Last updated: August 8, 2026
Welcome to Neurree. Your privacy matters to us. This Privacy Policy explains how the app publisher (the “Publisher”, "we", "us", or "our") collects, uses, stores, shares, and protects personal data when you use our mobile (iOS and Android) application Neurree (the “App”) and the Web Page (Neurree.com), and how you can exercise your rights under applicable data protection laws.
This policy applies only to personal data collected through the Web Page and the App and the services it provides.
This document explains the type, purpose and scope of data collection in connection with the use of our products.
The following notes provide a simple overview of what happens to your personal data when you visit or use our App. Personal data are all data with which you can be personally identified. For detailed information on data protection, please refer to our privacy policy listed below this text.
We would like to point out that data transmission over the Internet may have security gaps. It is not possible to completely protect data from access by third parties.
Data controller: Erik Shikhverdiev, Individual publisher of Neurree
Contact: support@neurree.com (please use subject: "Privacy Inquiry")
Address: 120 Bayview Ave, Toronto, ON M5A 0J1, Canada
Data protection contact
Email: support@neurree.com
The GDPR grants data subjects whose personal data are processed by us certain rights about which we would like to inform you at this point:
Many data processing operations are only possible with your consent. We will expressly obtain this from you before we start processing the data. You can revoke this consent at any time. For this purpose, an informal notification by email to us is sufficient. The legality of the data processing operations carried out up to the point of revocation remains unaffected by the revocation.
If the data processing is carried out on the basis of Article 6 (1) (E) or (F) GDPR, you have the right at any time to object, for reasons arising from your particular situation, to the processing of personal data concerning you, which also applies to profiling based on these provisions.
The respective legal basis on which processing is based can be found in this privacy policy.
If you object, we will no longer process the personal data concerned unless we can prove that there are valid reasons for processing worthy of protection which outweigh your interests, rights and freedoms or which serve the processing of the assertion, exercise or defence of legal claims.
If your personal data are processed for the purpose of direct marketing, you have the right to object, at any time, to the processing of your personal data for the purpose of such marketing, including profiling, insofar as it is connected with such direct marketing. If you object, your personal data will no longer be used for the purpose of direct marketing.
In the event of violations of the GDPR, those affected have a right of appeal to a supervisory authority. This right of appeal is without prejudice to other administrative or judicial remedies.
You have the right to receive information free of charge at any time about your stored personal data, its origin and recipients and the purpose of data processing, as well as the right to correct or delete this data. You can contact us at any time by email for this purpose and for further questions on the subject of personal data.
You have the right to request that the processing of your personal data be restricted. For this purpose, you can contact us at any time by email. The right to limit processing exists in the following cases:
If you dispute the accuracy of your personal data stored with us, we usually need time to verify this. For the duration of the review, you have the right to demand the restriction of the processing of your personal data.
If the processing of your personal data was/is unlawful, you can demand the restriction of data processing instead of deletion.
If we no longer need your personal data, but you need it for the exercise, defence or assertion of legal claims, you have the right to demand the restriction of the processing of your personal data instead of deletion.
If you have lodged an objection in accordance with Article 21 (1) GDPR, a balance must be struck between your interests and ours. As long as it is not yet clear whose interests prevail, you have the right to demand the restriction of the processing of your personal data.
If you have restricted the processing of your personal data, this data - apart from its storage - may only be processed with your consent or for the assertion, exercise or defence of legal claims or for the protection of the rights of another natural or legal person or for reasons of an important public interest of the European Union or a member state.
You have the right to have data, which we process automatically on the basis of your consent or in fulfillment of a contract, handed over to you or to a third party in a common, machine-readable format. If you request the direct transfer of the data to another responsible party, this will only be done to the extent technically feasible.
Subject to deviating or more specific information within this privacy policy, the personal data collected by this App will be stored until you request us to delete it, revoke your consent for storage or the purpose for which the data was stored ceases to apply. If there is a legal obligation to store the data or any other legally recognized reason for storing the data (e.g. legitimate interest), the personal data concerned will not be deleted until the respective reason for storage no longer applies.
The processing of personal data is only permitted if there is an effective legal basis for the processing of such data. If we process your data, this is regularly done on the basis of your consent in accordance with Article 6 (1) (a) General Data Protection Regulation (GDPR) (e.g. when you voluntarily provide your data in the registration form or in the contact form), for the purpose of fulfilling the contract in accordance with Article 6 (1) (b) GDPR (e.g. when using In-APP purchases or the use of other chargeable functions of the PRODUCT) or on the basis of legitimate interests according to Article 6 (1) (f) GDPR, which are always weighed against your interests. The relevant legal basis will be specified in a separate place in this privacy policy.
This PRODUCT uses SSL or TLS encryption for reasons of security and to protect the transmission of confidential content, such as the requests you send to us as the operator. This encryption prevents the data you transmit from being read by unauthorized third parties.
On the WEB: You can recognize an encrypted connection by the fact that the address line of your browser changes from "http://" to "https://" and by the lock symbol in your browser line.
We reserve the right to change these data protection regulations at any time in compliance with legal requirements.
In order to provide our services via the APP, we require the access rights listed below, which enable us to access certain functions of your device.
Access to the device functions is required to ensure the functionality of the APP. The legal basis for this data processing is our legitimate interest within the meaning of Article 6 (1) (f) GDPR, your consent within the meaning of Article 6 (1) (a) GDPR and/or - if a contract has been concluded - the fulfillment of our contractual obligations (Article 6 (1) (b) GDPR).
The data collected in this way will be stored until the User submits a request for its deletion, as provided in 13.3 of the Policy.
Purpose of processing: to provide the App’s features, secure and maintain your account, communicate about your account and updates, and comply with legal obligations.
If you do not provide the required account information we cannot create an account or provide the core service.
General
When you use our PRODUCT, we collect the following personal data from you, depending on availability:
The processing of this personal data is necessary to guarantee the functionalities of the PRODUCT. The legal basis for this data processing is our legitimate interest within the meaning of Article 6 (1) (f) GDPR, your consent within the meaning of Article 6 (1) (a) GDPR and/or - if a contract has been concluded - the fulfillment of our contractual obligations (Article 6 (1) (b) GDPR).
We do not collect or process special category (sensitive) data such as health information, racial or ethnic origin, political opinions, religious beliefs, or biometric data. Game scores and in-game performance are used only for the App’s features (e.g. your progress and the leaderboard) and are not used to draw health-related conclusions.
The provider of the pages automatically collects and stores information in so-called server log files, which your browser or the PRODUCT automatically sends to us. These are:
This data is not merged with other data sources.
The collection of these data is based on Article 6 (1) (f) GDPR. The operator has a legitimate interest in the technically error-free display and optimization of his application - for this purpose the server log files must be recorded.
You need to register in the PRODUCT to use its core features. We will use the data entered for this purpose only for the purpose of using the respective offer or service for which you have registered. The mandatory data requested during registration must be provided in full. Otherwise, we will refuse the registration.
In the event of important changes, for example in the scope of the offer or technically necessary changes, we will use the email address provided during registration to inform you in this way.
The data entered during registration is processed for the purpose of implementing the user relationship established by the registration and, if applicable, for the initiation of further contracts (Article 6 (1) (b) GDPR).
Retention of the data entered during registration is stored in line with Section 11 of the Policy. Legal retention periods remain unaffected.
Instead of a direct registration you can register with your Google Account.
The provider of this service is Google Ireland Limited ("Google"), Gordon House, Barrow Street, Dublin 4, Ireland. However, according to Google, the data collected is also transferred to the USA and other third countries.
If you choose to register with your Google Account and click on the button, you will be automatically redirected to the Google platform. There you can log in with your usage data. This will link your Google Account with this PRODUCT or our services. This link gives us access to your data stored at Google. This is above all:
Email address
This data is used to set up, provision and personalize your account.
The registration with your Google Account and the associated data processing procedures are based on your consent (Article 6 (1) (a) GDPR). You can revoke this consent at any time with effect for the future.
You can find further information in the Google Terms of Use and the Google Privacy Policy. These can be found under:
https://policies.google.com/privacy and https://policies.google.com/terms
On iOS devices you can also register and sign in using Sign in with Apple. The provider of this service is Apple Inc., One Apple Park Way, Cupertino, CA 95014, USA (for users in the EEA: Apple Distribution International Ltd., Hollyhill Industrial Estate, Cork, Ireland).
If you choose Sign in with Apple, Apple provides us with an identity token and, depending on your choice, your name and either your real email address or a private relay email address generated by Apple. We use this data solely to create, provision and authenticate your account. We do not receive your Apple ID password.
The registration with Sign in with Apple and the associated data processing procedures are based on your consent (Article 6 (1) (a) GDPR) and on the fulfillment of the user contract (Article 6 (1) (b) GDPR). You can revoke the link at any time in your Apple ID settings with effect for the future.
Further information can be found in Apple’s privacy policy: https://www.apple.com/legal/privacy/
The App includes a leaderboard feature. Your display name, avatar and total game score are visible to other users of the App on the leaderboard. Your email address and any other account data are never shown to other users. The legal basis for this processing is the fulfillment of the user contract (Article 6 (1) (b) GDPR), as the leaderboard is a core feature of the App. If you do not wish your display name to appear on the leaderboard, you can choose a pseudonym as your display name, or contact us at support@neurree.com.
If you contact us (e.g. via contact form within the PRODUCT, by email, telephone or fax), your inquiry including all personal data resulting from it (e.g. name, inquiry) will be stored and processed by us for the purpose of processing your request. This data is processed on the basis of Article 6 (1) (b) GDPR, provided that your inquiry is related to the fulfilment of a contract or is necessary for the implementation of pre-contractual measures. In all other cases the processing is based on your consent (Article 6 (1) (a) GDPR) and/or on our legitimate interests (Article 6 (1) (f) GDPR), as we have a legitimate interest in the effective processing of the inquiries addressed to us. The data sent to us by you via contact request will remain with us until you request us to delete it, revoke your consent for storage or the purpose for which the data was stored no longer applies (e.g. after your request has been processed). Mandatory legal provisions - in particular legal retention periods - remain unaffected. We will not pass on your data without your consent.
To detect, diagnose and fix errors and crashes in the App, we use Sentry, a service provided by Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA.
When an error or crash occurs, the following data may be transmitted to and processed by Sentry:
We do not send your name, email address, password or security answers to Sentry. Crash data is used exclusively to ensure the technical stability and improvement of the App and is automatically deleted by Sentry after a limited retention period (by default 90 days).
The legal basis for this processing is our legitimate interest in the technically error-free operation of the App (Article 6 (1) (f) GDPR). Data may be transferred to the USA; Sentry relies on Standard Contractual Clauses and participates in the EU-U.S. Data Privacy Framework. Further information: https://sentry.io/privacy/
If you switch on training reminders in the App’s settings, the App schedules notifications locally on your device at the time you choose. We do not operate a push-notification service for these reminders: no push token is created, no device identifier is sent to us, and no notification data leaves your device. Your reminder preference (on/off and the chosen hour) is stored only in the App’s local storage on your device.
The legal basis is your consent (Article 6 (1) (a) GDPR), given when you enable the feature and grant the operating-system notification permission. You can withdraw it at any time by turning reminders off in the App or revoking notification permission in your device settings.
To show you your own progress over time, we record one entry per completed game session containing the game played, the score and experience points earned, and the time of the session. This data is stored with your account and is used solely to display your progress inside the App (for example, your daily activity chart and per-game levels). It is not shared with other users or third parties, and it is deleted when you delete your account.
The legal basis is the performance of the user contract (Article 6 (1) (b) GDPR), as tracking and displaying your training progress is a core function of the App.
When you first create an account, the App asks you to complete a short skill assessment made up of four in-app exercises (a memory task, a reaction task, a sequence-reasoning task and a vocabulary task). We store the four resulting scores (each expressed as a value from 0 to 100) together with the starting level derived from them.
These scores are used only inside the App: to set the initial difficulty of each game, to choose which games your daily workout suggests, and to display your own profile back to you on the Progress screen. They are not shared with other users or third parties.
The legal basis is the performance of the user contract (Article 6 (1) (b) GDPR), as the assessment determines the difficulty at which the App’s games are delivered to you.
These results are a game-difficulty setting, not a medical or psychological assessment. They are not a diagnosis, are not health data, and must not be used or interpreted as an evaluation of your cognitive health.
If you access our PRODUCT, your usage may be statistically evaluated in aggregated form to improve our offers and fix problems in the user experience. We do not use advertising or cross-app tracking technologies, and we do not use your device’s advertising identifier. When using external service providers (contract processors), we ensure through appropriate contracts with the service providers that the data processing complies with European data protection standards.
When you create an account with an email address and password, we send a six-digit code to that address and ask you to enter it in the App. This confirms that the address is real and reachable, so that we can contact you about your account and so that account recovery works.
For this we store, in addition to the email address we already hold: an encrypted (hashed) copy of the code, the address it was sent to, the time the code expires, the number of times it has been sent, and the number of incorrect attempts. The code itself is never stored in readable form. The record is deleted as soon as the code is used, and in any case is only valid for 30 minutes. We also store the date and time your address was confirmed.
The legal bases are the performance of the user contract (Article 6 (1) (b) GDPR), as a working address is needed to operate and recover your account, and our legitimate interest in the security of the App and its users (Article 6 (1) (f) GDPR), as verification prevents accounts being created against addresses that do not belong to the person registering.
If you sign in with your Google Account or with Sign in with Apple, no verification code is sent: those providers only release an address they have already verified themselves.
Accounts created before this feature was introduced are not asked to verify.
Where the GDPR applies, we rely on the following legal bases to process your personal data:
Under Canadian law, we process personal data with your knowledge and consent, except where otherwise permitted or required by law.
We use personal data for the following purposes:
To provide the App we use third-party processors that host, maintain, or help operate our service. These processors act on our instructions and are bound by contract to protect your personal data.
Key processors:
Notes on processors and transfers:
We will not sell your personal data. We may disclose personal data to:
While our main infrastructure for the App is hosted within the European Union, some subprocessors or backup locations may be outside the EEA or Canada. When personal data is transferred internationally, we will protect it using legal mechanisms such as:
We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including to:
If you delete your account (see Section 13.3), we will delete or anonymize your personal data as required by applicable law, subject to any legal exceptions.
We implement industry-standard technical and organizational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure or access, including:
Important: no system can be 100% secure. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected data subjects in accordance with GDPR timelines (generally within 72 hours to the authority, and without undue delay to affected individuals when required).
13.1. If you are located in the EU/EEA, you have the following rights regarding your personal data (subject to legal limits):
13.2. Under Canadian privacy law, you also have the right to:
13.3. How to exercise your rights / account deletion: You can delete your account and all associated data directly in the App: open Settings → Danger Zone → Delete Account. Deletion is immediate and permanent. Alternatively, contact us at support@neurree.com with the subject line "Data Subject Request" and indicate the request type (e.g., access, deletion). We will verify your identity before fulfilling a request and respond within one month in accordance with GDPR or within a reasonable time under Canadian law.
13.4. If you believe we have violated your rights, you may lodge a complaint with your local data protection authority (for example, the supervisory authority in the EU member state where you live, or the Office of the Privacy Commissioner of Canada).
The App is not intended for children under the age of 18. We do not knowingly collect personal data from children under this age. If you are a parent or guardian and believe we have collected personal data about a child under 18, please contact us at support@neurree.com and we will delete the information where required by law.
August 8, 2026 (2): we now publish the full list of our processors at neurree.com/legal/Subprocessors.html and keep it current there, and this section now states plainly which changes we will email you about and which we will simply publish. Neither affects what we collect or why.
August 8, 2026: new accounts registered with an email address and password are now asked to confirm that address with a code we email to it. Section 5.14 describes what this stores and why. We have also named Microsoft (Microsoft 365 / Microsoft Graph) in Section 8 as the processor that delivers our account emails. No new category of personal data is collected: the email address was already required to register, and confirming it is part of operating and securing your account.
August 7, 2026: our database moved from Neon (Neon SaaS Postgres) to Heroku Postgres. Both are hosted in the European Union; no data left the EEA as part of this change, and the categories of data we store are unchanged. Neon is no longer a processor for Neurree.
We may update this Privacy Policy to reflect changes to our practices, services, legal requirements, or for operational reasons. We will always publish the revised policy in the App and on our website and update the “Last updated” date.
How we tell you about a change. What we do beyond publishing depends on how much the change affects you:
We draw this line so that a change which genuinely affects you reaches you, instead of being lost among routine housekeeping. Every change is recorded in the list above, whether or not it was material.
For privacy-related questions, data subject requests, or complaints, please email: support@neurree.com
If you prefer, you can write to us at:
120 Bayview Ave, Toronto, ON M5A 0J1, Canada