Privacy and personal data policy

1. Scope and controller

The data controller is ИП ДУБАНОВ РОДИОН ЮРЬЕВИЧ, registration details: ИНН 026615978091 · ОГРНИП 326784700324356, зарегистрирован 08.09.2026, address: 198334, Россия, г. Санкт-Петербург, ул. Партизана Германа, д. 33, литера А, кв. 258. Questions and requests may be sent to mindroomquiz.public@gmail.com.

Mindroom runs through Telegram. Telegram processes information under its own terms and privacy policy. Mindroom does not receive your Telegram password, login codes or payment-card details.

The primary database location is: Россия, дата-центр DataLine: г. Санкт-Петербург, территория ЦОД, ул. Жукова, д. 43, стр. 2.

2. Data we process

Telegram and account data

• Telegram user ID, display name, username when available and interface language;
• chat ID, title, language, time zone and game settings when the bot is added to a group;
• signed Telegram Mini App launch data needed to authenticate a session.

Gameplay and support data

• selected topics and modes, answers, correctness, response time, scores, rating, achievements, streaks, energy and match history;
• profile and chat settings, invitations, rooms and group-game results;
• ratings, labels, support messages and question reports. We do not analyze ordinary group conversation as content.

Technical and analytics data

• screen opens and completed game actions, session and launch identifiers;
• Mini App and Telegram versions, platform, device class, user agent, network state, page path, time and technical error details;
• IP address and standard request logs processed by the server or hosting provider for security and diagnostics.

Payment data

• Telegram user ID, product, Stars amount, date, status, entitlement period and auto-renewal flag;
• Telegram payment identifiers needed to deliver purchases, provide support and process refunds.

We do not receive or store card numbers or bank credentials. Telegram handles the Stars payment flow.

3. Purposes and legal bases

We use data to provide and secure the service, authenticate users, save settings and progress, run games and ratings, deliver purchases, answer support requests, prevent cheating and abuse, diagnose failures and improve the product.

Depending on the context and applicable law, processing is based on separate consent for the game profile, performance of the user agreement and steps requested before entering it to the extent necessary, the operator’s legitimate interests in operating and protecting the service, compliance with legal duties, and separate voluntary consent for additional interface analytics. You may withdraw consent without affecting processing already carried out lawfully.

Before the first game action, the bot or Mini App requests separate consent to data processing for the game. On the same screen, you may confirm voluntary consent to optional analytics: “Agree and continue” confirms both purposes, while “Continue without analytics” confirms only processing for the game. “Back” does not give consent. Analytics is off until you explicitly allow it and is not required to play. You can also allow analytics through a separate choice on the website or in Mini App settings. Basic game records, payment records and essential security or error diagnostics are processed on their respective independent grounds. We do not sell personal data or share it with advertising networks.

Consent and the analytics choice are linked to your Telegram user ID: an active choice is recognized in the bot, Mini App and groups without another request. Each group-game participant makes their own choice. Active game consent under version 2026-09-13.1 preserves access and does not include analytics; changing the choice screen alone does not require new confirmation. An earlier refusal, withdrawal or expiry of analytics consent does not cancel game consent.

The website analytics choice is stored against a random browser identifier separately from your Telegram account. Consent in the bot or Mini App does not enable website analytics, and a website choice does not enable analytics for your Telegram account.

4. Who may receive data

• Telegram, for message delivery, Mini App authentication and Telegram Stars operations;
• Beget, for the server and databases in Russia; its location confirmation identifies DataLine and the data-centre service provider JSC Severen-Telecom;
• Gcore, for delivery of web content and technical request information;
• Telegram, also for the support bot and sending requests to the operator; Gmail for email requests;
• public authorities only where a valid legal basis and required procedure exist.

Telegram, Gcore and Gmail use their own infrastructure. A primary database in Russia does not establish that all operations of these services occur in Russia. Contact the operator about specific recipients and processing operations.

5. Retention, local storage and security

• profile, settings and game history are kept while you use the service, until deletion, service closure or the end of another lawful purpose;
• feedback from the game bot or Mini App and additional product events are removed from the working database with the profile through /delete_me; separate support-bot conversations, exports sent to the operator and group-game results require a separate request;
• payment ledger records may remain after profile deletion for refunds, abuse prevention and mandatory tax or accounting retention;
• backups and technical logs are removed under infrastructure retention cycles when no longer needed for recovery, security or legal compliance.

The website stores a necessary mindroom_privacy cookie with a random identifier for up to 365 days to remember the analytics choice. Additional analytics is off until consent. After consent, sessionStorage also holds a visit identifier. Mini App uses localStorage for interface preferences. None of these values grants consent to other purposes.

Additional analytics includes screen views, actions, technical parameters and referral information, linked to a Telegram ID in the Mini App and bot. Consent ends on withdrawal, a version change or after 365 days. Withdraw through Analytics settings on the website or Profile → Settings → Data and consent in Mini App. Withdrawal stops new events and deletes related events from the working database. See the separate consent.

Copies are also kept on the operator’s computer in Saint Petersburg without cloud synchronization. Working-database deletion does not immediately remove backups or Telegram messages; those require a separate deletion and restoration-control procedure.

Consent evidence is stored separately: user or browser identifier, choice, version, language and time. It is used to demonstrate the processing basis and handle disputes, not for analytics.

We use access controls, signed Telegram initialization data, transport security, backups, monitoring and data minimization. No online service can promise absolute security; confirmed incidents are handled and reported where the law requires it.

6. Your rights

Subject to applicable law, you may request access, a copy, correction, deletion, restriction, objection, withdrawal of consent and information about processing. You may also complain to a competent supervisory authority.

Use /delete_me for the standard personalized-data deletion flow or contact mindroomquiz.public@gmail.com. We may ask you to confirm control of the relevant Telegram account. Some records may be retained where the law or a valid legal claim requires it.

7. Children, changes and contact

Mindroom is not designed to knowingly collect information from children below the age at which they may independently consent under applicable law. A parent or guardian who believes a child’s data is being processed may contact us.

We may update this policy as the service or legal requirements change. The current version and its date are published on this page. Material changes will be communicated through an available channel when required.

Privacy contact: mindroomquiz.public@gmail.com. General support is available on the support page.