Privacy Policy

1. Information we collect

1.1 Information you give us

• Account details. The name and email address you enter at registration, and a password. We never store your password in readable form — it is hashed with bcrypt before it reaches our database, and the original is not recoverable by us or by anyone with database access.
• Google sign-in (optional). If you sign in with Google instead of a password, Google sends us the basic profile information associated with that account — typically your name, email address, and profile image URL. We do not receive your Google password.
• Correspondence. If you email us, we retain that message and our reply.

1.2 Information generated by using the Service

• Gameplay records. For each run you complete, we store the game played, your score, how many questions you answered correctly out of how many, the time it was recorded, and a small amount of structured detail about the run (for example, per-category point breakdowns in multi-game modes). This is what powers your percentile profile, your readiness scores, and the public leaderboards.
• Anonymous handle. At registration we generate a random public identifier in the form animal-animal-#### (for example, otter-falcon-4821). This is the only identity shown to other users.

1.3 Information collected automatically

• Server and security logs. Our hosting provider, Vercel, automatically records standard request data including IP address, browser and device type, referring page, and request timestamps. This is used for security, abuse prevention, and diagnosing faults.
• Product analytics. We use Vercel Analytics to count page views and understand which parts of the site are used. It is privacy-oriented and aggregate: it does not use third-party advertising cookies and does not track you across other websites.
• Essential cookies. If you sign in, we set a small number of strictly necessary cookies: one that keeps you signed in between page loads, one anti-forgery token that protects the sign-in form, and one that remembers where to return you after signing in. They are all HttpOnly, Secure, and same-site, and they exist only to make accounts work. If you never sign in, we set no cookies at all. We use no advertising or cross-site tracking cookies, which is why you are not asked to accept a cookie banner.

1.4 Payment information

None. QAM Labs is free and has no paid tier, so we never ask for, collect, receive, or store payment details of any kind — no card numbers, no billing addresses, no payment processor records. There is nothing to pay for, and we will never ask you to.

2. How we use information

• To create and operate your account and keep you signed in.
• To record your scores, calculate percentiles and readiness scores, and rank entries on leaderboards.
• We do not currently send email. If we add account email — such as address verification or a security notice — it will be transactional only. We do not send marketing email and do not sell or share your address.
• To keep the Service secure — detecting abuse, automated play, and attempts to manipulate leaderboards.
• To diagnose faults and improve the Service.
• To comply with legal obligations.

We do not sell your personal information, and we do not share it with advertisers or data brokers. We do not use your information to build advertising profiles.

3. Legal bases for processing

Where the UK or EU GDPR applies to you, we rely on the following legal bases: performance of a contract for operating your account and recording your scores; legitimate interests for security, abuse prevention, aggregate analytics, and improving the Service; and legal obligation where we must retain records, for example for tax purposes.

4. What other users can see

Leaderboards are public and display only your anonymous handle, your score, and the date of the run. Your real name and email address are never shown to other users — they appear only to you, on your own dashboard, and to us as the operator. Handles are randomly generated and are not derived from your name or email.

5. Service providers we share data with

We use a small number of providers to run the Service. Each receives only what it needs for its function, and each processes data on our behalf under its own terms:

• Vercel — hosting, content delivery, server logs, and analytics.
• Neon — the managed PostgreSQL database where account and gameplay records are stored.
• Google — only if you choose to sign in with Google.

We may also disclose information where required by law, court order, or valid legal process, or where necessary to protect the rights, safety, or property of QAM Labs or its users. If QAM Labs is involved in a merger, acquisition, or sale of assets, account information may transfer as part of that transaction.

6. International transfers

QAM Labs is operated from the United States, and our providers store and process data on servers located in the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored in, and processed in the United States, where data protection law may differ from that of your own country.

7. Data storage and retention

Your account information and gameplay records are stored on the Service and retained for as long as your account exists. Scores and attempts are kept on an ongoing basis so that leaderboards, percentile rankings, and readiness scores remain accurate and comparable over time — percentiles are calculated live against the full history of recorded attempts, so removing past entries would distort everyone's ranking.

Server and security logs are retained on our hosting provider's standard schedule. We hold no billing or payment records, because the Service is free and we never take payment.

8. Security

Traffic to and from the Service is encrypted in transit using TLS. Passwords are stored only as bcrypt hashes. Card details never touch our systems. Access to the production database is restricted to the operator.

No online service can be guaranteed completely secure, and we cannot promise that unauthorised access will never occur. Please use a strong, unique password, and contact us immediately if you believe your account has been compromised.

9. Your rights

Depending on where you live — including under the California Consumer Privacy Act as amended, and the UK and EU GDPR — you may have the right to request access to the personal information we hold about you, to request correction of information that is inaccurate, to request deletion, to request a portable copy, to object to or restrict certain processing, and not to be discriminated against for exercising these rights.

To make a request, email qamlabsinc@gmail.com from the address on your account. We will respond within the period required by applicable law. Note that we may need to retain certain information where we have a legal obligation or an overriding legitimate reason to do so, and that deleting an account removes your ability to access it.

10. Changes to this policy

We may update this policy as the Service changes or as the law requires. The date at the top of this page always reflects the current version. Where a change materially affects your rights, we will take reasonable steps to notify account holders. Continuing to use the Service after a change takes effect means you accept the updated policy.

11. Contact

Questions, requests, or complaints about this policy or about how your information is handled can be sent to qamlabsinc@gmail.com.