Your data. Your choices.

This notice covers the XNBack website and iPhone app. The browser game works without an account. The app can save your progress and connect you with other players. For support or privacy requests, email help@xnback.com. Who runs XNBack is at the end of this notice.

Last updated: 26 October 2026.

The browser game

The game generates cues and calculates results in your browser. The website does not send your responses or scores to the XNBack backend. This website has no accounts, cloud history, analytics scripts, advertising scripts, or payment forms.

The game keeps its state in memory for this page only. It does not write results or preferences to cookies or local storage. Your browser may cache public files such as pages and letter sounds.

The iPhone app

With an account, XNBack stores your sign-in identity, profile, settings, and training records. Training records include rounds, responses, scores, N levels, and practice dates. Social records include friendships, group memberships, pokes, leaderboard entries, blocks, and reports. A poke records who reminded whom and when; we delete it after 7 days. You can also choose an avatar.

Sign in with Apple shares an account identifier and, when available, your name and email. Apple may provide a private relay email. We do not receive your Apple password. If you use email sign-in, we store a password hash, not your readable password.

Other players can see profile and game information through social features. In Settings, you can control username discovery, leaderboard visibility, and pokes from friends. Do not put private information in your username, avatar, or reports.

If you allow notifications, the app gives us a push token for your device. We keep it with your sign-in on that device and delete it when you sign out. We use it only to send pokes from your friends, through Apple's push notification service.

If you send feedback from Settings, we store your message with your account, the app version and build, and your iPhone's system version. The app tells you this before you send. Only we read feedback; other players never see it. We also email each message to our support inbox.

Game Center

If you are signed in to Game Center on your iPhone, the app sends Apple your scores and Badges. Scores are your highest N level and your best round results, and they are sent only after the XNBack server has accepted the round. Each Badge you earn becomes a Game Center achievement. This data goes from your iPhone to Apple. Apple's privacy policy and your Game Center settings decide what Apple does with it and who can see it.

If you choose Continue with Game Center, or link Game Center in Settings, we store your Game Center player ID with your account. We use it only to sign you in. We do not receive your Apple Account password or email from Game Center. The player ID is deleted with your account. To remove it sooner, email us.

To stop sending scores and Badges to Game Center, turn off Game Center in the app's Settings. You can also sign out of Game Center in your iPhone's Settings app.

Why we use this data

We use account and game data to provide the features you request. The legal basis is performance of our agreement with you. Without the necessary account data, we cannot provide saved progress or account-based features.

We use connection details, security records, reports, and support messages to protect and maintain the service and answer requests. We read feedback to fix problems and improve XNBack. This serves our legitimate interests in running a safe service and improving it. We do not sell your data or use it for targeted advertising.

Hosting and service providers

OVHcloud hosts the public website and production app server in Canada. A separate server in Finland holds records from earlier app versions and uses Cloudflare for network access.

Production avatars and encrypted backups use private Cloudflare R2 storage. Records and files from earlier app versions are also held on the separate server. Production account email and feedback emails use Resend. Mail sent to our support address passes through Cloudflare Email Routing to Gmail.

Hosts process connection data, such as IP addresses, browser headers, requested paths, and request times, to deliver and protect services. Providers may process data outside the European Economic Area, including Canada and the United States. Contact us for details about the providers and transfer safeguards that apply to your data.

Apple handles app distribution, Sign in with Apple, Game Center, and push notifications under its own privacy terms.

How long we keep data

We keep account and training records while your account is active. Account deletion removes the account, its progress, and its avatar from the active service. A small deletion record remains so that restoring a backup does not restore a deleted account.

Daily production backup snapshots expire after 28 days. The separate server keeps its seven most recent scheduled backups. Separate migration and earlier-service archives need a manual check when handling a deletion request. They are not covered by these snapshot limits.

We keep support messages and security records as needed to resolve a request, protect the service, or meet a legal duty. We assess that need based on the request or incident. We delete feedback from the app server 12 months after you send it, or sooner when you delete your account. The emailed copy is a support message.

Your choices and rights

In the iPhone app, open Settings and choose Delete account. Follow the confirmation steps. Deletion continues on the server after you leave the screen. If you cannot sign in, or need help with an earlier account, email help@xnback.com.

You can ask to access, correct, erase, or receive a copy of your personal data. You can also request restricted processing or object to processing based on legitimate interests. These rights have legal conditions. We may need to check your identity before acting.

You can complain to Finland’s Data Protection Ombudsman or your local data protection authority. Contacting us first is not required.

Earlier browser accounts

The new browser game has no sign-in. Replacing the website does not delete an earlier browser account or move it into the iPhone app. Contact us for access or deletion requests concerning that account.

Changes

We will update this notice when the service changes. We will bring important changes to your attention through the website or app.

Who runs XNBack?

Alex Botham, Finland, operates XNBack and is the controller of your personal data. Contact help@xnback.com for support or privacy requests.