Privacy Policy
Last updated: 2026-11-08
CogDojo Privacy Policy
This policy explains how Kean de Jager ("CogDojo", "we", "us"), with an address at 52 Guinifowl Street, Silver Lakes, Pretoria, 0053, South Africa, processes personal information when you use the CogDojo Android app, the website cogdojo.com, and related services (the "Service").
We are the responsible party under the Protection of Personal Information Act 4 of 2013 (POPIA) and the controller under the EU/UK General Data Protection Regulation (GDPR).
Information Officer: Kean de Jager, [email protected], +27 73 768 4484. Our Information Officer is registered with the Information Regulator: [PLACEHOLDER: registration number].
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account | name, email, username, hashed password, age or age bracket, terms version accepted | you |
| Training data | games played, scores, levels, reaction times, streaks, Brain Fitness Index, achievements | generated by your use |
| Profile and preferences | your answers to the short setup survey (how long and when you like to play, the skills you want to sharpen, starting difficulty), your chosen app style, in-game coins and characters, and your profile picture if you choose one: a character, or a photo you pick from your gallery (we store a small thumbnail, never your other photos) | you |
| Social | friends, family-group membership, leaderboard display name | you and other users who invite you |
| Purchases | plan, status, renewal dates, and a purchase token or order ID. We never receive your full card number. Payments are processed by Google Play | payment providers |
| Device and technical | device model, OS version, app version, IP address, session and refresh-token records (to show your signed-in devices), crash logs | automatically |
| Advertising (free plan) | advertising ID, coarse location derived from IP, and ad interactions, processed by Google AdMob (Google Ireland Limited / Google LLC) | automatically, subject to your choices |
| Analytics (website) | pages visited and referrer, only if you accept analytics cookies | automatically |
| Memory Spark comparisons | random first-attempt identifier, game version, longest completed sequence and timing; no account or age required | generated when you play |
| Support | messages you send us | you |
Memory Spark uses browser storage to count one first attempt per browser for its shared game comparisons. Replays do not replace that result. Active and unfinished first attempts are included; aggregate percentages are shown from the first recorded attempt. The attempt record is kept to maintain these comparisons and prevent repeat counting. Blocking browser storage leaves the game playable without contributing a result. This game feature is separate from optional website analytics.
CogDojo accounts are available to people aged 13 or older. We do not knowingly allow children under 13 to create accounts. In South Africa a child is anyone under 18. Processing a child's information requires a competent person's consent (POPIA s35), so users under 18 must have a parent's or guardian's permission.
2. Why we use it, and the legal basis
| Purpose | POPIA justification (s11) / GDPR basis (Art. 6) |
|---|---|
| Create and run your account, sync progress, coins, characters, preferences and your profile picture between devices, and provide the games | necessary for the contract |
| Personalise difficulty and show age-group comparisons | contract / legitimate interest |
| Process subscriptions, verify purchases and prevent fraud | contract, legal obligation |
| Security: rate limiting, session management and abuse detection | legitimate interest |
| Show ads on the free plan (personalised only where you consent) | consent / legitimate interest |
| Website analytics | consent |
| Service emails (verification, password reset, receipts, policy changes) | contract |
| Marketing emails | consent, with an unsubscribe link in every email |
| Comply with tax, accounting and legal requests | legal obligation |
We do not sell your personal information. We do not use your training data to make decisions that produce legal or similarly significant effects about you.
3. Who we share it with
We share information only with operators (processors) bound by written agreements:
- hosting and database: Hetzner Online GmbH, Falkenstein, Germany
- email delivery: our own mail server, hosted with Hetzner Online GmbH in Germany
- payments: Google Play
- advertising: Google AdMob (free plan, in the Android app only)
We also share information with authorities where the law requires it. Friends and family members you connect with can see your display name, scores and streaks as described in the app.
4. International transfers
Our servers and some providers are outside South Africa (for example in the EU or US). We transfer information only where POPIA s72 allows, for example where the recipient is subject to laws or binding agreements that give substantially similar protection, or with your consent. For EU/UK users, we rely on adequacy decisions or Standard Contractual Clauses.
5. How long we keep it
- Account and training data: while your account is active. We delete it within 30 days after you delete your account (see the Account Deletion page), except as listed below.
- Purchase and invoice records: kept for 5 years to meet South African tax law (Tax Administration Act).
- Security logs and session records: up to 90 days.
- Backups: deleted data leaves encrypted backups within 14 days.
6. Security
We use encryption in transit (HTTPS), hashed passwords (bcrypt), httpOnly session cookies with CSRF protection, access controls and backups. If a security compromise affects your information, we will notify you and the Information Regulator as POPIA s22 requires. Under GDPR we will notify the relevant supervisory authority within 72 hours where required.
7. Your rights
You can do the following:
- access your information. The Export data button on your Account page downloads a copy.
- correct it
- delete it: use Delete account in the app or on the website, or email us
- object to processing and withdraw consent at any time. This does not affect processing that took place earlier.
- object to direct marketing
- for GDPR: data portability and restriction of processing
If you are unhappy, you can complain to the Information Regulator (South Africa) at https://inforegulator.org.za (complaints: [email protected]), or to your local EU/UK data protection authority.
We respond to requests within 30 days. We may need to verify your identity first.
8. Cookies
See our Cookie Policy. Essential cookies (sign-in and security) are always on. Analytics cookies are used only if you accept them.
9. Changes
If we make material changes, we will notify you in the app or by email before they take effect. The "last updated" date shows the current version.
10. Contact
Kean de Jager, 52 Guinifowl Street, Silver Lakes, Pretoria, 0053, South Africa, [email protected].