Privacy Policy
Last updated 12 August 2026
Mental Tank is a quiz game for school-age players. This page explains exactly what we store, why we store it, and how to get rid of it. It is written to be read by a parent or a teacher, not a lawyer.
The short version. You can play the whole game without an account, and we store nothing on our servers if you do. Signing in is optional and exists only to save progress across devices. We do not show ads, we do not use analytics or tracking services, we do not profile players, and we never sell or share personal information.
Playing without an account
If you never sign in, your progress is kept in your own browser using
localStorage on your device. It is not sent to us. Clearing your browser data
deletes it.
Accounts belong to adults
An account is intended to be created and controlled by a parent, guardian or teacher. When an adult signs in we store:
- An email address, or an anonymous identifier supplied by Google or Apple if that sign-in method is used
- A display name, if the sign-in provider gives us one
- A login session token (stored only as an irreversible hash) and the browser's user-agent string, so you can stay signed in
If you use Sign in with Apple and choose to hide your email, we only ever receive Apple's relay address. We never see your real one.
Player profiles for children
An adult can create player profiles, one per child. For each profile we store only what the game needs to work:
| Stored | Why |
|---|---|
| A display name the player picks | So the right player can be selected |
| A grade level | To ask questions at the right difficulty |
| Game progress: research points, unlocked tanks, campaign state, best results | So progress is not lost |
| A randomly generated friend code | So a friend can be added deliberately |
| Match records: which shots were taken, and who won | So an unfinished match can be resumed |
We do not ask a child for an email address, a real name, a birthday, a photograph, a phone number, or a location. We do not need them and we do not want them. A display name can be a nickname, and we would encourage that.
How players find each other
Players can only be added using a 6-character friend code that the other player chooses to share. There is deliberately no way to search for a player by name, email or any other detail, so a child cannot be found by a stranger who happens to know something about them. There is also no chat or free-text messaging anywhere in the game. Players can only send each other a challenge to a match.
What we do not do
- No advertising, and no advertising networks
- No analytics, tracking pixels, or third-party scripts that follow players around
- No selling, renting or sharing of personal information
- No behavioural profiling and no automated decisions about a player
- No cookies beyond the one that keeps you signed in
The one third-party request the game makes is to Google Fonts, to load two typefaces. If you sign in with Google or Apple, your browser talks to them directly for that sign-in.
Children's privacy and parental rights
Because this game is aimed partly at children under 13, we intend to keep collection to the minimum described above and to keep accounts in adult hands. As the adult who controls an account you may at any time:
- See everything stored for your account and every profile under it
- Correct a profile's name or grade level
- Delete a single player profile, or the entire account
- Refuse further collection, by deleting the account and playing as a guest
Deleting the account removes the account, every profile under it, all progress, all friendships and all match history. The deletion is immediate and it cascades — nothing is kept behind in an archive.
How long we keep things
Account and profile data is kept until you delete it. Sign-in links expire after 15 minutes and work once. Login sessions expire after 90 days.
Security
The site is served only over HTTPS. Session tokens are stored as hashes, never in a form that could be reused if the database were read. Sign-in cookies are HTTP-only and same-site.
Contact
For any privacy question, or to ask for data to be shown or deleted, email privacy@mentaltank.com.
Note for the site owner: this page describes what the software actually does, and it is not legal advice. Because the game is directed in part at children under 13, COPPA in the United States (and the UK Age Appropriate Design Code, and GDPR-K in the EU) impose specific obligations — including verifiable parental consent in some circumstances, and a working route for parents to review and delete data. Have a lawyer review this text and the consent flow before you promote the game to schools or families.