Privacy Policy

Busted Minds Account provides sign-in, account recovery, and identity federation for Busted Minds services, including BM Chess, BM Search, BM AI, Minds Feed, and BM City. Each connected service may have an additional privacy policy covering its own content and activity data.

• Account information: email address, username, display name, avatar, account identifiers, authentication methods, confirmation status, and security-related timestamps.
• Authentication information: session identifiers, provider identifiers, login events, recovery events, and technical information needed to prevent abuse and keep sessions secure.
• Support information: messages and contact information you provide when requesting help or exercising a privacy right.

When you choose Google, we request only the OpenID identifier, email address, name, and basic profile image needed to create or access your Busted Minds Account. We do not request access to Google Drive, Contacts, Calendar, Gmail, or other unrelated Google services.

Google authentication is handled by the central Busted Minds Account service. Connected apps receive only the approved Busted Minds identity claims needed to establish their own session; they do not receive your Google password or Google access token.

• Create, authenticate, recover, secure, and administer your Busted Minds Account.
• Keep one consistent identity across connected experiences you approve.
• Provide verified identity claims such as account ID, email, and basic profile information to a connected Busted Minds service after authorization.
• Detect abuse, investigate security events, enforce service rules, and comply with legal obligations.
• Respond to support and privacy requests and improve account reliability.

BM Chess, BM AI, Minds Feed, and BM City use the same central identity but maintain separate application data. BM Search uses the BM AI account session for signed-in AI search. Chess, Search, AI, Feed, and City activity are not automatically combined into one activity profile.

During authorization, the Accounts service shows the connected service and requested permissions. You may decline instead of continuing.

We use Supabase for authentication and account storage, Vercel for application hosting, Resend for authentication email delivery, and Google when you choose Google sign-in. These providers process information as necessary to deliver their services under their respective terms and data-protection commitments.

We do not sell personal information or Google user data, and we do not use central account information for third-party behavioral advertising. We may disclose limited information when required by law, to protect users or the service, during a business reorganization with appropriate safeguards, or at your direction.

We retain central account information while your account is active. When you delete the account, we remove its email, authentication methods, sessions, username, display name, avatar, and account identifiers from live systems. Connected Busted Minds services registered with the deletion service are notified before the shared sign-in is removed.

A minimal deletion receipt containing the request date, outcome, and categories retained—but no email, username, or account ID—is kept for 24 months. Security audit events may remain for up to 180 days after identifiers and free-form metadata are removed. Unresolved safety reports may remain until resolution and are deleted 90 days afterward. Anonymized shared game records may remain for other players. Backup copies age out through provider retention cycles and are not used to recreate a deleted account.

We use encrypted transport, restricted database policies, protected secrets, authorization checks, rate limits, and secure session cookies. No online service can guarantee absolute security.

You may use email and password instead of Google where available, sign out, update eligible account details, or request access, correction, deletion, restriction, portability, or objection where applicable law provides those rights. Removing a connected sign-in method may require another verified method so you do not lose access.

You can permanently delete the account through the account deletion page. If you cannot sign in, email support@bustedminds.org. We may need to verify your identity without asking for your password.

The service is not directed to children under 13, or a higher minimum age required by local law without appropriate guardian authorization. Providers may process information in countries other than your own using their available legal safeguards.

We may update this policy as Busted Minds Account evolves. Material changes will receive an updated effective date and, where appropriate, additional notice. See the Terms of Service for the rules governing account use.