Privacy Policy
Cortex Culture app — last updated: 13 October 2026
Cortex Culture is a learning app: series of short articles to read, and general-knowledge games. This page explains what the app records, why, for how long, and how you stay in control of it.
1. Who is responsible
The data controller is Yanis DENIZOT, who publishes the app as an individual (see the legal notice).
For any question, or to exercise your rights: contact@cortexculture.app
Cortex Culture has not appointed a Data Protection Officer. For any question about your data, write to us directly at the address above.
2. What we record
| Category | What it is | Why |
|---|---|---|
| Account | Email address, username, friend code; first and last name if you choose to add them | To identify you and restore your progress on another device |
| Progress | Series read, answers given, experience points, daily streak, hearts, training journeys, series saved for later and series you like | To make learning work: resume where you stopped, avoid re-asking what you know, show your rankings |
| Connections | Your friends in the app, and requests sent or received | To show your friends' feed and rankings among friends |
| Activity shared with friends | Finished series, new levels, streaks of 30, 100 and 365 days, challenge rankings (top 1%, 5% or 10%), series you like, and the likes given and received on these achievements | To show these achievements in your friends' feed |
| Moderation | Players you have blocked, and usernames you have reported (with the username as it was when reported) | To protect you from unwanted players, and to handle reports |
| Audience measurement | Screens opened and actions taken in the app, tied to a visit number and not to your account (see point 3) | To understand what is used or abandoned, and improve the app |
| Technical and security | Platform (iOS, Android), app version, language, time zone. And, processed automatically by our infrastructure: IP address, browser or device identifier (“user-agent”), date and time of requests, error logs (the address called and the error message) | To serve the right content, limit abuse, and diagnose failures |
About the IP address. We do not store it in our database. It is used in passing, in memory, to limit how many requests are made and to prevent abuse. It does, however, travel through our technical providers (point 4), who keep it in their own logs for their own periods.
Reminders
If you allow them in your phone's prompt, Cortex shows at most two reminders a day, around 11 am and 6:30 pm in your phone's time: today's challenges, or what is left to finish your day. These reminders are scheduled by the app, on your phone: our servers send nothing and receive no notification identifier. Their text is built from your progress, which the app already knows. After seven days without opening Cortex, no further reminder is scheduled.
You can turn them off at any time: Me → Settings → Reminders, or in your phone's settings. Audience measurement (point 3) only records whether reminders are on, whether the page offering them was shown and what was chosen there, and whether a reminder was opened, with the phone's time.
What we do not record
- No location data
- No access to your contacts, photos, microphone or camera
- No advertising identifier, no advertising tracker
- No free text in usage measurements
- No tracking across apps or websites: nothing is combined with your activity elsewhere
3. Legal basis, data by data
| Data | Legal basis | What that means |
|---|---|---|
| Account, progress | Performance of the service | Without this data the app cannot do what it promises |
| Connections (friends, requests) | Performance of the service | You create them yourself by adding someone; removing them erases them |
| Shared activity, likes | Performance of the service | The friends' feed is a feature of the app; sharing can be switched off in the settings |
| First and last name | Consent | You add them only if you want to; deleting them withdraws that consent |
| Blocks and reports | Legitimate interest — player safety | Protecting players from an offensive username, and being able to correct it |
| Technical and security (IP, logs) | Legitimate interest — keeping the service safe and working | Preventing abuse and fixing failures; without logs, a failure stays invisible |
| Audience measurement | Legitimate interest — understanding use | Improving the app; you can switch it off (see below) |
What your friends see
Your friends are the players whose request you accepted, or who accepted yours. They see:
- your username, your level, and your first and last name if you added them;
- your profile: finished series, training journeys, challenge podiums;
- in their feed, when "Share my achievements" is on: your finished series, new levels, streaks of 30, 100 and 365 days, and challenge rankings (top 1%, 5% or 10%), published the day after the challenge;
- in their feed, when "Show my likes" is on: the series you like;
- how many likes an achievement received, and whether you gave one.
Other players see only your username and level (in search and friend requests) and, in public challenge rankings, your username and score. Your first and last name are never shown to them.
Shown to no one: your email address, your answers, the cards you are reading, the series you saved for later, and whether you are using the app.
Both settings are in Me → Settings → What my friends see, and are on by default. Switching one off immediately removes from their feed what had already been shared. Removing a friend or blocking a player ends what they see straight away.
Audience measurement, and the visit number
To connect the steps of a single visit, the app draws a visit number at random each time it opens, renewed after thirty minutes of inactivity.
These measurements contain neither your account identifier, nor your email address, nor your username, and are not used to recognise you from one visit to the next. The visit number remains personal data, and is treated as such throughout this document.
The measurement is also designed to stay limited to the strict minimum, in the spirit of what the French data protection authority (CNIL) expects of audience measurement:
- it serves only to measure use of the app, for us alone;
- no third-party tool or service receives it;
- nothing is tied to an account, and nothing is combined with another app or website;
- it is kept for 13 months at most.
You can switch it off at any time: Me → Settings → Usage statistics → Off. Once off, the app records nothing further and clears anything still waiting to be sent.
No automated decisions
No decision about you is made by a machine alone. A filter refuses a username, first name or last name when you type it — you simply pick another one, straight away. Any other moderation measure (renaming a username, handling a report) is decided by a person, and you can contest it by writing to us.
4. Who else has access
No one receives your data for commercial or advertising purposes. Five technical providers host or process it on our behalf, solely to run the app:
| Provider | Role | Where |
|---|---|---|
| Railway Corporation | Server and database hosting | Our environment is deployed in the Amsterdam (European Union) region. Railway and its own sub-processors may, however, process some technical data outside the European Economic Area, under the safeguards set out in its data processing agreement. |
| Cloudflare, Inc. | Image storage and delivery | Storage configured in Western Europe. Some technical processing, in particular Cloudflare's logs, may take place outside the European Union. The images served are public and contain no personal data. |
| Google (Firebase Authentication) | Sign-in credentials | United States. Processes your email address and password, as well as the IP address and user-agent of your sign-ins. |
| Google (Sign in with Google) | Signing in with a Google account, if you choose to | United States. Google authenticates you and passes us your email address and, where available, your first and last name. Google then knows that you are signing in to Cortex. |
| Apple (Sign in with Apple) | Signing in with an Apple account, if you choose to | United States. Apple authenticates you and passes us your email address — your own, or a relay address if you choose to hide it — and, where available, your first and last name. |
Using these providers means data is transferred outside the European Union, under the European Commission's Standard Contractual Clauses as set out in their data processing agreements.
5. How long we keep it
- Usage measurements: 13 months at most, then automatically deleted — a period we have deliberately limited.
- Account, progress, connections, shared activity, likes: for as long as your account exists. A series you stop liking disappears from your friends' feed; a deleted first or last name is no longer kept.
- Blocks: for as long as you keep them — removing one erases it.
- Reports: erased with the account of whoever reported or was reported, and at the latest 12 months after they are handled.
- Server technical logs: 7 days at our host. Our other providers follow their own periods.
- Backups: the database is copied every night to private storage, and those copies exist only to recover from a failure. A daily copy is kept for 14 days, a weekly copy for 60 days, and a monthly copy for one year.
6. Deleting your account
From the app: Me → Settings → Delete my account. Without the app, the procedure is described on the Delete my account page.
Deletion starts immediately and cannot be undone. Your active data — profile, progress, connections, shared activity, likes, blocks and reports — is erased from our database, and your sign-in credentials are deleted at Firebase. Your progress cannot be restored.
Two traces remain temporarily and disappear on their own: the backups until they expire (point 5), and our providers' technical logs for their own periods. They exist only to recover from a failure; nobody reads them otherwise.
Usage measurements are tied to no account: there is nothing there to attach to you, and nothing to erase. They expire after thirteen months.
7. Your rights
You have the right to access, correct, erase, port, restrict and object to the processing of your data. Write to contact@cortexculture.app; we answer within one month.
If our answer does not satisfy you, you may lodge a complaint with the CNIL, the French data protection authority, or with the supervisory authority of your country of residence.
8. Children
Creating a Cortex account is for people aged 15 and over. Reading the series and playing without an account remains open to everyone.
This age limit is a design choice, intended to limit the data collected about younger users. It is not the same thing as the age rating shown on the App Store, which describes the content of the app, not who may hold an account.
In France, where a processing operation relies on consent in an online service, a child under 15 cannot give that consent alone: the joint agreement of the child and of a parent or guardian is then required.
If you are a parent and believe your child created an account, write to us and we will delete it.
9. Changes
Any change to this document will be published at this address, with a new update date. A significant change will also be signalled inside the app.