Privacy Policy
Brownie Points is run by Rushit Choksey (“we”). This page explains what we store when you use the app, why, who can see it, how long we keep it, and how to download or delete it. Questions go to rushitchoksey@gmail.com.
What we store
| Data | Why |
|---|---|
| Username, display name | To identify you and show you to the people you play with. |
| Password | To sign you in. We store only a salted one-way hash (scrypt), never the password itself. |
| Profile photo and bio, if you add them | To show the people you play with who you are. |
| Age group (under 13, 13–15, 16–17 or 18+), if you pick one. We never ask for your birth date. | To suggest deed ideas that suit your age and the age of the people you play with. |
| Country (India for now) | To suggest deed ideas that fit where you live. |
| Games: title, kind (partner, kid, friend…), the two players | To run the scoreboard. |
| Deeds and rewards: title, points, status and when each step happened | To keep score. |
| Account dates: when you signed up, last used the app, and accepted these terms | To apply the retention rules below and keep a record of your consent. |
| Sign-in safety counters (wrong password count, lockout time) | To protect your account from guessing. |
| Server logs: the address requested, time, errors, device and browser type, and a rough location (country or city) worked out from your IP address. The logging tool discards the IP address itself. | To keep the service running and secure. Logs never contain passwords. |
We don’t collect your email, phone number, location, contacts or payment details. There are no ads, no analytics trackers and no cookies. The app keeps your sign-in token and a few display preferences in your browser’s local storage; that data stays on your device.
The legal basis for processing is performing our agreement with you (running the app you signed up for) and our legitimate interest in keeping it secure.
Who can see it
- The other player in a game sees your name, username, photo, bio, age group, country and everything in that game.
- Anyone with a game code can join that game if it has a free seat, so share codes only with the person you mean to play with.
- Our service providers, who process data for us and only on our instructions:
- Microsoft Azure (Static Web Apps, Table Storage, Application Insights) hosts the app and stores data in Microsoft’s East US 2 region (United States), encrypted at rest.
- Google Fonts and jsDelivr serve the app’s fonts and the QR-code helper. Your browser contacts them directly, so they see your IP address.
We don’t sell or share your data with anyone else, except where the law requires it.
How long we keep it
| Data | Kept until |
|---|---|
| Your account and profile | You delete it, or 24 months after you last signed in or used the app. Then it is deleted automatically. |
| A game and its deeds | Either player deletes the game, or 24 months after anything in it last changed, or both players’ accounts are gone. A game nobody joined and nothing was added to is deleted after 30 days. |
| Your part in a game shared with someone, after you delete your account | Your name, username, photo and bio are removed. You appear as “Former player” so the other person keeps their own history. |
| Server logs | 30 days. |
Deletion takes effect in our live database straight away. We don’t keep separate backups, so deleted data can’t be restored.
Your choices and rights
- See and download your data: My games → Edit profile → Download my data gives you everything we store about your account as a file.
- Correct it: change your name, photo, bio, age group and country in Edit profile.
- Delete it: Edit profile → Delete my account. This happens immediately.
- Sign out everywhere: Edit profile → Sign out on all devices.
We follow India’s Digital Personal Data Protection Act, 2023. Under it you can ask us for a summary of your data, correct or erase it, and nominate someone to act for you; you can also complain to the Data Protection Board of India. For any concern, our grievance contact is Rushit Choksey at rushitchoksey@gmail.com. Depending on where you live (for example under the GDPR or UK GDPR, or Californian law), you may also have the right to object to or restrict processing and to complain to your data protection authority. Write to rushitchoksey@gmail.com and we’ll reply within 30 days.
Children
Brownie Points is open to all ages. Anyone under 18 needs a parent’s or guardian’s agreement before signing up, and the sign-up box asks for that. We ask parents to set up or watch over a child’s account. For children we collect only what this page lists: no email, phone number, location, ads, trackers or behavioural profiling. The age group is used only to pick suitable ideas. A parent or guardian can ask to see, correct or delete their child’s data, or withdraw their agreement, by writing to rushitchoksey@gmail.com; we’ll act on it within 30 days.
Security
Traffic is encrypted with HTTPS. Passwords are hashed with scrypt, repeated wrong passwords lock the account, and sign-in sessions expire after 90 days. No system is perfectly secure; if we learn of a breach that affects you, we’ll tell you as the law requires.
Changes
If we change this policy, we’ll update the date above. If a change affects what we collect or how long we keep it, we’ll show a notice in the app first.