MINDPrivacy Policy
Controller (Art. 13(1)(a) GDPR). Kruxmind ("the app", kruxmind.com / .cc / .app) is owned and developed by Alfredo Rodriguez Henriquez ("freddyrhcubes"), a natural person, Therese-Giehse-Str. 6, 13599 Berlin, Germany. Full details in the Legal Notice. Contact: info@kruxmind.com. We are not required to appoint a Data Protection Officer. This policy applies to EU users under Regulation (EU) 2016/679 (GDPR).
1. Data only on your device (default)
Same as the previous version. The app works without an account. Everything is stored in local storage (localStorage): times and sessions, self-assessments (activation, focus, confidence), trainer progress, language and settings. We have no access. If you clear browser/app data, it is lost. Your self-assessments (activation, focus, confidence) are NOT synced: they always stay only on your device and never reach our servers.
2. Optional account and sync
Legal basis: performance of a contract (Art. 6(1)(b) GDPR). On account creation we store email, nickname and password as a salted cryptographic hash (never in plaintext). The session uses a secure HttpOnly cookie. With sync enabled, your sessions, times (with penalties), failure tags and algorithm progress are uploaded, solely to restore them on your devices. Sync is enabled only after your informed consent.
MAC address of your smart cubes. If you connect a Bluetooth cube (GAN, MoYu, QiYi), its MAC address is required to decrypt what the cube sends: without it the cube pairs but does not work. The browser does not give it to us, so you enter it once. With sync enabled, that same consent covers storing in your account the MAC of the cubes you connect, for the sole purpose of not having to enter it again on your other devices. It is an address of your own equipment, not of you as a person: it is not shared with anyone, not used for advertising or tracking, and kept only while sync is active. You can delete it by disconnecting the cube and turning sync off, or by requesting deletion of your account (§ 8).
3. Daily challenge (leaderboard)
Legal basis: consent (Art. 6(1)(a)), given on submission. Your nickname and time are shown publicly in the day's table. Your email is not shown. Requires an account (16+).
4. Analytics
Legal basis: legitimate interest (Art. 6(1)(f)). Cloudflare Web Analytics, aggregated and cookieless: no profiling, no cross-site tracking. This legitimate interest does not override your rights, as analytics is strictly aggregated and without identifiers. We use no Google Analytics, no advertising pixels and no third-party trackers. (For advertising in the installed app, see "Advertising".)
5. Infrastructure and processors
Cloudflare (Pages, Workers, D1 database with EU jurisdiction) acts as processor (Art. 28), encrypted (HTTPS/TLS).
6. What we do not do
We do not sell or rent your data. Without your consent we show no personalized advertising (see "Advertising"). No access to contacts, location, microphone* or camera. (*Stackmat support uses the microphone only to decode the timer signal on your device; that audio is never recorded or sent.)
7. Local storage and cookies (§ 25 TDDDG)
The session cookie and local storage (settings/progress) are strictly necessary for the app to work and to provide the service (§ 25 TDDDG / Art. 5(3) ePrivacy) and require no explicit consent. For analytics and functionality we use no tracking or advertising cookies and show no consent banner in the browser. Ads in the installed app require your prior consent (see "Advertising").
Advertising (Google AdSense)
In Kruxmind (web version in the browser and installed app distributed via Google Play) we display ads through Google AdSense in certain free modules. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"); its parent company is Google LLC, USA.
Without your consent, no ads are shown. Google AdSense requires, for any type of ad — including non-personalized ads — access to your device under § 25 TDDDG. Therefore ads are only shown after your consent.
Ads are only displayed if you have previously given consent via our consent banner. The legal basis is your consent (Art. 6(1)(a) GDPR and Sec. 25(1) TDDDG). You may withdraw it at any time with future effect in the app's privacy settings (Art. 7(3) GDPR).
Third-party vendors, including Google, use cookies or comparable identifiers to serve ads based on prior visits to this app/website or other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your use of this service and/or other websites. You may opt out of personalized advertising at any time in Google's Ads Settings (adssettings.google.com); alternatively at www.aboutads.info or www.youronlinechoices.com.
Personal data may be transferred to the USA in this process. Google LLC is an active participant in the EU-US Data Privacy Framework; standard contractual clauses (Art. 46 GDPR) additionally apply. More information: policies.google.com/privacy and policies.google.com/technologies/partner-sites.
Scope (special categories, Art. 9 GDPR)
Kruxmind derives psychomotor and cognitive performance metrics from solve data (times, phases, execution events). It does not infer, assess, or store emotional states or health data. Any user-reported sensation is voluntary, visible, exportable, and deletable.
8. Your rights (GDPR)
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent (leaderboard) at any time. Write to info@kruxmind.com from your account email; we reply within one month, extendable by two further months where complexity or the number of requests requires (Art. 12(3) GDPR). To delete your account and all synced data, write with the subject "Delete account". You may lodge a complaint with the supervisory authority of your country of residence or with the Berliner Beauftragte für Datenschutz und Informationsfreiheit.
9. Retention
Account data is kept while the account exists. On deletion, synced data is removed from the active database within 30 days at most, subject to legal retention obligations.
10. Security and breaches
Reasonable technical and organizational measures (HTTPS/TLS, access control, salted password hash). In case of a breach posing a risk to your rights, we notify the competent authority within 72 hours and you where required (Art. 33/34 GDPR).
Security logs. To protect the service against unauthorized access and abuse, we record certain security events (for example, failed sign-in attempts). These logs include a truncated IP address — we never store the full address — and, where applicable, the email associated with the account. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We keep these logs for a maximum of 90 days; they are removed through a periodic purge process.
11. Minors
The core app (timer, algorithm library, trainers, statistics and history) can be used at any age and without an account: everything stays on the device and we collect no personal data. Performance features (analysis of your execution, self-assessments and performance-suite exercises) require age verification of 18 and run exclusively locally. Creating an account, syncing and joining the leaderboard require a minimum of 16 years under Art. 8 GDPR and German national law. In countries with different statutory ages, the local minimum age applies, plus your explicit consent. Pro plans are purchased via Google Play Billing, with Google acting as seller (Merchant of Record) in the EEA: we process no payment data. Purchase requires majority (18) or guardian authorization, confirmed via a mandatory checkbox before payment. In-app age verification relies on self-declaration; we collect no additional verification data. We do not knowingly process minors' data; if detected, we delete it without delay.
12. Changes
We reserve the right to modify this policy. In that case (e.g. future introduction of rewarded advertising) we publish the new version with its date and note it in the app where relevant.