Privacy Policy

Brain Flex is operated by Atlas Labs LLC. This policy describes personal data processed in connection with the website, iPhone app, IQ assessments, purchases, Brain Flex Vault, challenges, and gifts. For product limits on scores, see the disclaimer.

Brain Flex is not a covered entity under HIPAA and is not a medical or clinical service. Do not submit protected health information expecting HIPAA protections.

Depending on how you use Brain Flex, we may process:

• Account and profile: email address, display name, authentication data, and Sign in with Apple identifiers when you use Apple Sign In.
• Age-related data: date of birth (private) and derived age band used for eligibility and research snapshots — not shown on public share pages.
• Assessment data: session metadata, question responses, response times, completion status, and results (including estimated IQ score and category profile).
• Purchases: transaction references, amounts, currency, status, assessment credits, gift entitlements, and Vault subscription entitlement status — not full payment card numbers.
• Vault activity: game sessions and attempts, Brain Points, streak information, and related progress.
• Social features: challenge links and share choices; gift/invite recipient email when you send a gift or invitation.
• Terms acceptance: versioned acceptance records.
• Analytics and diagnostics: product usage events, device/app environment signals needed to operate and improve the service, and aggregated calibration or quality diagnostics (for example age-band sample sizes without exposing your date of birth publicly).

We use personal data to:

• Authenticate and secure accounts;
• Deliver assessments — assemble, resume, score, and show results;
• Process purchases and subscriptions, honour credits, gifts, and Vault access;
• Provide Vault games, Brain Points, and streaks;
• Enable challenges and gifts you initiate;
• Analyze product usage and item performance in aggregated or de-identified form where practical;
• Detect fraud, abuse, and integrity issues;
• Provide support and communicate about the service;
• Comply with legal obligations and enforce our Terms.

We do not sell your personal information. We do share data with service providers who process it on our behalf to operate Brain Flex, including:

• Stripe — web payments and Vault subscriptions;
• Apple — Sign in with Apple and iOS In-App Purchases / subscription management;
• Supabase — authentication, database, and related backend infrastructure;
• Email provider — transactional messages such as gift or invitation emails when you use those features.

We may also disclose information if required by law, to protect rights and safety, or in connection with a corporate transaction (for example merger or asset sale), subject to appropriate safeguards.

Assessment data, purchases, credits, Vault activity, and results are readable by the account that owns them, enforced at the database level where implemented. Administrative access is restricted to support, operations, and calibration work on a need-to-know basis.

Sharing is opt-in. When you create a challenge link, you choose whether it displays your saved display name or an anonymous challenger label. Public pages include a snapshot of score/classification choices you enable — not your email, date of birth, payment details, full cognitive answer key, or private account identifiers.

A short-lived first-party challenge token may be stored in your browser so a challenge survives signup and payment navigation. It is not used for cross-site advertising and is retained for a limited time in the browser.

We retain account and assessment data while your account is active and as needed to provide the service. After account deletion, we remove or de-identify profile, assessment, Vault, and challenge data that is no longer required, except records we must keep for accounting, tax, fraud prevention, dispute resolution, or legal compliance (including certain purchase records).

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to or restrict certain processing. You can update profile details in account settings, manage marketing preferences where offered, and delete your account from account settings.

To exercise privacy rights, contact us through the Brain Flex website or account support channels. We may need to verify your request. You may also have the right to lodge a complaint with a supervisory authority where applicable.

Brain Flex is for adults 18+. We do not knowingly collect personal information from children under 18. If you believe we have, contact us through the website or account support channels so we can delete it.

We may process and store information in the United States and other countries where our providers operate. Those locations may have different data-protection laws than your home country.

We may update this Privacy Policy from time to time. Material changes will be reflected on this page and, where appropriate, through in-product notice. Continued use after an update constitutes acceptance of the revised policy where permitted by law.

Privacy questions can be sent through the Brain Flex website or the support channels available in your account. Related documents: Terms of Service and Disclaimer.