Privacy policy

1. Who operates BrainSync

BrainSync is operated by Jyoti Ranjan Padhi, an individual developer based in India (referred to as “BrainSync”, “we”, “us”, or “our”). This policy applies to the BrainSync website, creator studio, participant experiences, APIs, and BrainSync for Zoom.

Questions or privacy requests can be sent to support@jrpadhi.com.

2. Information we process

Creator account information

• Name and email address.
• A salted, one-way password hash. BrainSync does not store the original password.
• Essential session-cookie information used to keep a creator signed in.

Creator content

• Quiz titles, descriptions, questions, answers, scoring settings, chess positions, solution moves, and assignment settings.
• Uploaded images and related metadata such as filename, media type, size, and storage identifier.
• Publishing status, activity configuration, and usage history.

Participant and live-session information

• Display name, game PIN, answers, response times, scores, streaks, ranks, reactions, chess move attempts, and completion results.
• A temporary resume token stored on the participant’s device so a disconnected player can recover the same place in a game.
• An integration-provided participant identifier when BrainSync is embedded or opened through Zoom.

Zoom App information

• Zoom display name, meeting role, authorization status, meeting-specific participant identifier, and encrypted Zoom App context.
• Meeting, collaboration, and Zoom-user identifiers are transformed into keyed, pseudonymous hashes before being stored in BrainSync’s database.
• BrainSync does not request meeting audio, video, chat messages, recordings, contact lists, calendar data, or broad Zoom REST API access for the current experience.

Technical information

Our infrastructure may process IP addresses, browser/device information, request timestamps, security events, and error logs when necessary to deliver the service, prevent abuse, diagnose failures, and maintain availability.

3. How we use information

• Create and secure creator accounts.
• Save, publish, host, and deliver activities and media.
• Synchronize hosts and participants in real time.
• Calculate points, rankings, results, and activity reports.
• Reconnect participants after a refresh or temporary connection loss.
• Associate a Zoom meeting or Play Together collaboration with the correct BrainSync live session.
• Respond to support, security, privacy, and abuse reports.
• Protect BrainSync against fraud, unauthorized access, and service disruption.
• Comply with applicable legal obligations.

4. Legal grounds and consent

Depending on where a user lives, BrainSync processes information to perform the service requested by the user, pursue legitimate interests such as security and reliability, comply with law, or act with consent. A host or organization is responsible for providing any notices and obtaining any consents required before inviting participants or uploading personal information.

5. Cookies and local storage

BrainSync uses an essential, secure HTTP-only cookie for creator authentication. Participant devices use local storage for sound preferences and a game resume token. These technologies are necessary for requested functionality and are not used for cross-site advertising.

6. Service providers and disclosures

BrainSync uses carefully selected infrastructure providers to operate the service:

• Amazon Web Services for application hosting and media storage/delivery.
• MongoDB Atlas for managed database hosting.
• Zoom when a user opens BrainSync in the Zoom client or joins Play Together.

Providers process information only to supply their services under their own contractual and security obligations. We may also disclose information when required by law, to protect users and the service, or as part of a business transfer with appropriate safeguards. BrainSync does not sell or rent personal information.

7. Data retention

• Creator accounts and content: retained while the account is active and until deletion is requested or the content is deleted.
• Live sessions and results: retained so creators can review activity outcomes, until the associated creator requests deletion or the data is no longer needed to provide the service.
• Ended Zoom meeting bindings: retained as pseudonymous operational records only as long as reasonably needed for session integrity, troubleshooting, and abuse prevention.
• Pending media uploads: temporary upload records expire automatically if the upload is not completed.
• Security logs and support correspondence: retained only as long as reasonably needed for security, dispute resolution, and legal compliance.

Backup copies may persist for a limited period after deletion before being overwritten through normal backup rotation.

8. Security

BrainSync uses HTTPS, restricted infrastructure access, signed authentication sessions, password hashing, encrypted Zoom context verification, webhook signature validation, private media storage, rate limiting, and least-privilege access controls. No online system is risk-free, but we continuously work to reduce foreseeable risks. See the security overview.

9. Your choices and rights

Subject to applicable law, a user may request access, correction, portability, restriction, objection, or deletion of personal information. Creators can edit much of their content directly. Participants and creators can submit a verified request using the process on the data deletion page.

Removing BrainSync from Zoom stops future Zoom authorization. It does not automatically delete a separate BrainSync creator account or historical activity results; request deletion if those should also be removed.

10. Children and educational use

BrainSync is not primarily directed to children under 16. A person under 16 may use BrainSync only through a properly managed educational environment and with authorization from the school, parent, guardian, or other responsible adult as required by applicable law. Hosts should avoid requesting unnecessary personal information from participants.

11. International processing

BrainSync and its service providers may process information in countries other than the user’s country. Where required, appropriate contractual, organizational, and technical safeguards are used for international transfers.

12. Changes to this policy

We may update this policy when BrainSync, its integrations, or legal requirements change. The date at the top identifies the latest version. Material changes will be communicated through the service or another appropriate channel.