Privacy Policy

Last updated: 15 October 2026

1. Introduction

BrainBrawl ("we", "our", or "us") is committed to protecting the privacy of our users, particularly students and teachers using our educational platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and related services.

BrainBrawl is operated by Paul Jordan, a sole trader based in the United Kingdom.

BrainBrawl is designed for use in educational settings, primarily by students aged 16-18 and their teachers in the United Kingdom. We are committed to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When BrainBrawl is used by an educational institution, that institution acts as the data controller for its students' and staff members' personal data. In this context, BrainBrawl acts as a data processor, processing personal data on the institution's behalf to provide the Service. The institution's own policies and lawful bases for processing apply to their users. For individuals who use BrainBrawl independently of an educational institution, BrainBrawl is the data controller.

2. Information We Collect

2.1 Information You Provide

  • Account Information: Name, email address, and password when you create an account
  • Class Information: Class names and student groupings created by teachers
  • Game Data: Answers to quiz questions, scores, and performance metrics
  • Written Answers: The answers students type to written questions, and the marks and feedback they receive

2.2 Information Collected Automatically

  • Usage Data: How you interact with the platform, including games played and features used. This is recorded as product analytics (see section 5.4)
  • Device Information: Browser type, operating system, and device identifiers
  • Log Data: IP addresses, access times, and pages viewed, for security

2.3 Information from Third Parties

We use Firebase Authentication for secure login. When you sign in, we receive basic authentication data from Firebase (part of Google Cloud) to verify your identity.

3. How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the BrainBrawl platform
  • Authenticate users and manage accounts securely
  • Generate educational analytics for teachers to track student progress
  • Mark written answers and produce feedback and class reports, using AI (see section 5.3)
  • Send account, welcome, password reset and support emails
  • Understand which features are used so that we can improve them
  • Enable gamification features such as leaderboards, achievements, and XP systems
  • Ensure the security and integrity of our services
  • Respond to user enquiries and provide support
  • Comply with legal obligations

4. Legal Basis for Processing

Under UK GDPR, we process personal data based on the following lawful bases:

For teachers and institutional administrators:

  • Contract: To provide our services as agreed when you create an account
  • Legitimate Interests: To improve our services, ensure security, and provide educational analytics

For students within educational institutions:

Student accounts are created by teachers on behalf of their institution. The lawful basis for processing student data derives from the institution's educational purposes, typically their legitimate interests or public task in providing education. BrainBrawl processes this data as a data processor on the institution's behalf.

For all users:

  • Legal Obligation: To comply with applicable laws and regulations

5. Data Sharing and Disclosure

We share your information only in the following circumstances:

5.1 Within Educational Institutions

Teachers can view the performance data of students in their classes. This is essential for the educational purpose of the platform.

5.2 Service Providers

We use trusted third-party services to operate BrainBrawl:

  • Firebase (Google Cloud): Authentication and real-time database
  • Supabase: Database hosting for persistent data storage
  • Vercel: Hosting and deployment
  • Cloudflare: Security, performance, and DDoS protection
  • Sentry: Error monitoring and application performance
  • OpenAI: AI marking of written answers, and AI-written student feedback and class reports (see 5.3)
  • PostHog: Product analytics (see 5.4)
  • Resend: Sending emails (see 5.5)

These providers process data on our behalf to provide their service to us.

5.3 AI Processing (OpenAI)

We send limited data to OpenAI's API to provide three features:

  • marking a student's written answer against the mark scheme
  • writing feedback for a student on a game they have played
  • writing a report on a class game for the teacher

What is sent is the question, the mark scheme and the answers given (for written marking, only the student's typed answer; for feedback and class reports, the questions, the answers chosen and how many students got each right). We do not send names, email addresses or account identifiers. Because students type their own written answers, an answer could contain personal information if the student chooses to write it. Requests are made with OpenAI's response storage switched off. The marks and feedback that come back are stored in BrainBrawl and are visible to the student and their teachers. Marks are produced by AI without a human reading each answer first, and a student can question a mark and a teacher can review and change it. When marking, the AI also flags answers that try to give it instructions, contain offensive language, or suggest that the student or someone else may be unsafe or in distress. Flags do not change the mark and are shown only to the student's teacher.

5.4 Product Analytics (PostHog)

We use PostHog, hosted in the EU, to understand how BrainBrawl is used so that we can improve it: which pages are visited, which features are used, and events such as a battle finished, a Daily Debrief completed or a class created. We use this only to produce statistics about the service. It is never used for advertising, never sold, and never used to make decisions about an individual student.

Each event is linked to your account's internal identifier, whether you are a teacher or a student, and your school's internal identifier. Events carry only categories and counts, for example the difficulty, the outcome, the XP earned or a range of accuracy. For each school we also record its name and how many teachers, students and classes it has. We do not send names, email addresses, IP addresses or location, anything you type, written answers, or question content, and we do not record sessions, screens or clicks automatically. Page addresses are reduced to a template with no record identifiers or query strings, and analytics requests are routed through BrainBrawl's own domain.

PostHog stores an identifier in your browser so that it can recognise the same browser between visits. You can turn analytics off at any time below. If you are signed in, this also stops analytics about your account. We also honour your browser's Do Not Track and Global Privacy Control settings. When an account is deleted, its analytics data is deleted too.

Product analytics is … in this browser.

5.5 Email (Resend)

We use Resend to send the emails the Service needs: teacher welcome emails, student welcome emails containing login details for the class a teacher has added them to, password reset emails, and replies to enquiries sent through the website. Resend receives the recipient's email address and the content of the message.

5.6 Legal Requirements

We may disclose information if required by law or in response to valid legal processes.

6. Data Security

We implement appropriate technical and organisational measures to protect your data:

  • All data is transmitted over encrypted connections (HTTPS/TLS)
  • Passwords are securely hashed and never stored in plain text
  • Access to data is restricted to authorised personnel only
  • Regular security monitoring and incident response procedures
  • Bot protection and rate limiting to prevent abuse

7. Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. Educational performance data is retained to enable longitudinal progress tracking throughout a student's course of study. Upon account deletion, personal data is removed, though anonymised aggregate data may be retained for analytical purposes. Product analytics data (section 5.4) is kept for no more than 24 months.

8. Your Rights

Under UK GDPR, you have the following rights:

  • Access: Request a copy of your personal data
  • Rectification: Request correction of inaccurate data
  • Erasure: Request deletion of your data (subject to legal requirements)
  • Restriction: Request limitation of processing in certain circumstances
  • Portability: Request your data in a structured, machine-readable format
  • Object: Object to processing based on legitimate interests

To exercise these rights, please contact your teacher (for students) or contact us directly using the details below.

9. Children's Privacy

BrainBrawl is designed for A Level students (typically aged 16-18) and their teachers. Student accounts are created by teachers within educational institutions. We do not knowingly collect personal information from children under 13 years of age. If we become aware that we have collected data from a child under 13, we will take steps to delete that information.

We have designed BrainBrawl with the ICO's Age Appropriate Design Code in mind, ensuring high privacy defaults and avoiding manipulative design patterns. Product analytics is limited to pseudonymous statistics about the service, with no location, content or profiling of individual students, and students can turn it off themselves.

10. International Data Transfers

Some of our service providers may process data outside the UK. OpenAI and Resend are United States companies, and PostHog data is stored in the EU. Where data is processed outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR requirements.

11. Cookies and Similar Technologies

We use cookies and similar technologies to:

  • Maintain your session and authentication state
  • Remember your preferences
  • Protect against security threats (e.g., Cloudflare security cookies)
  • Produce statistics about how the service is used, to improve it (PostHog stores an identifier in your browser for this; you can turn it off in section 5.4)

Essential cookies are required for the platform to function. The analytics identifier is used only for statistics about the service, and you can turn it off at any time in section 5.4. You can also manage cookies through your browser settings.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of any material changes by posting the new policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

13. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us:

Email: [email protected]

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated. Visit ico.org.uk for more information.