Your data. Your choices.

This notice covers the XNBack website and iPhone app. The browser game works without an account. The app can save your progress and connect you with other players.

Last updated: 22 September 2026.

Who is responsible?

Alex Botham, Finland, operates XNBack and is the controller of your personal data. Contact help@xnback.com for support or privacy requests.

The browser game

The game generates cues and calculates results in your browser. The website does not send your responses or scores to the XNBack backend. This website has no accounts, cloud history, analytics scripts, advertising scripts, or payment forms.

The game keeps its state in memory for this page only. It does not write results or preferences to cookies or local storage. Your browser may cache public files such as pages and letter sounds.

The iPhone app

With an account, XNBack stores your sign-in identity, profile, settings, and training records. Training records include rounds, responses, scores, N levels, and practice dates. Social records include friendships, group memberships, leaderboard entries, blocks, and reports. You can also choose an avatar.

Sign in with Apple shares an account identifier and, when available, your name and email. Apple may provide a private relay email. We do not receive your Apple password. If you use email sign-in, we store a password hash, not your readable password.

Other players can see profile and game information through social features. In Settings, you can control username discovery and leaderboard visibility. Do not put private information in your username, avatar, or reports.

Why we use this data

We use account and game data to provide the features you request. The legal basis is performance of our agreement with you. Without the necessary account data, we cannot provide saved progress or account-based features.

We use connection details, security records, reports, and support messages to protect and maintain the service and answer requests. This serves our legitimate interests in running a safe service. We do not sell your data or use it for targeted advertising.

Hosting and service providers

OVHcloud hosts the public website and production app server in Canada. A separate server in Finland holds records from earlier app versions and uses Cloudflare for network access.

Production avatars and encrypted backups use private Cloudflare R2 storage. Records and files from earlier app versions are also held on the separate server. Production account email uses Resend. Mail sent to our support address passes through Cloudflare Email Routing to Gmail.

Hosts process connection data, such as IP addresses, browser headers, requested paths, and request times, to deliver and protect services. Providers may process data outside the European Economic Area, including Canada and the United States. Contact us for details about the providers and transfer safeguards that apply to your data.

Apple handles app distribution and Sign in with Apple under its own privacy terms.

How long we keep data

We keep account and training records while your account is active. Account deletion removes the account, its progress, and its avatar from the active service. A small deletion record remains so that restoring a backup does not restore a deleted account.

Daily production backup snapshots expire after 28 days. The separate server keeps its seven most recent scheduled backups. Separate migration and earlier-service archives need a manual check when handling a deletion request. They are not covered by these snapshot limits.

We keep support messages and security records as needed to resolve a request, protect the service, or meet a legal duty. We assess that need based on the request or incident.

Your choices and rights

In the iPhone app, open Settings and choose Delete account. Follow the confirmation steps. Deletion continues on the server after you leave the screen. If you cannot sign in, or need help with an earlier account, email help@xnback.com.

You can ask to access, correct, erase, or receive a copy of your personal data. You can also request restricted processing or object to processing based on legitimate interests. These rights have legal conditions. We may need to check your identity before acting.

You can complain to Finland’s Data Protection Ombudsman or your local data protection authority. Contacting us first is not required.

Earlier browser accounts

The new browser game has no sign-in. Replacing the website does not delete an earlier browser account or move it into the iPhone app. Contact us for access or deletion requests concerning that account.

Changes

We will update this notice when the service changes. We will bring important changes to your attention through the website or app.