BRAINPANDORA

Privacy Policy

Effective date: November 3, 2026 • Operator: Bickert Web & Design • Contact: brain@brainpandora.com

This Privacy Policy explains how BrainPandora processes personal data when visitors and registered members use the platform, in compliance with the General Data Protection Regulation (GDPR) and the German Telecommunications-Telemedia Data Protection Act (TDDDG).

1. Data Controller

Bickert Web & Design
Eugen Bickert
Grafenspitz 11
94099 Ruhstorf an der Rott, Germany
Email: brain@brainpandora.com

2. Categories of Personal Data

Depending on how the platform is used, BrainPandora may process:

• Registration and account information (email address, password hash, unique account identifier).
• Public nicknames, avatar selections, and profile descriptions.
• Social authentication provider identifiers and verified email addresses (when using optional Google, Facebook, or LinkedIn single sign-on).
• Essential session tokens and CSRF security credentials.
• Uploaded and published content (signals, narratives, media, 3D meshes, games, metadata).
• User interactions, transmissions, comments, bookmarks, and reports.
• Gameplay telemetry and qualifying activity metrics.
• Discovery Boost balances, encounter logs, and daily pacing telemetry.
• Treasure discoveries, claim reservations, and voucher redemptions.
• Security events, rate-limiting tokens, and technical error logs.
• Device category (desktop, mobile, tablet) and referring origin.
• Communication and support ticket requests.

3. Purposes and Legal Bases

Personal data is processed for the following purposes:

• Platform operation, account management, and SSO: Registration, authentication, profile management, signal creation, and delivery of requested features. Legal basis: Article 6(1)(b) GDPR (performance of a contract).
• Security and abuse prevention: Protecting user accounts, mitigating session hijacking, enforcing gameplay anti-bot pacing, preventing duplicate vote/claim manipulation, and maintaining server integrity. Legal basis: Article 6(1)(f) GDPR (legitimate interest in platform security and promotional integrity).
• Discovery Boost and promotional rewards: Calculating Boost velocity, managing encounter draws, allocating promotional vouchers, and verifying non-duplicate claims. Legal basis: Article 6(1)(b) GDPR (contractual performance of promotional features) and Article 6(1)(f) GDPR (fraud prevention).
• Community moderation, support, and legal compliance: Reviewing transmission reports, investigating malicious code patterns via the automated safety checker, responding to support tickets, fulfilling EU Digital Services Act (DSA) requirements, and adhering to statutory retention duties. Legal basis: Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest in defending legal claims and maintaining community safety).
• Optional processing: Where explicit consent is collected (e.g. voluntary newsletter subscription with 1-click opt-out), processing relies on Article 6(1)(a) GDPR and may be withdrawn at any time with future effect.

4. Accounts and Public Profiles

Registered users configure a public nickname identity and may publish signals or transmit public profile messages. Public profile information, tier badges, and published signals are visible to other users and general visitors. Private account credentials (login email addresses, password hashes, and OAuth tokens) are strictly confidential and never displayed publicly or exposed in API responses. Users should refrain from including sensitive or third-party personal data in public biographies.

5. Social Login and Third-Party Authentication (SSO)

BrainPandora offers optional single sign-on (SSO) authentication through Google, Facebook (Meta), and LinkedIn.

When you actively choose a social login provider, your browser is redirected directly to the provider’s official OAuth authorization endpoint. Depending on the provider and the permissions granted, BrainPandora receives only the basic identity attributes necessary to authenticate your session: a unique provider account identifier, email address, and verified identity status.

This information is processed solely to create or access your BrainPandora account, link the authentication method, and verify your account without requiring manual password management. The legal basis is Article 6(1)(b) GDPR (contractual performance), supplemented by Article 6(1)(f) GDPR for abuse prevention.

Cookie & Tracking Safeguards: Social login is entirely voluntary; users can always register and authenticate using a standard email and password. BrainPandora does not embed external social widgets, tracking pixels, or third-party client SDKs (such as Google Identity Services SDK or Meta JavaScript SDK) on our pages. All login buttons are rendered locally using self-hosted vector graphics. No connection or data transmission to Google, Meta, or LinkedIn occurs until you actively click the login button.

During the redirected authentication flow, the selected provider processes technical connection data (including IP address and browser headers) in accordance with its own privacy policy:

• Google: https://policies.google.com/privacy
• Meta (Facebook): https://www.facebook.com/privacy/policy/
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

6. User-Generated Content and Content Safety Auditing

Content submitted for publication (including 3D models, audio, videos, game packages, and narratives) is stored and processed on our infrastructure. All submitted interactive code and game packages undergo an automated server-side content safety audit to detect malicious patterns (such as cookie stealing, unauthorized network beacons, or storage scraping). The safety audit evaluates code payloads before public approval to protect visitors from weaponized scripts.

7. Guest Sessions

Unregistered visitors receive a temporary, pseudo-random first-party session identifier strictly necessary to enable universe navigation, temporary game progress, and transient Discovery Boost tracking. If a guest registers or logs in during their session, accrued Discovery Boost is transferred to their permanent member account. If the visitor closes their browser without registering, transient guest telemetry expires automatically.

8. Promotional Rewards and Sponsor Claims

BrainPandora operates a promotional discovery system where members can discover encrypted sponsor treasures and promotional vouchers. BrainPandora processes only the data necessary to verify eligibility, enforce daily rate limits, and record successful redemption codes.

All voucher claim secrets are stored with AES-256 encryption at rest. Where a sponsor voucher directs an explorer to an independent partner or sponsor store, the external redemption is governed by that sponsor’s own platform terms and privacy policy. BrainPandora does not sell or transfer user browsing profiles to sponsors.

9. Cookies, Local Storage, and Technical Storage Technologies

BrainPandora operates without a cookie consent banner because the platform utilizes exclusively technically necessary first-party cookies and essential storage mechanisms exempt from consent under § 25 Abs. 2 Nr. 2 TDDDG, with personal data processing grounded in Article 6(1)(b) GDPR (contractual performance of requested services) and Article 6(1)(f) GDPR (platform security and anti-fraud integrity):

• Session Cookie (brainpandora_session): Strictly necessary to maintain user login state, guest session continuity, and secure request processing. Configured with HttpOnly, Secure, and SameSite=Lax security flags.
• CSRF Token (XSRF-TOKEN): Strictly necessary cryptographic token to defend against Cross-Site Request Forgery attacks.
• Local Storage (Interface State): Used solely to preserve user-selected client-side preferences (such as audio volume, cosmos visualizer settings, or active form drafts) strictly necessary to deliver the requested interactive application experience.

BrainPandora does not use advertising cookies, marketing pixels, cross-site trackers, or third-party profiling scripts. All client-side libraries (Three.js, Phaser, Google model-viewer), stylesheets, and typography are hosted and delivered directly from our own infrastructure, preventing external IP leakage to third-party CDNs.

10. First-Party Technical Analytics & Server Telemetry

BrainPandora conducts privacy-preserving, first-party technical telemetry solely to monitor server load, platform stability, and navigational pathways across the universe. The telemetry service is hosted and executed entirely on BrainPandora-controlled infrastructure.

To avoid creating persistent user tracking profiles across visits, the system generates a pseudonymous, session-scoped cryptographic key stored temporarily in volatile server session memory. Telemetry records contain only the requested URL path, coarse device category (desktop, tablet, mobile), referring domain host, page dwell duration, and aggregate scroll depth. No raw IP addresses, persistent cross-site tracking IDs, or hardware fingerprinting techniques are employed. Telemetry records are never linked to advertising networks, commercial brokers, or external analytics vendors.

11. Artificial Intelligence Technologies (Internal Content Creation)

BrainPandora utilizes automated algorithmic and artificial intelligence technologies exclusively for internal content generation and procedural universe world-building (such as generating fictional storylines, lore narratives, concept imagery, ambient audio, and 3D mesh assets).

These systems operate strictly as internal backend content-creation tools. Platform visitors and members do not interact directly with external AI service APIs. Personal member credentials, authentication tokens, private transmissions, and browsing histories are never supplied or transmitted to external AI providers. All generated assets are hosted and served directly from BrainPandora’s own infrastructure.

12. Hosting and Technical Infrastructure

BrainPandora is hosted on dedicated server infrastructure physically located within the Federal Republic of Germany (European Union). Infrastructure providers operate under binding Data Processing Agreements (DPAs) in full compliance with Article 28 GDPR, adhering to rigorous technical and organizational security measures.

13. International Data Transfers

Because BrainPandora is hosted in Germany, primary data processing remains strictly within the European Union. Where external authentication providers (e.g. Google, Meta, LinkedIn) process connection data outside the European Economic Area (EEA) following an active user request, transfers are governed by European Commission adequacy decisions (such as the EU-U.S. Data Privacy Framework) or Standard Contractual Clauses (SCCs) pursuant to Article 46 GDPR.

14. Data Retention Schedule

In accordance with the principle of storage limitation (Article 5(1)(e) GDPR), personal data is retained only for documented operational necessity and statutory requirements:

15. Technical and Organizational Security Measures (TOMs)

BrainPandora maintains robust technical security measures pursuant to Article 32 GDPR:

• Mandatory TLS 1.3 transport encryption across all endpoints with modern cipher suites.
• Cryptographically salted password hashing using modern key-derivation algorithms (Argon2id/Bcrypt).
• Encrypted storage at rest (AES-256-GCM) for sensitive voucher codes and provider secrets.
• Automated rate-limiting and IP velocity throttling to block automated scrapers and brute-force attacks.
• Automated Content Safety scanning to inspect and sanitize uploaded scripts and game packages.

16. Data Subject Rights

Under Chapter III of the GDPR, you have the following rights:

• Right of access (Art. 15 GDPR): Request confirmation and details of personal data processed about you.
• Right to rectification (Art. 16 GDPR): Correct inaccurate or incomplete personal records.
• Right to erasure (Art. 17 GDPR): Request deletion of your account and personal data (“Right to be forgotten”).
• Right to restriction of processing (Art. 18 GDPR): Restrict processing under statutory conditions.
• Right to data portability (Art. 20 GDPR): Receive an export of your personal data in a structured, commonly used format.
• Right to object (Art. 21 GDPR): Object at any time to processing grounded in legitimate interests (Art. 6(1)(f) GDPR).
• Right to withdraw consent (Art. 7(3) GDPR): Revoke voluntary consents (e.g. newsletter) with future effect at any time.
• Right to lodge a complaint: File a formal complaint with our lead supervisory authority: Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany (www.baylda.bayern.de).

To exercise any statutory data protection rights, please email: brain@brainpandora.com.

17. Automated Decision-Making and Profiling

BrainPandora employs algorithmic calculations to determine Discovery Boost velocity and verify eligible promotional challenge attempts. These automated mechanisms do not constitute automated decision-making producing legal effects concerning the user or similarly significantly affecting them within the scope of Article 22 GDPR.

18. Revisions to This Privacy Policy

We reserve the right to amend this Privacy Policy to maintain conformity with evolving technological architectures and statutory regulations. The current version will always be published on this page.

19. Contact

For inquiries regarding privacy, data protection, or compliance:
Email: brain@brainpandora.com • Bickert Web & Design, Grafenspitz 11, 94099 Ruhstorf an der Rott, Germany.