Privacy Policy

Effective Date: February 7, 2026  |  Last Updated: February 20, 2026

Brainrot Studios ("we," "us," or "our") develops and publishes Escape the Brainrot (the "Game"), a mobile application available on Android and iOS. This Privacy Policy explains how we collect, use, store, and share information when you use our Game.

By downloading, installing, or using the Game, you agree to this Privacy Policy. If you do not agree, please do not use the Game.

1. Data Controller

The data controller responsible for your personal data is:

For questions regarding data protection, you may contact our Privacy Officer at the email address above.

2. Information We Collect

2.1 Information You Provide

• Display Name: When you first play, a random display name is automatically generated for you (e.g., "SwiftRunner472"). You may change this to a custom display name of your choice, subject to profanity filtering and a 14-day cooldown between changes. Your display name is publicly visible to other players on leaderboards and friend lists. Display names are stored on PlayFab (Microsoft) servers. Users in Child Mode (under 13) cannot set custom display names and retain only their auto-generated name.
• Friend Connections: When you add friends using a Player ID or display name, we store that relationship.
• Age Verification: During initial setup, we ask for your year of birth to verify you meet the minimum age requirement.
• Bug Report Screenshots: When submitting a bug report, you may optionally attach an image from your device's photo library. The image is sent to our development team and is not stored on our servers or shared with third parties.

2.2 Information Collected Automatically

• Device Information: Device model, operating system version, graphics hardware, and system memory. This helps us optimize performance and diagnose crashes.
• Device Identifiers: Anonymous device-based identifiers used for account creation and authentication. We do not collect your name, email address, phone number, or physical address.
• Gameplay Data: Scores, distance traveled, coins and gems earned, power-ups used, missions completed, characters unlocked, items equipped, and session timestamps. This data is used to save your progress and populate leaderboards.
• Purchase Information: Records of in-app purchases (product IDs, timestamps). Payment processing is handled entirely by Apple (App Store) or Google (Google Play); we do not collect or store credit card numbers or billing addresses.

2.3 Information Collected by Third-Party Services

Our Game uses the following third-party services, each of which may collect data according to their own privacy policies:

Service	Provider	Purpose	Data Collected	Privacy Policy
Google AdMob	Google LLC	Advertising (rewarded videos, interstitials, banners)	Device identifiers, approximate location, ad interaction data, app usage patterns	Google Privacy Policy
PlayFab	Microsoft Corporation	Authentication, cloud saves, leaderboards, friend system	Anonymous account ID, gameplay statistics, friend relationships, display name	Microsoft Privacy Statement
Firebase Crashlytics	Google LLC	Crash reporting and stability monitoring	Device model, OS version, app version, crash logs, stack traces	Firebase Privacy
Unity IAP	Unity Technologies	In-app purchase processing	Purchase receipts, transaction identifiers	Unity Privacy Policy
Apple App Store / Google Play	Apple Inc. / Google LLC	App distribution and payment processing	As per their respective privacy policies	Apple / Google

All third-party service providers with whom we share user data are contractually required to provide the same or equivalent level of protection for your personal information as described in this Privacy Policy.

3. Legal Bases for Processing

We process your personal data on the following legal bases:

Processing Activity	Legal Basis
Cloud saves, gameplay progress, leaderboards, friend system	Performance of a contract — necessary to provide the Game's core services
Personalized advertising (Google AdMob)	Consent — you may opt in or out at any time via the in-game consent screen
Non-personalized advertising	Legitimate interest — to support the free-to-play model
Crash reporting (Firebase Crashlytics)	Consent — crash reporting is disabled by default and only enabled with your explicit consent
Fraud prevention and security	Legitimate interest — to protect the integrity of the Game and its players
In-app purchases	Performance of a contract — necessary to deliver purchased content
Aggregated analytics for Game improvement	Legitimate interest — to improve the Game experience (data is anonymized)

4. How We Use Your Information

• Save and sync your game progress across devices via cloud saves.
• Provide leaderboards and social features so you can compete and connect with friends.
• Display advertisements to support the free-to-play model. If you consent to personalized ads, ad content may be tailored to your interests. You can opt out at any time. You may also manage your Google ad preferences at https://adssettings.google.com.
• Process in-app purchases and deliver purchased content (gems, skins, subscriptions).
• Diagnose crashes and improve stability using crash reports (only when you have opted in).
• Improve the Game by analyzing aggregated, anonymized gameplay patterns.
• Prevent fraud and abuse in purchases and leaderboards.
• Investigate and resolve bugs using bug reports and optional screenshot attachments you submit.

5. Your Choices and Consent

When you first launch the Game, you are presented with a consent screen where you can choose to enable or disable the following. Each option is presented separately and is not bundled with other terms:

• Personalized Ads: Controls whether ads are tailored to your interests. Disabled by default. You can deny this and still see non-personalized ads.
• Crash Reporting: Controls whether crash data is sent to Firebase Crashlytics. Disabled by default.
• Cloud Saves: Controls whether your progress is synced to PlayFab servers. If disabled, progress is saved locally only.

You can update your preferences at any time through the Game's Settings menu. You may also select "Deny All" to refuse all optional data collection. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal.

5.1 Ad Tracking (iOS)

On iOS devices, we request your permission via Apple's App Tracking Transparency (ATT) framework before collecting the Identifier for Advertisers (IDFA) for ad personalization. You can change this permission at any time in your device's Settings > Privacy & Security > Tracking.

5.2 Consent Management for EEA/UK/Switzerland

For users in the European Economic Area, United Kingdom, and Switzerland, we use a consent mechanism compliant with the IAB Transparency and Consent Framework (TCF) to obtain and manage your consent for personalized advertising.

6. Data Sharing

We do not sell your personal information.

We may share device identifiers and ad interaction data with Google AdMob for the purpose of serving advertisements. Under some privacy laws (including the California Consumer Privacy Act), this may constitute "sharing" of personal information for cross-context behavioral advertising. You may opt out of this sharing at any time through the in-game consent screen or by selecting "Deny All" for personalized ads.

We share data with the third-party services listed in Section 2.3, and only for the purposes described. Specifically:

• Google AdMob receives device and usage data to serve advertisements.
• PlayFab (Microsoft) receives gameplay data to provide cloud saves, leaderboards, and social features.
• Firebase Crashlytics (Google) receives device and crash data to help us fix bugs (only when you opt in).

Your display name, Player ID, high score, player level, and approximate last-login time are visible to other players who add you as a friend.

7. Data Retention

• Gameplay data and account data is retained for the lifetime of your account or until you request deletion.
• Crash reports are retained for 90 days by Firebase Crashlytics.
• Ad interaction data is retained by Google according to their data retention policies.
• Device identifiers are retained for the lifetime of your account or until you request deletion.
• Purchase records are retained for the lifetime of your account or as required by applicable tax and financial regulations.
• Local data (on your device) is deleted when you uninstall the Game.
• Bug report screenshots are retained only in the developer's email inbox and are deleted after the issue is resolved.

8. Data Security

We use industry-standard security measures to protect your data:

• All data transmitted between the Game and our servers uses encrypted connections (HTTPS/TLS).
• PlayFab cloud data is stored on Microsoft Azure infrastructure with enterprise-grade security.
• We do not store passwords, payment details, or sensitive personal information on our servers.
• We maintain a written information security program appropriate to the size and scope of our data collection.

No method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Children's Privacy

We present a neutral age screen when the Game is first launched. Users who indicate they are under 13 are placed into "Child Mode", which automatically disables all optional data collection and online features. In Child Mode:

• Only non-personalized, contextual ads are displayed (no behavioral targeting or data collection for advertising purposes)
• No analytics data is collected
• No crash reports are sent
• No cloud saves or online leaderboards (progress is saved locally only)
• No PlayFab account is created or accessed
• No custom display names — users retain only the auto-generated random name assigned at first launch
• In-app purchases remain available (subject to platform parental controls)

We do not knowingly collect personal information from children under the age of 13. If we learn that we have collected personal information from a child under 13, we will promptly delete that information.

9.1 Parental Rights (COPPA)

If you are a parent or guardian and believe your child under 13 has provided us with personal information or is using the Game, please contact us at the email address below. You have the right to:

• Review the personal information collected from your child.
• Request deletion of your child's personal information.
• Refuse to permit further collection of your child's personal information.

We will respond to your request within 30 days.

9.2 Users Aged 13–17

If you are between 13 and 17 years of age, please review this Privacy Policy with your parent or guardian before using the Game. In certain jurisdictions:

• California (CCPA): Personal information of users under 16 is treated as sensitive personal information. We will not sell or share your personal information for cross-context behavioral advertising unless you have affirmatively opted in.
• Brazil (LGPD): For adolescents aged 12–17, we process data in their best interest and with consideration for applicable protections.
• South Africa (POPIA) and United Kingdom: Users under 18 are considered children under local law. We process their data with additional safeguards and in their best interest.

10. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you.
• Deletion: Request that we delete your data and account. You can delete local data through the Game's Settings. For server-side data deletion, contact us at the email below.
• Correction: Request correction of inaccurate data.
• Opt-Out / Withdraw Consent: Withdraw consent for optional data collection (personalized ads, crash reporting, cloud saves) at any time through the in-game Settings.
• Data Portability: Request your data in a portable, machine-readable format.
• Restriction: Request that we restrict processing of your data in certain circumstances.
• Objection: Object to processing based on legitimate interest.

10.1 Account Deletion

You may request complete deletion of your account and all associated data by:

• Using the "Delete Account" option in the Game's Settings menu, or
• Contacting us at brainrotstudios.privacy@gmail.com

We will process deletion requests within 30 days. Deletion includes removal of your data from PlayFab cloud storage, leaderboards, and friend lists. Some anonymized, aggregated data that cannot be linked back to you may be retained.

10.2 For EU/EEA Residents (GDPR)

Under the General Data Protection Regulation (GDPR), you have the rights listed above plus:

• Right to withdraw consent at any time via the in-game Settings. Withdrawal does not affect the lawfulness of processing before withdrawal.
• Right to lodge a complaint with your local data protection supervisory authority. A list of EU/EEA supervisory authorities is available at edpb.europa.eu.
• Right to information about automated decision-making: We do not use automated decision-making or profiling that produces legal effects concerning you. Ad personalization by Google AdMob is based on your consent and can be disabled at any time.

10.3 For UK Residents (UK GDPR)

You have the same rights as described in Section 10.2. You may lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10.4 For California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by the CPRA), you have the right to:

• Know what personal information we collect, use, disclose, and sell/share.
• Delete your personal information.
• Opt out of the sale or sharing of your personal information. We do not sell personal information. You can opt out of sharing for advertising via the in-game consent screen.
• Limit the use of sensitive personal information.
• Non-discrimination for exercising your privacy rights.

Categories of personal information we collect (per Cal. Civ. Code § 1798.100):

• Identifiers (device identifiers, Player ID, display name)
• Internet or electronic network activity (gameplay data, ad interactions, app usage)
• Geolocation data (approximate location via AdMob, if consented)
• Commercial information (in-app purchase history)

10.5 For Brazilian Residents (LGPD)

Under the Lei Geral de Proteção de Dados (LGPD), you have the right to:

• Confirmation of processing and access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data.
• Data portability.
• Information about public and private entities with which your data has been shared.
• Revocation of consent.
• Filing a complaint with the ANPD (Autoridade Nacional de Proteção de Dados) at gov.br/anpd.

10.6 For Canadian Residents (PIPEDA)

Under the Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access your personal information, challenge its accuracy, and withdraw consent for its collection, use, or disclosure. You may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.

10.7 For South African Residents (POPIA)

Under the Protection of Personal Information Act (POPIA), you have the right to access, correct, and delete your personal information. You may lodge a complaint with the Information Regulator at inforegulator.org.za.

10.8 For Residents of Thailand (PDPA)

Under Thailand's Personal Data Protection Act (PDPA), you have the right to access, correct, delete, restrict processing, and port your data. You may withdraw consent at any time and lodge a complaint with the Personal Data Protection Committee (PDPC).

10.9 For Residents of Singapore (PDPA)

Under Singapore's Personal Data Protection Act (PDPA), you have the right to access and correct your personal data, and to withdraw consent for its collection, use, or disclosure. You may file a complaint with the Personal Data Protection Commission (PDPC) at pdpc.gov.sg.

11. International Data Transfers

Your data may be transferred to and processed in countries other than your own, including the United States, where our third-party service providers Google LLC and Microsoft Corporation operate.

• For EU/EEA users: Transfers to countries outside the EEA are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission, or by adequacy decisions where applicable.
• For UK users: Transfers outside the UK are protected by UK-approved Standard Contractual Clauses or adequacy regulations.
• For Canadian users: Your personal information may be processed in the United States by Google LLC and Microsoft Corporation. While stored outside Canada, your information remains subject to applicable legal protections.
• For all other users: By using the Game, you consent to the transfer of your data to the United States and other countries where our service providers operate.

12. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Game (via an updated consent prompt) or by updating the "Last Updated" date at the top of this page. Where required by law, we will obtain your consent to material changes. Your continued use of the Game after changes constitutes acceptance of the updated policy.

13. Contact Us