Mind League Privacy Policy

Last updated: October 26, 2026

This English version is a translation of the Italian text, which is the version in force. If the two versions differ, the Italian version prevails.

This policy explains what personal data Mind League, meaning the app and the website mindleague.games, processes, why, for how long and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 ("GDPR") and the Italian Personal Data Protection Code (Legislative Decree 196/2003).

1. Who the data controller is

Oglut S.r.l., Viale Tito Livio 65, 00136 Rome, Italy, VAT no. 15766701005. For any question about privacy or to exercise your rights, write to info@oglut.com.

2. In short

You can play right away, without signing up and without giving us your name, email or phone number.
If you complete your profile we ask for a nickname and your date of birth, which stays private. Email is optional and only serves to recover your account.
The app may show ads, never during rounds; with the Premium subscription you do not see them. Ads are personalized only if you are at least 16 and you agree to it (§17). We do not sell your data. The app does not use third-party analytics tools; the website uses Google Analytics only if you accept it (§16).
You can delete your account from the app at any time: deletion is immediate.

3. What data we process

a) Guest session. The first time you open it, the app automatically creates an anonymous guest account, identified by a random code. It is used to save your results and progress without asking you anything.

b) Profile (optional). To use the social features (friends, challenges, invites) you complete your profile with:

a nickname that you choose;
your date of birth. We use it to check that you are at least 13 years old (§13) and, only in aggregated and anonymous form, for statistics by age group on the use of the app. We never show it to other players and we do not use it for leaderboards or matchmaking: nobody can work out your age from your nickname;
your avatar, chosen from a predefined list (you do not upload photos);
the date of acceptance of the Terms and Conditions and the version accepted.

c) Email (optional). If you enter it, we use it to send you a one-time code to verify it, to sign in to your account again and to recover it on another phone. We do not use it for newsletters or advertising and it is not visible to other players.

d) Game results and progress. For each round we record the game, the level, the score, the match statistics and the sequence of your answers with their timings (for example which square you tapped and after how many milliseconds), pauses and their length, the date, the app version and the operating system (iOS or Android). We need them to calculate the score, show you your progress and levels, compile the leaderboards and recognize invalid results (§5). We do not record the coordinates of your taps on the screen.

e) Social features. Friendships, friend requests, invites, challenges with their results and the date you became friends.

e-bis) Moderation. If our team takes action on your account (§7-bis), we save the action, the reason and who took it. If we write you a message, we save the text and when you opened and read it. You can read the message only once, after which it is no longer visible in the app.

e-ter) Failed age check. If you enter a date of birth showing you are under 13, we do not save the date: we only record that the check was not passed, so as not to repeat it on the same account.

f) Notifications. If you allow them, the push token of your phone, that is a code that makes it possible to deliver notifications to you. We also keep the notifications we send you and whether you have read them (§6).

g) Technical data. For each device you sign in from: the operating system (iOS or Android), the app version, the date of the first and last access and the session codes (stored in encrypted form with a hash function). With every request the app also sends the language of the app and the time zone of the phone (for example "America/New_York") and, for the daily training, the local date. We keep the language and the last time zone received in your account data, guest accounts included: we use the language to write notifications and emails to you in your language, and the time zone to count days according to your local time (for example the daily limit of the levels and the active days of the month). Our team can also see them in the account record. Like any Internet service, the server receives your IP address. For each device we keep the last IP address you connected from and the name of the network it belongs to (for example your carrier's), derived from the address: we use them only for account security and to handle abuse and reports, only the moderation team can see them and we delete them after 30 days without access from that device. To limit abuse (for example too many sign-in attempts) we also use the address in the form of a non-reversible code, for a few minutes. The technical logs of the infrastructure (servers and load balancers) may contain the IP address and are kept for 30 days.

h) Data saved only on your phone. The app saves on the device the access codes (in the system's protected keychain), your preferences (sounds, vibration, reduced motion), the tutorials already seen, your personal records and rounds in progress not yet sent. On iPhone the access codes remain in the keychain even if you uninstall the app, so you get your guest account back when you reinstall it. The account data on the phone is deleted when you sign out of the account or delete it.

i) Website contact form. If you write to us through the form on mindleague.games we collect the email to reply to, your name if you give it, the topic, the message and the language of the page. We use them only to reply and handle your request.

l) Website statistics (only with your consent). If you accept statistics cookies, Google Analytics collects, in aggregated form, the pages you visit, the actions on the website (for example starting a mini-game or sending the form), the website you came from, the type of device and browser, the language and the approximate country or city. It uses a random identifier saved in a cookie. We do not receive your full IP address, we do not link this data to your app account and we do not use it for advertising.

m) Advertising. When the app shows ads, the Google component built into the app sends the data described in §17 directly to Google. Our servers do not receive it.

What we do not collect. First and last name (except the name you choose to write to us in the website contact form), phone number, photos, address book contacts, location, microphone or camera. The advertising identifier and the phone model do not reach our servers: only Google receives them, for ads (§17).

4. Why we process the data and on what legal basis

Purpose	Data	Legal basis
Providing the app: guest account, profile, games, levels, progress, leaderboards, friends, challenges	a, b, d, e, g, h	Performance of the contract, that is the Terms and Conditions (Art. 6.1.b GDPR)
Signing in and recovering the account with email	c	Performance of the contract (Art. 6.1.b)
Push notifications on the phone	f	Consent, given through the operating system permission and the switch in the app (Art. 6.1.a), which you can withdraw at any time
Security of the service, prevention of abuse and falsified results, log of operations	d, g	Legitimate interest in protecting the service and the fairness of the leaderboards (Art. 6.1.f)
Minimum age check	b, e-ter	Legal obligation on the minimum age for online services (Art. 6.1.c GDPR, Art. 2-quinquies of the Italian Privacy Code)
Aggregated and anonymous statistics by age group	b	Legitimate interest in understanding who uses the app and improving it (Art. 6.1.f); the results contain no nicknames or identifiers
Proof of acceptance of the Terms	b	Legitimate interest in demonstrating acceptance (Art. 6.1.f)
Blocks, reports, team actions and messages, enforcement of the Terms	b, e, e-bis, report data	Performance of the contract for blocking (Art. 6.1.b); legitimate interest in protecting players for reports (Art. 6.1.f)
Replying to people who write to us through the website contact form	i	Performance of the contract if the request concerns the use of the app (Art. 6.1.b); otherwise legitimate interest in replying to those who contact us (Art. 6.1.f)
Statistics on website visits	l	Consent, given through the cookie banner (Art. 6.1.a and Art. 122 of the Italian Privacy Code), which you can withdraw at any time from "Cookie preferences"
Personalized ads and use of information stored on the phone for advertising	m	Consent, given through the consent form in the app and, on iPhone, the tracking permission (Art. 6.1.a and Art. 122 of the Italian Privacy Code), which you can withdraw at any time from Profile → Settings → Privacy and ads
Non-personalized ads, which allow us to offer the app for free	m, without the advertising identifier	Legitimate interest in funding the free app (Art. 6.1.f)
Legal obligations and defense of legal claims	data needed	Legal obligation (Art. 6.1.c) and legitimate interest (Art. 6.1.f)

Providing a nickname and date of birth is necessary only for the social features; without them you can still play as a guest. Email is always optional.

5. Automatic validation of results

To keep the leaderboards fair, the server automatically checks every round (for example impossible response times, inconsistent sequences, too many pauses or excessive length). A result may be not validated or placed under review: in these cases it does not count for leaderboards and levels. In the same way the server automatically decides the winner of a challenge by comparing the scores. These decisions have no legal effects and do not significantly affect you within the meaning of Art. 22 GDPR; if you think one of your results was excluded by mistake, write to us at info@oglut.com.

6. Notifications

With your consent the app sends you push notifications for:

friend requests received and accepted;
invites accepted;
challenges received and completed;
Mind League service communications (for example app news, new games or notices about the service);
messages from our team, for example the reply to one of your reports. The notification does not contain the text of the message, which you read only once in the app.

The same notifications also appear in the Notifications section of the app. You can turn off push notifications at any time in Profile → Settings → Notifications or in your phone settings: in that case we delete the device's push token. Service communications contain no advertising or commercial offers.

7. What other players see

Nickname and avatar: in leaderboards, search results, invites, challenges and the friends list.
Scores: the weekly leaderboard shows your nickname, your position and the points of validated rounds. There are no leaderboards by age.
Friends: your friends see your record for each game and since when you have been friends.
Challenges: your opponent sees your score and the statistics of the match played in the challenge.
Invites: anyone who receives one of your invite links sees your nickname, even without having the app.
Search: with the "Let others find me in search" option (Profile → Settings) you decide whether people who are not your friends can find you by nickname, send you a friend request, challenge you or get you as a random opponent. You still appear in the leaderboards.
Blocking: a player you have blocked can no longer find you, send you a friend request or challenge you, and vice versa.

Other players never see your email, your date of birth, your age or age group, or your devices, and random opponents are not chosen based on age.

7-bis. Blocks and reports

You can block or report another player. If you block someone we save the block to prevent you from interacting; the other player is not notified. If you report someone we save who reported, who was reported, their nickname at that moment, the reason, any note you write, where the report was made from and the date. Reports are reviewed by our authorized staff to enforce the Terms and protect players (legitimate interest, Art. 6.1.f GDPR). The reported player is not notified and does not know who reported them. If you delete your account, the reports you made remain without the link to you; those you received remain, to prevent repeated abuse, until the expiry stated in §10.

After a report, or if you breach the Terms, our team may change your nickname, remove your results for the week from the leaderboard or suspend the account (Terms, §13). It may also write you a message, for example to reply to one of your reports: you receive it as a notification and can read it only once.

We do not sell or transfer your data. It is processed on our behalf, under a contract that binds them (Art. 28 GDPR), only by the providers needed for the service:

Amazon Web Services EMEA SARL, for the servers, the database, the website mindleague.games, the contact form messages and sending the emails with the sign-in code, in the Frankfurt region (Germany, European Union);
Expo (650 Industries, Inc., USA), which routes push notifications, together with Apple (Apple Push Notification service) and Google (Firebase Cloud Messaging), which deliver them to the phone. They receive the push token and the text of the notification, which may contain another player's nickname;
Google Ireland Limited (Ireland), for website statistics with Google Analytics, only if you accept them (§16).

For ads in the app, Google Ireland Limited (Google AdMob) receives the data described in §17 as an independent controller, not on our behalf: it processes it under its own privacy policy (policies.google.com/privacy).

Our authorized staff, bound to confidentiality, may access the data only as far as necessary, for example for support and security. We may disclose data to the authorities when the law requires it.

During the beta on TestFlight, Apple may share with us the feedback, screenshots and crash reports you decide to send, together with the name and email of your TestFlight account. Apple's privacy policy also applies to this data.

9. Transfers outside the European Union

Some providers (Expo, Apple, Google, including for Google Analytics and advertising) are based in the United States or may process data there. In these cases the transfer is based on the EU-US Data Privacy Framework, for certified providers, or on the standard contractual clauses approved by the European Commission (Art. 45 and 46 GDPR). You can ask us for a copy of the safeguards adopted by writing to info@oglut.com.

10. How long we keep the data

Account, profile, results, friendships and challenges: as long as you have the account. If you delete it, we erase them immediately (§11).
Guest account never used: deleted after 24 months without access.
Email sign-in code: valid for 10 minutes, deleted within one day of expiry or use.
Sign-in sessions: they expire after 90 days of inactivity; the data of expired or closed sessions is deleted after 30 days.
Notifications: 12 months.
Reports, team actions and messages (§7-bis): 24 months from the closing of the report or the sending of the message. Blocks remain as long as either account exists or until you unblock.
Contact form messages: 24 months from our last reply, then deleted.
Website statistics (Google Analytics): 14 months, then automatically deleted by Google.
Advertising: our servers keep no data about ads. Your consent choice stays on the phone until you change it or uninstall the app. Google keeps the data it receives under its own privacy policy.
Last IP address and network of each device: replaced at every connection, deleted after 30 days without access from that device.
Technical logs of the infrastructure of the app and the website, with the IP address: 30 days.
Security operations log (for example "account created", "challenge sent", "account deleted"): it contains only an internal numeric identifier, without nickname or email, and is kept for 24 months.
Backup copies: deleted data may remain in backups for up to 30 days, after which it is overwritten.

11. Deleting your account

You can delete your account in Profile → Settings → Delete account. Deletion is immediate and irreversible: we erase your profile, date of birth, email, preferences, results, progress, friendships, requests, invites, challenges, notifications and push tokens. The challenges you played also disappear from your opponents' history. Only an anonymous internal identifier remains, with no data about you, and the record of the deletion in the security log. Signing out of the account (logout) does not delete the data.

12. Your rights

You can ask us at any time to:

access your data and receive a copy;
rectify it (you can also change your nickname and date of birth from the app);
erase it (also from the app, §11);
restrict its processing;
receive it in a structured, machine-readable format (portability);
object to processing based on legitimate interest;
withdraw your consent to notifications and to personalized ads, without affecting processing already carried out.

Write to info@oglut.com from the app or from the email linked to your account, so that we can check that the request comes from you. We reply within one month. You also have the right to lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or with the supervisory authority of the European Union country where you live, work or where the alleged infringement took place. If you live in the United Kingdom, you can complain to the Information Commissioner's Office (ico.org.uk).

13. Minors

Mind League is only for people who are at least 13 years old. When you complete your profile we ask for your date of birth: if it shows you are under 13 the profile is not completed, we do not save the date and you cannot use friends, challenges and leaderboards. If we find out that an account belongs to someone under 13, we delete it. Parents can write to us at info@oglut.com to request deletion.

If you are under 16, and until you give us your date of birth, you see only non-personalized ads and we do not ask for your consent to advertising (§17).

14. Security

Communications between the app and the server are encrypted (HTTPS). Access codes are saved on the phone in the system's protected keychain and on the server only in encrypted form with a hash function. Access to the data by our staff is limited by role and logged.

15. Changes

If we change this policy we update the date at the top. For important changes we tell you in the app before they take effect.

16. The website mindleague.games and cookies

The website mindleague.games presents Mind League. It has no accounts or sign-ins, and the mini-games you find there do not save results. Fonts and images are hosted on the website itself.

Technical browser storage. Without asking for your consent, because they are needed for the website to work (Art. 122 of the Italian Privacy Code), we save only two pieces of information in your browser:

the language you chose, until you change it or clear the browser data;
your choice on the cookie banner, for 6 months; after that we ask you again.

They stay in the browser and the website does not send them to the server.

Statistics cookies (Google Analytics). Only if you accept them on the banner do we use Google Analytics to count visits and understand which parts of the website work best (§3 l). Google Analytics saves the cookies _ga and _ga_<ID>, with a random identifier, for 13 months. Without consent it is not loaded and saves nothing. We have turned off data sharing with Google for other purposes, advertising features and the signals that link data to Google accounts. Refusing changes nothing in your use of the website. You can change your mind at any time from "Cookie preferences", at the bottom of every page, or by deleting the cookies from your browser. Google's privacy policy also applies to how Google processes this data (policies.google.com/privacy).

Contact form. The data and retention periods are in §3 i), §4 and §10. Only the email and the message are required: without them we cannot reply. To stop automated submissions we use a hidden field that people do not see and a limit on the number of submissions, calculated on the IP address in non-reversible form and kept for a few minutes.

Visits. As with any website, the server receives the IP address and the technical data of the request (page, browser, date and time). They remain in the infrastructure logs for 30 days (§10).

17. Ads in the app

The app may show ads provided by Google AdMob (Google Ireland Limited): banners at the bottom of some screens and full-screen ads between rounds, which you can close. We do not show ads during rounds or ads that give in-game rewards. Ads do not change scores, levels, leaderboards or challenges. With the Premium subscription the app shows no ads and sends Google no data for advertising.

What data Google receives. To choose and show ads and count views and taps, the Google component built into the app sends directly to Google:

the IP address and the approximate country or area derived from it;
the type and model of the phone, the operating system, the language and the app version;
the ads you see and whether you tap them;
the phone's advertising identifier (IDFA on iPhone, advertising ID on Android), only if you allow it;
your consent choice.

We do not send Google your nickname, email, date of birth or results. Google processes this data as an independent controller, under its own privacy policy (policies.google.com/privacy) and its rules for partner apps (policies.google.com/technologies/partner-sites).

Personalized ads. If you are at least 16, before the first ad we ask whether you accept personalized ads and the use of information stored on the phone. On iPhone, iOS then asks whether you allow the app to track you. If you refuse you still see ads, but not personalized ones, and the app works the same way. You can change your choice at any time from Profile → Settings → Privacy and ads and, for tracking, from the iPhone settings. If you live in the United States, from the same item you can ask that your data not be used for personalized ads.

Under 16. If you are under 16, or have not yet given us your date of birth (for example when playing as a guest), we do not ask for your consent and you see only non-personalized ads, chosen without your advertising identifier and without your activity in other apps. We only tell Google that you are under the age of consent, not your date of birth.