Your data, no jargon.
What we gather, why, who helps us handle it and how you stay in control, written to match how Brandaax actually runs.
Last updated: 17 October 2026
Short version: you can browse and play with no profile and without sharing personal details. If you make a profile or message us, we use what you send only to run that profile and to answer you. No ads, no analytics or tracking tools, no selling of data, and we never ask for card or payment details.
Who is responsible
The data controller for this website is (company number ), .
“We” and “us” mean whoever operates Brandaax (brandaax.com). For questions about your data, use the contact form and choose “Privacy question”, or email .
What we collect
1. If you create an optional profile
- With email: your first and last name, a screen name, an email address and a password. The password is stored only as a scrambled hash, never as the password itself.
- With Google: your name, verified email and Google account ID, passed to us by Google after you approve the sign-in. We then ask for a screen name and your date of birth.
- Date of birth: checked a single time at sign-up to confirm you are 18+. It is not stored; only the fact that your age was confirmed is kept.
- Account records: the date you joined, your latest log-in, how you signed up (email or Google), and a failed-attempt counter that locks the account for 15 minutes after five wrong passwords.
2. If you message us
The contact form collects your name, email, subject, message and, when you arrive from a game page, that game’s name. Please keep passwords and sensitive details out of messages.
3. If you reset a password
We generate a one-time link that works for 60 minutes. Until it is used or expires we store only a scrambled version of its secret code.
4. Technical and security data
- Abuse limits: to slow spam and password guessing, the server keeps short-lived counters linked to a hashed form of your IP address. They expire within a day.
- Mail results: a technical log of whether each email was sent or failed, with any error text from the mail server. It does not hold your message.
- Server logs: like most sites, our host’s web server may record standard details such as IP address, browser type and requested pages, for security and troubleshooting.
5. What we do not collect
No payment or card details (nothing is for sale), no advertising or analytics tools, and no profiles built about you.
Why we use it, and the legal basis
| Purpose | Data | Basis |
|---|---|---|
| Create and run a profile, keep you logged in | Account details, session cookie | Performing our agreement with you |
| Confirm you are 18+ | Date of birth (not stored) | Legal obligation and legitimate interest in keeping minors out |
| Answer your messages and requests | Contact form data | Legitimate interest in replying, and your request |
| Email a password-reset link | Email address, reset link | Performing our agreement with you |
| Stop spam, abuse and password guessing | Hashed IP counters, failed-attempt counter | Legitimate interest in security |
Where it goes and who else sees it
- Our server. Account details live on our web server in protected files that cannot be opened from the web. There is no database.
- Email delivery. Contact messages and reset emails are sent through our email provider, Brevo (SMTP relay), and arrive in our support inbox. We keep messages only as long as needed to handle your request and any follow-up.
- Google. Only if you choose “Continue with Google”. Google’s sign-in code loads only on the log-in and sign-up pages, and Google handles sign-in under its own Privacy Policy.
- Hosting. Our host stores the site and its server logs.
- The games. Games are served from our own domain (brandaax.com) and load inside our pages. A game may save its own settings or progress in your browser’s storage; we do not use that to identify you.
Some providers may process data outside your country. We do not sell personal data or share it for advertising, and may disclose data when the law requires.
How long we keep it
- Profile: until you delete it in My account (immediate) or ask us to.
- Messages: as long as your request and follow-up need, then deleted.
- Reset links: up to 60 minutes, or until used.
- Abuse counters: about a day at most.
- Sessions: until you log out, or up to 30 days if you tick “Remember me”.
Security
Passwords are hashed, account files sit out of reach of the web, forms are guarded against cross-site requests, and repeated wrong passwords briefly lock an account. No system is perfectly safe, so please choose a strong, unique password.
Your rights
Depending on where you live, you may be able to ask to see the data we hold on you, correct or erase it, restrict or object to its use, get a copy, or withdraw consent. With a profile, you can delete it yourself anytime in My account. For anything else, use the contact form and choose “Privacy question”. You can also complain to your local data protection authority.
Cookies and browser storage
Only strictly necessary cookies and storage are used. See the Cookie Policy.
Children
Brandaax is for adults aged 18 and over, and we knowingly collect nothing from anyone younger. If you think a child has made a profile, tell us and we will remove it.
Changes
If our practices change, we will update this page and its date.