Privacy Policy

1. The data controller

Name: Richmond Digital Kft.

Registered office: 2740 Abony, Pázmány Péter utca 3., Hungary

Email: richard@richmonddigital.hu

2. What data do we process?

Waitlist: your email address, the time of sign-up and of your consent, your chosen language, and an irreversible (salted) hash derived from your IP address to filter out mass abuse. We do not store raw IP addresses.

User account (if you register): name, email address, password (only in a secure, irreversible form), time zone and settings.

Training data: the results of your game sessions (answers, reaction times, accuracy, levels), the daily check-in (sleep, mood, caffeine), questionnaire answers, assessment results, points and achievements.

Thinking workshop: the text of your “You First” entries and any AI answers you paste in are stored encrypted (AES-256-GCM).

The locations of your Memory Palace (e.g. the rooms of your home) are stored encrypted.

Personal texts in games (e.g. your Story Machine stories, your ideas in A Thousand Uses) and your own Knowledge Bank cards: stored encrypted.

Feedback: the message you send from the app (encrypted), the page address and your browser type.

Login log (to stop password guessing): the email address entered at login, the time, whether it succeeded and a salted, irreversible hash of the IP address – kept for 30 days.

Error log: if something goes wrong in the app, the error message (with email addresses and identifiers masked), the page address and the browser type – not linked to you, kept for 30 days.

Invitations (beta): when an invite was used and which invite you registered with.

Friends and duels: your friend code, your friend requests and friendships, and your duels (game, level, scores). Your friends only see: your name, level and title, streak, weekly XP, game levels and best results, and medals – you can switch this sharing off; your journal, questionnaires and assessments are never shown.

3. What do we use it for, and on what legal basis?

Waitlist: notifying you about the launch – based on your consent (GDPR Article 6(1)(a)). You can withdraw your consent at any time.

Account and training data: providing the service (training, progress tracking, a personalised training plan) – based on the performance of a contract (GDPR Article 6(1)(b)).

The daily check-in and the questionnaires may qualify as health-related information: we process these only with your explicit consent, and use them only for your own personal insights (GDPR Article 9(2)(a)).

We do not sell your data, do not use it for advertising, and do not make automated decisions based on it that would have legal effects on you.

4. How long do we keep it?

Waitlist: until launch or until you withdraw your consent, but for no longer than 2 years.

Account and training data: until your account is deleted. When an account is deleted, all associated data is permanently erased.

Backups: the database provider's point-in-time recovery keeps earlier states for at most 30 days, so a deleted account's data disappears from backups within 30 days at the latest. We restore from backups only to fix faults – never to bring back a deleted account.

5. Who can access it (data processors)?

Hosting and application runtime: Vercel Inc. (data is processed in the EU, in the Frankfurt region).

Database: Neon (part of Databricks, Inc.) – data is stored in the EU, in the Frankfurt region, over encrypted connections.

Vercel and Neon are US companies: any access from outside the EU is safeguarded by the EU–US Data Privacy Framework (DPF) and the European Commission's Standard Contractual Clauses (SCC); the data processing agreements (GDPR Article 28) are part of their standard terms.

Email delivery: Lettermint B.V. (Netherlands) – sends account-related system emails (password reset, email address confirmation). It receives the recipient's email address and name, the message content and delivery events; it processes and stores data only in the EU and keeps sending logs for 28 days. We don't send marketing emails. The data processing agreement (GDPR Article 28) is part of its standard terms.

There is currently no other data processor; if there is one, we will list it here in advance.

6. Cookies and visitor analytics

The app uses only a functional cookie that is necessary for logging in.

For offline use, the app stores the app pages you open (and those preloaded after you log in) and any game sessions not yet uploaded in your browser's storage on your device. They stay on your device only; the saved pages are deleted when you log out or log in with another account.

On the public pages (home page, legal pages) we use cookieless, anonymous visitor counting (Vercel Web Analytics): it does not identify you, does not track you across sites, and does not require consent. There is no third-party measurement of any kind inside the app.

7. Your rights

You can request access to your data, its rectification or erasure, or the restriction of its processing, and you can object to its processing. You have the right to data portability: you can download all your data at any time in the app's settings (JSON/CSV).

You can withdraw your consent at any time; this does not affect the lawfulness of processing carried out before the withdrawal.

You can send your request to the data controller's email address (richard@richmonddigital.hu); we will respond within one month at the latest.

You can lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH; 1055 Budapest, Falk Miksa utca 9–11., www.naih.hu), or you can turn to the courts.

8. Data security

Encrypted connections (HTTPS), passwords stored with a secure hash, field-level encryption for the most sensitive texts, strict access control and a Content Security Policy (CSP).

9. Children

Elmejáték is intended for people aged 16 and over. We do not knowingly process the data of anyone under 16; if we learn that someone under 16 has signed up or created an account, we delete their data without delay.

If you are a parent or legal guardian and notice this, please write to the controller's email address.