Privacy Policy
Who we are
BasalMind is an AI-assisted software development platform. This policy covers basalmind.com and any associated subdomains. Questions: [email protected].
What data we collect and why
If you play Snake without signing in (anonymous play):
- Nothing. No identifiers are created, no localStorage is written, no cookies are set beyond the consent cookie.
If you sign in with Google:
- Your Google account ID (a stable unique identifier Google assigns you) — used to identify your account across sessions
- Your email address — used to contact you about your account and to fulfill data requests
- Your chosen gamer ID — a display name you pick after signing in; optional
- Gameplay data (scores, feedback you submit) — linked to your account
If you contact us or submit a consulting inquiry:
- Your name and email address — to respond to your message
- Notes from our conversations — to manage the consulting relationship. These are notes we write, not data you type into a form, and they are subject to the same deletion rights as any other personal data we hold.
We do not collect IP addresses for tracking, use fingerprinting scripts, store passwords, collect payment information, or use third-party analytics services.
How we use your data
Game data and feedback you submit are used to improve the BasalMind pipeline and Snake game — that is the explicit value exchange. Your submission says “build something from this.” We build from it.
Email addresses are used only to respond to your message, fulfill data requests, or send updates you explicitly opted into. We do not send marketing emails without a separate opt-in.
We use Anthropic’s API to process code and content. Submitted feedback may be included in API requests to Anthropic. Anthropic’s privacy policy applies to that processing.
Authentication
BasalMind uses Google Sign-In as the sole authentication method — we do not store passwords. When you sign in, Google shares your account ID and email with us. We do not receive your Google password or any other Google account data beyond what you explicitly authorize. Google’s privacy policy governs how Google handles your data on their end.
Anonymous play (no sign-in) is fully supported. Sign-in is only required to save your score across sessions, pick a gamer ID, or submit feedback.
Cookies and local storage
We use exactly one cookie — to remember that you accepted this notice. See the Cookie Policy for the full details.
We do not write anything to local storage during anonymous play. After sign-in, your session token is stored in local storage to keep you logged in. It is cleared when you sign out.
How long we keep your data
- Account data (email, gamer ID, gameplay records): retained until you request deletion
- Consulting notes: retained while the relationship is active, then deleted on request — except records we are legally required to keep (invoices, contracts: typically 6–10 years under tax law)
- Consent records: retained permanently as proof of compliance
- Deletion audit records: retained permanently to prove deletions happened
- Backups: purged within 30 days of a deletion request being executed
Who we share data with
We do not sell data. We do not share data with advertisers or data brokers. We do not use Google Analytics, Meta pixel, or any third-party analytics service.
The only third party that receives your data is Anthropic (via API), for the code and content processing described above.
Your rights (GDPR and CCPA)
You have the right to:
- Know what personal data we hold about you — we will send you a complete export
- Request deletion of your data — we execute it automatically, with a 7-day grace period to cancel
- Receive a signed deletion certificate proving what was deleted, what was anonymized, and what was legally retained — independently verifiable at /compliance
- Withdraw consent for analytics or marketing at any time from your account settings
- Data portability (your data in machine-readable format)
To exercise any of these rights, sign in and visit /data-rights. If you cannot sign in, email [email protected] and we will verify your identity before processing the request.
Security
Traffic is encrypted in transit (HTTPS via Cloudflare). We do not store passwords. Deletion certificates are cryptographically signed — you can verify them without trusting us. If you discover a security issue, email [email protected].
Changes to this policy
If we make material changes we will update the effective date above and, where possible, notify affected users by email before the change takes effect.