Privacy Policy

1. Who we are and what this covers

CodeXOps Technologies Private Limited (“we”, “our”, “us”) runs Brain and Bounce Kids: the website at brainandbounce.com, the learning web app at brainandbounce.com/app, and our mobile apps (together, the “Platform”). We decide why and how personal data on the Platform is used, which makes us the “data fiduciary” under India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the “operator” under COPPA.

Brain and Bounce Kids is for children studying in school classes 1–5, used together with a parent or guardian. A parent or guardian creates the account and the child profiles (“explorers”), and controls them. This policy covers Brain and Bounce Kids only. Any other Brain and Bounce app (for example one for adult learners) has its own privacy policy.

2. The short version

• A child never enters a real name, email address or phone number. An explorer has a call sign (a nickname) and a character.
• No advertising, no data sold, and no third-party tracking or advertising tools anywhere a child can be.
• Your data is stored and processed in the United States (see section 8).
• You can delete your account in the app, and email us for anything else (section 11).

3. Information we collect

3.1 Parent or guardian account

• Email address (used to sign in, verify the account and send you messages about it).
• A password, stored only as a one-way cryptographic hash (we cannot read it), or, if you use “Sign in with Google”, your Google account ID and email address. We do not receive your Google name or photo.
• Whether the email is verified, the date and time you gave parental consent, and the account status.
• Short-lived one-time codes and reset links we generate when you verify your email or reset a password.

3.2 Explorer (child) profile

• A call sign (nickname) and the character the child picked.
• The class level and programme they study, and their preferred language.
• The country whose questions they get (for example India), so money and measurement questions use the right currency and units. Our team sets this; it is never a location reading from the device.
• Settings you control: leaderboard participation and report-email preferences.

We do not ask for a child's real name, email address, phone number, home address, location, photo, school, or any government ID.

3.3 Learning activity

The answers a child gives to quiz and practice questions; accuracy and difficulty level for each topic; missions, practice and quiz rounds; coins, points (XP), ranks, badges and rewards; avatar items owned and equipped; and leaderboard standing. We use this to adapt questions, show progress and prepare your reports.

3.4 Subscriptions and payments

The plan and status of each explorer's subscription, the start, renewal and end dates, any promo code used, and identifiers and receipts from the payment provider (Razorpay for web purchases; Google Play for purchases in the Android app). We never receive or store your card, UPI or bank details; the payment provider handles them.

3.5 Messages you send us

If you use our contact form or write to support: your name, email address, optional phone number, and your message.

3.6 Technical information

Like most websites, our servers keep standard security and operational logs (for example IP address, browser type and requested pages). We also use your IP address to rate-limit requests and block abuse. We keep these records only as long as needed for security and abuse prevention, and do not use them to profile you or your child. Sign-in uses cookies described in section 12.

Our mobile apps contain no advertising, analytics or tracking SDKs. They ask only for the permissions needed for Google Play billing and, if you allow it, notifications. If you allow notifications, we store a push token for your phone so we can send them; it is deleted when you sign out on that phone or delete the account.

3.7 Images, fonts and scripts loaded from third parties

Some content on the Platform is delivered from servers run by other companies. When your browser or app requests it, that company automatically receives your IP address, device and browser type, the page or app that asked for it, and the time of the request. This happens as soon as the content loads. We do not send these companies your name, email or any child information, but they may keep their own logs under their own privacy policies.

• Images and artwork (characters, badges, avatar items, blog images) are delivered by Cloudinary, in the website, the mobile apps and the images inside our emails. Other artwork is served from our own servers.
• Fonts: we use your device's standard system fonts. No font service, such as Google Fonts, is contacted.
• Sign-in and payment scripts: Google's sign-in script loads on the sign-in screens, and Razorpay's checkout script loads only when a parent taps Subscribe. Neither loads on a child screen.
• Public website pages only: Google Analytics (only after you click Accept) and a Product Hunt badge image in the footer.

3.8 Website analytics (public pages only)

On our public marketing pages we use Google Analytics, but only if you click “Accept” on the cookie notice. It is never loaded in the learning app, the Parent Zone or any child screen.

4. How we use information

Where it comes from. Mostly from you, the parent, when you sign up and set up profiles; from your child's activity in the app; from Google if you sign in with Google; and from Razorpay or Google Play (or the Apple App Store) about the status of a purchase. We do not buy data about you or your child from anyone.

• To create and secure accounts, and to sign you in.
• To run the learning experience: personalised difficulty, missions, rewards and leaderboards.
• To send you the weekly and monthly progress reports for your explorers and other messages listed in section 5.
• To manage free trials, subscriptions, promo codes, cancellations and refunds.
• To answer your questions and provide support.
• To keep the Platform secure, prevent misuse and fix problems.
• To improve the Platform, using aggregate learning statistics.
• To meet legal, tax and accounting obligations.

We do not use personal data for advertising, we do not build advertising profiles, and we do not sell or rent personal data.

Where the law asks us to name the legal basis for each use, it is:

Information that has been anonymised or aggregated so that it can no longer identify a person or a device is not personal data, and we may use it to understand and improve the Platform.

5. Emails we send

• One-time verification codes and password-reset or password-change messages.
• A welcome email after you verify your account.
• A weekly and a monthly progress report about each explorer (accuracy, topics practised, missions, coins, badges and rank). These are on by default; they can be switched off in Parent Zone → Notifications (web or mobile app), with the unsubscribe link in any email, or by emailing us.
• Confirmations when you contact support.
• Reminders and progress notes about an explorer (for example a new mission or a streak), by email or as a push notification on your phone if you allowed notifications. They use the explorer's call sign, never their real name, and you can turn them off in Parent Zone → Notifications.

Emails are sent through SendGrid, which may rewrite links in some emails so it can record that a link was clicked, and some emails show images (such as our characters) hosted on Cloudinary. Payment receipts and payment notices come from the payment provider (Razorpay or Google Play). Push notifications are delivered through Expo's push service and then Google's or Apple's, to the parent's phone. Children have no accounts or devices of their own with us, and we do not send marketing emails or push notifications to children.

6. Leaderboards

Explorers can appear on a leaderboard for their class level. Only the call sign, character and score are shown, to other explorers at the same level who also take part. Participation is on by default and can be switched off for any explorer in the app's settings. Please help your child choose a call sign that does not include their real name.

7. Who we share information with

We do not sell personal data. We share it only with service providers that help us run the Platform:

We may also disclose information if the law requires it, to protect the safety of a child or user, or as part of a sale or reorganisation of our business (in which case this policy's protections continue to apply). Links on the Platform to other sites (for example YouTube, Instagram or LinkedIn) lead to services we do not control, and their privacy practices are their own.

8. Where your data is processed

Our main database is hosted by Neon on Amazon Web Services in the US East (N. Virginia) region, and our application servers are in Ashburn, Virginia, United States. Our AI, email and payment providers also process data in the United States or other countries. By using the Platform you understand that personal data is transferred to and processed outside India. We share only what each provider needs and rely on their security and contractual commitments.

9. Children’s privacy and parental consent

• Only parents or guardians can create an account. Explorer profiles are created and managed by the parent.
• We ask for your consent, and record the date and time, before an explorer profile is created. The Parent Zone and purchase screens sit behind a “grown-ups only” question.
• We do not show advertising, and we do not track or profile children for advertising or behavioural targeting.
• We use children's learning activity only to run and improve the learning experience and to report progress to their parent.
• You can withdraw consent, and access, correct or delete your child's data, at any time (section 11).

India (DPDP Act): anyone under 18 is a child, so we process children's data only with a parent's consent and without tracking, behavioural monitoring or targeted advertising directed at children. United States (COPPA): children cannot create accounts or give us contact details. A parent creates the account and gives consent before a child profile exists, and the only information about a child is the limited, non-identifying information in section 3.2 and 3.3, used only to run the learning experience.

To report inappropriate content, or a concern about a child's safety on the Platform, email hello@brainandbounce.com.

10. How long we keep information

• Account and learning data are kept for as long as the account is active.
• If you delete your account (Parent Zone → Delete account): you are signed out everywhere; your email address, password hash and Google ID are removed from the account and replaced with an anonymous placeholder; and every explorer profile is deactivated, so it no longer appears in the app or on leaderboards. Deleting a single explorer profile works the same way for that profile.
• Permanent erasure: a scheduled job permanently erases the learning activity, rewards, avatar and progress records of a deleted profile, and your parent-account support messages, contact messages and email-report history, about 7 days after deletion (the short delay lets us catch a mistaken deletion). If you want it done sooner, email us (section 11).
• We keep a minimal security record that an account was deleted (the date, and the email address it belonged to) for as long as needed to prevent abuse and meet legal obligations.
• Payment, subscription and billing records are kept for up to 8 years as tax and accounting law requires. They hold no learning data, and raw payment-provider payloads are redacted when an account is deleted.
• Support messages are kept for as long as needed to resolve your request, and are erased with your account.
• Email-report settings are kept until you change them or delete the account.
• Backups made by our database provider may hold deleted data for a limited period until they expire.

11. Your rights and how to use them

As a parent or guardian, for yourself and your child, you have the right to: get a copy of the personal data we hold; correct inaccurate data; have data erased; withdraw consent; and complain to us (see below). Under the DPDP Act you may also nominate another person to exercise these rights on your behalf.

• In the app: you can delete your account, change or add explorer profiles, edit their settings and turn the leaderboard on or off.
• By email: for a copy of your data, corrections, complete erasure or anything else, write to hello@brainandbounce.com from the email address on the account. We may ask you to confirm your identity first, and we will respond within 30 days. A self-service download of your data is not available yet, so we provide it by email on request.

These rights are not absolute. We may decline or limit a request if we cannot confirm who you are, if it would reveal another person's information, or if we must keep the data to meet a legal obligation or to handle a legal claim. We will tell you why when we do.

Do Not Track and Global Privacy Control: we do not load analytics or advertising cookies unless you click Accept on the cookie notice, so declining or a browser signal that asks us not to track you has the same effect: nothing is loaded.

If you are outside India

Our Android app is available in many countries. Wherever you live, the same protections in this policy apply, a parent or guardian must create the account, and we ask for parental consent before a child profile is created. In addition:

• European Economic Area, United Kingdom and similar laws: you may ask us to give you a copy of your data, correct it, erase it, restrict or object to its use, or move it to another service, and you may complain to your local data-protection authority. We rely on your consent and on what is needed to provide the service you asked for. Where the law sets the age of digital consent at 13 to 16, a parent or guardian gives that consent.
• California and other US states: we do not sell or share personal information, and we do not use it for targeted advertising. You may ask what we hold and ask us to delete it, and we will not treat you differently for doing so.
• Because we are based in India and our servers are in the United States (section 8), your data is transferred across borders. Write to the Grievance Officer to exercise any of these rights.

Grievance Officer

For privacy questions or complaints, contact the Grievance Officer, Ms. Pooja Pandey, CodeXOps Technologies Private Limited, at hello@brainandbounce.com, Greater Noida West, Gautam Buddha Nagar, Uttar Pradesh 201009. If we do not resolve your complaint, you may complain to the Data Protection Board of India once it is operational. We acknowledge every grievance within 48 hours and aim to resolve it within 30 days.

12. Cookies and similar technologies

You can clear cookies at any time in your browser.

13. Security

• Traffic to the Platform is encrypted with HTTPS.
• Passwords are stored only as one-way hashes; sign-in attempts are rate-limited.
• The website and app connect to our database with restricted access that cannot reach staff or administrative data.
• Access to production data is limited to staff who need it, and administrative changes are logged.

No system is completely secure. If a breach affecting your personal data occurs, we will tell you and the authorities as the law requires.

14. Changes to this policy

We may update this policy. For material changes we will email the parent account or show a notice in the app before they take effect, and we will change the effective date above. The previous version was dated October 6, 2026.

15. Contact us

Email: hello@brainandbounce.com
Company: CodeXOps Technologies Private Limited
Address: Greater Noida West, Gautam Buddha Nagar, Uttar Pradesh 201009

See also our Terms and Conditions and Refund and Cancellation Policy.