Privacy Policy

Deplexed is a cognitive training app. This policy explains what it stores, why, and how to get rid of it. It covers the website and the iOS app, which share one account and one database.

who is responsible for your data

Deplexed is operated from Cyprus by its owner, who is the data controller for the purposes of the GDPR. Anything in this policy, including a request to see or delete your data, can be raised at hello@deplexed.com, and we will answer within one month.

an account is required

Deplexed asks you to create an account before you use it. That account is what makes your progress survive a lost phone, sync between your devices, and appear on a leaderboard.

Training you do is held on your device first and mirrored to your account so it is not lost. If you never sign in, nothing about your training reaches us and there is nothing for us to look up or delete on your behalf; clearing your browser data or deleting the app erases it.

what an account stores

• Account: your email address and username. Passwords are hashed by our authentication provider and are never visible to us.
• Training: exercise scores, personal bests, progress, streaks, daily lesson state, playlists, favourites, ladder progress and aptitude or IQ results.
• Social: friend requests and friendships, your visibility settings, and any reports you file.
• Notifications: if you turn them on, the delivery address your browser or device issues, your time zone, and a record of what was sent so you are not sent it twice.
• How you found us: a coarse channel label such as “tiktok” or “direct”, along with the campaign name and the site that linked you, if any. This is written on your first visit, before you sign in and whether or not you ever do, so we can tell which channels bring people who stay. It is stored on your device, it is never overwritten by a later visit, and clearing your browser data removes it. We also keep the referral code you signed up under, if there was one.
• Survey answers, if you choose to answer them: age, sleep, exercise and similar, used to interpret your results and, in aggregate, to understand how scores vary across people.

The survey’s question about learning considerations never leaves your device. ADHD, dyslexia, autism and anxiety or depression are health information, so that answer is held locally, used only to shape the report you see, and is not uploaded, synced between your devices, or readable by us.

Apple Health data never leaves your iPhone. In the iOS app you can connect Apple Health, and if you do, Deplexed reads two things and only two things: how long you slept, and how many steps you took. They are used on the device to work out whether your rest and activity line up with your training scores. They are not uploaded, not synced to your account, not shared with anyone, and not readable by us. Forgetting them in Settings deletes them; the permission itself is withdrawn in Apple’s own Health app, under Sharing. Nothing is ever written back to Health.

There is no advertising identifier, no location tracking, no contact list access, no camera or microphone use, and no sale or sharing of personal data for advertising, ever.

why we are allowed to hold it

Under the GDPR each use of your data needs a lawful basis. Ours are:

• To provide the service you asked for (performance of a contract): your account, your training data, your social connections and your visibility settings. Without these there is no app to give you.
• Because you chose to turn it on (consent): notifications, survey answers, and connecting Apple Health. You can withdraw any of these at any time in Settings, and withdrawing does not affect what was done beforehand.
• To keep Deplexed working and honest (legitimate interests): security, abuse and cheat prevention, aggregate performance measurement, and the coarse channel label that tells us which channels bring people who stay. We have weighed these against your privacy and kept them to the minimum that answers the question.

what other people can see

Posting a score to a leaderboard publishes your username and that score. Your profile, scores, aptitude results and ladder progress each have their own visibility setting in Settings, and you can restrict any of them at any time.

who processes it, and where

• Supabase: the database and authentication behind your account.
• Vercel: hosting, plus aggregate analytics and performance measurement. These count page views and load times; they do not build a profile of you.
• Apple and Google: only if you enable notifications, and only to deliver them to your device.

These providers are based in the United States and your data is stored and processed there, outside the European Economic Area. Transfers rely on the European Commission’s standard contractual clauses, or on the EU-US Data Privacy Framework where the provider is certified under it. You can ask us for the details.

Deplexed does not currently sell anything, so no payment details are collected or processed.

how long it is kept

Your account and everything attached to it is kept for as long as the account exists, and no longer: delete the account and it goes immediately, as described below. That includes the record of which notification was sent to you, which exists so the same nudge is not sent to you twice. Ordinary server logs are held briefly by our hosting provider, are not organised by account, and expire on their own.

deleting your account

Settings → Delete account removes the account and everything attached to it: profile, scores, progress, playlists, friendships, notification settings, survey answers and your entries on every public leaderboard. It happens immediately and cannot be undone. Your username is released for someone else to take.

Two things survive by design. Posts you made in Club are kept but detached from you: the author and username are cleared, so the post remains without naming anyone. And ordinary server logs, which are not organised by account and expire on their own, are not searched retrospectively.

your rights

If the GDPR or a similar law applies to you, you have the right to ask for a copy of your data, to correct it, to have it deleted, to get it in a portable form, to restrict or object to how we use it, and to withdraw consent for anything you switched on. Most of these you can do yourself: your data is visible in the app, editable in Settings, and deletable outright with the control above. For anything else, or if you would like an export first, email us and we will sort it out.

We do not make automated decisions that produce legal or similarly significant effects about you. Scores and reports are shown to you and to nobody else unless you publish them.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to a data protection authority: in Cyprus that is the Office of the Commissioner for Personal Data Protection, and if you live elsewhere in the EEA or the UK you can complain to your own national authority instead.

children

Deplexed is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has created one, contact us and it will be removed.

changes

If this policy changes in a way that affects what is collected or who it is shared with, the date at the top changes and the app will say so rather than relying on you to re-read this page.