, our server keeps a keyed one-way hash of your IP address (not the address itself) and a one-way hash of the e-mail address entered when signing in. It also keeps a record of account events (registration, e-mail verification, password changes and resets, adding Google sign-in, deletion) and of moderation actions, such as a nickname reset or a suspension, with the reason.
  • Server logs: when the game contacts our server, the web server automatically records technical information such as your IP address, the date and time, the address requested and the app’s connection details. These logs are used to deliver the service, keep it secure and investigate errors or abuse, as on our website.
  • All data between the game and our server travels over an encrypted (HTTPS) connection. The game does not ask for your real name, postal address, phone number, contacts or location, and it has no chat or messages between players.
  • Advertising: the game shows a small Google AdMob banner in its menus and result screens only - never while a question is on the screen. After the two free Guardian fights of a day the player may choose to watch a rewarded video ad for one more fight in the offline adventure; it is always optional and never gives Daily Derby points, places, medals or anything else competitive. AdMob receives device and usage data such as your IP address and an advertising ID to show and measure ads (see the advertising section below). Ads are limited to content suitable for teenagers, and for players without an account they are requested as for users under the age of consent (no personalised ads in the EEA and the UK). The game has no analytics or crash-reporting SDK.
  • If you write to us at our support address, we receive your e-mail address, your message and any information you choose to include, and use it only to reply and handle your request.

The Google Play Store also processes information when you download the game. That processing is governed by Google’s Privacy Policy.

3. Your account and the e-mails we send

You can use parts of the game as a guest. To take part in the official Daily Derby and the leaderboards you need a Mind Derby account, created with your e-mail address and a password. Mind Derby accounts belong to this game only: they are not shared with our other games.

We send e-mails only for your account, from our own address ([email protected]) through the e-mail service Brevo:

  • a 6-digit code to confirm your e-mail address (valid for 30 minutes);
  • a 6-digit code to reset your password when you ask for it (valid for 15 minutes).

We do not send newsletters or advertising e-mails, and we never sell your e-mail address or share it with anyone except the e-mail service that delivers these codes.

4. Leaderboards and your public profile

The leaderboards in the game show your nickname, avatar, chosen title, score, number of days played and medals to other players. Your e-mail address, birth year and internal account number are never shown.

While your public profile is on (the default), other players can also open your profile from a leaderboard: nickname, avatar, title, level, medal counts, current and longest streak, number of official quizzes played, number of achievements and the date you joined. You can switch the public profile off at any time in the game under Settings › Account and privacy; your nickname still appears on the leaderboards you take part in.

5. Scoring and fair-play checks

Official points are calculated only on our server from your answers. To protect the competition, we can review attempts that look unusual (for example, every answer right at a speed no reader manages). Such a review is done by a person; nothing is decided automatically. If we suspend an account or reset a nickname, we record the action and its reason (see our Terms of Use).

6. Deleting your account

You can delete your account at any time in the game under Settings › Account and privacy › Delete my account, or ask us by e-mail at [email protected] if you no longer have the app. Deletion removes your account and the personal data linked to it; a few records are kept without your name, as described on our account deletion page. Uninstalling the game does not delete your account.

7. Advertising (Google AdMob)

The game is free to play and shows ads provided by Google AdMob, a Google advertising service. To show ads, measure their performance and prevent fraud, the Google Mobile Ads SDK included in the game may collect information and share it with Google, such as:

  • device identifiers, including the advertising ID and app set ID;
  • your IP address, which may be used to estimate your general location;
  • information about your interactions with ads and with the game;
  • diagnostic information, such as app performance and crash data.

Google describes this data collection in its AdMob data disclosure and explains how it uses information from apps that use its services in How Google uses information from sites or apps that use our services.

Your consent choices

If you are in the European Economic Area, the United Kingdom or Switzerland, the game asks for your consent before personalised ads are shown. If you do not consent, Google may still show non-personalised or limited ads, which use some data for purposes such as frequency capping, aggregated reporting and preventing fraud.

The game uses Google’s User Messaging Platform to ask for consent to personalised ads where it is required. You can change or withdraw your choice at any time in the game under Settings › Privacy and cookie settings (the button is shown where consent applies).

On Android you can also reset or delete your advertising ID in your device settings (for example Settings › Privacy › Ads or Settings › Google › Ads, depending on your device), and manage Google ad personalisation at My Ad Center.

  • Personalised ads – your consent, asked through Google’s consent message where the law requires it (Article 6(1)(a) GDPR). Non-personalised ads – our legitimate interest in keeping the game free to play (Article 6(1)(f) GDPR).
  • Your account, the official Daily Derby, leaderboards, medals, achievements, progress saved to your account and the account e-mails — performing our agreement with you, the Terms of Use you accept when you create the account (Article 6(1)(b) GDPR).
  • The minimum-age check with your birth year — our legitimate interest in letting only players old enough to consent create an account (Article 6(1)(f) GDPR, with Article 8 GDPR).
  • Security, rate limits, account-event and moderation records, fair-play checks and server logs — our legitimate interest in operating a secure, reliable and fair service (Article 6(1)(f) GDPR).
  • Sign in with Google — your choice to use it, as part of our agreement with you (Article 6(1)(b) GDPR).
  • E-mail support — our legitimate interest in answering your enquiry (Article 6(1)(f) GDPR).

9. Service providers and third-party services

We do not sell personal data. The game and our servers use the following service providers and third-party services:

  • Google AdMob — advertising. Privacy policy
  • UAB Bacloud — web hosting of our game server (Lithuania-registered company; the server is located in Lithuania, within the European Economic Area).
  • Brevo (Sendinblue SAS) — sends the account e-mails (verification and password reset codes): it receives your e-mail address, your nickname and the code (France, within the European Economic Area). Privacy policy
  • Cloudflare — protects and delivers the connections between the game and our server; it processes connection data such as IP addresses. Privacy policy
  • Google Sign-In — only if you choose to sign in with Google: Google confirms your Google account to us. Privacy policy

The game uses no other third-party SDKs or services.

10. Children

The game is intended for: players aged 12 and over and adults; it is not directed at younger children.

Only players aged 16 or over can create an account. When you sign up we ask for your birth year and refuse the account if you could be younger than 16 (we count the youngest age possible for that birth year). Younger players can still use the parts of the game that need no account; that data stays on their device.

We do not knowingly collect personal data from children below the age of digital consent in their country. If you believe a child has provided personal data to us, please contact us and we will delete it.

11. How long we keep data

  • Data saved on your device stays there until you uninstall the game or clear its data. The game does not use Android Auto Backup, so it is not copied to your Google account. Signing out removes the sign-in tokens from your device.
  • Your account and the data linked to it (profile, results, medals, achievements, progress): for as long as you keep the account. We do not delete inactive accounts; an account stays until you delete it. Ended sign-in sessions are deleted 30 days after they expire or are signed out, and used or expired e-mail codes after 7 days. Everything is deleted when you delete the account, apart from the records without your name described below.
  • Official quiz attempts and answers stay on our server after you delete your account, but without any link to you; finished leaderboards keep the place and score as a “deleted player”, without a nickname.
  • Rate-limit records (hashed IP and e-mail addresses) are deleted automatically after about two days.
  • Account-event and moderation records: one year, then they are deleted automatically.
  • Server logs: 24 months.
  • Backup copies of our game database may contain deleted data for up to one year, until they are replaced by newer backups.
  • E-mails: only for as long as necessary to respond to your enquiry and handle related follow-up, unless a longer period is required by law or necessary for legal claims.

Data collected by Google for advertising is retained according to Google’s own policies.

12. Your rights and data deletion

Depending on where you live, including under the EU GDPR, you have the right to access, correct or delete your personal data, to restrict or object to its processing, and to data portability. To exercise these rights or to ask us to delete data related to the game, e-mail [email protected] and mention “Mind Derby”. We will reply within one month.

You can delete your Mind Derby account yourself in the game at any time. How to do it, how to ask us to delete it without the app, and what is deleted and kept: Delete your account.

We do not use automated decision-making that has legal or similarly significant effects on you.

You can also lodge a complaint with your local data protection authority. In Lithuania this is the State Data Protection Inspectorate (vdai.lrv.lt).

13. Security

We take reasonable technical and organisational measures to protect information processed in connection with the game. Data sent between the game and third-party services is transmitted over encrypted connections where those services support it.

14. Changes to this policy

We may update this policy, for example when the game gains new features or services. Significant changes will be reflected on this page before they take effect.

15. Contact

Projectellus Studio
E-mail: [email protected]