NeuraTap Privacy Policy
Last updated: 20 September 2026
The short version
- We collect little: the email address on your account, your nickname, your age group, your country (determined once from your IP address at registration), your puzzle-solving activity, your prompts to AI features, and anonymous-style analytics about how the Service is used.
- We use this data to run and personalise your training, to improve NeuraTap and our own models, to keep the Service secure and to communicate with you.
- We do not sell personal data, and there are no third-party ads in NeuraTap.
- Accounts for users under 18 are created by a parent or legal guardian, in every country. We collect the same minimal data for children as for everyone else, and we never send them marketing.
- Tappy and the puzzle generator send your prompts and board positions to AI model providers that work for us. Under our agreements with them, they do not use your data to train their models.
- You can see, correct, export and delete your data, and withdraw consent, in your account settings or by writing to hello@neuratap.ai.
This summary is for convenience. The full Policy below is what applies.
1. Who is responsible for your data
The Service at neuratap.ai is operated by the NeuraTap development team, based in the Republic of Kazakhstan ("NeuraTap", "we", "us"). We are the owner and operator of the database containing your personal data under the law of Kazakhstan, and the "controller" under the data protection laws of the European Economic Area (EEA) and the United Kingdom where those laws apply.
Contact for all matters, including personal data: hello@neuratap.ai.
This Policy applies to the "Service": the neuratap.ai website, the NeuraTap web application, our emails and our support channels. It does not apply to third-party websites we link to.
2. Whose data we process
- Adult users who create their own accounts.
- Users under 18, whose accounts are created by a parent or legal guardian (Section 6).
- Visitors to our website who do not have an account.
3. What we collect
| # | Category | Examples | Where it comes from |
|---|---|---|---|
| 1 | Account data | Email address on the account, nickname, age group (children under 12, teenagers 12 to 18, adults), language and settings, country. The country is determined once from your IP address at registration; the IP address itself is not kept in your account. If you sign in with Google, we receive your email address and name from Google; you choose your nickname yourself | You (or the parent or guardian who creates the account); Google, if you sign in with Google |
| 2 | Sign-in and security data | Password (in protected form), sign-in times, counters of failed attempts and temporary blocks linked to the email address, device and browser type | You; generated when you sign in |
| 3 | Training activity | Puzzles attempted, moves played, time spent, results, streaks, estimated level and knowledge profile, recommendations shown | Generated as you use the Service |
| 4 | AI feature data | Prompts to Tappy and to the puzzle generator, the board positions and moves attached to them, the responses generated, and your reactions to them (for example, "helpful") | You; generated |
| 5 | Content you share | Puzzles, result cards and links you choose to share | You |
| 6 | Product analytics | Which screens and features you use, clicks and actions inside the Service, device and browser type, a pseudonymous identifier. Collected with PostHog. This is about actions in the Service, not about you personally: it does not include the text of your prompts, your name or your email address | Generated |
| 7 | Communications | Emails and messages you send to support, feedback, appeals | You |
We do not ask for and do not want your surname, phone number, postal address, government ID numbers, payment data, photos, health data or any other sensitive data. Please do not put such data into prompts, your nickname or messages.
4. Why we use your data and on what legal basis
| # | Purpose | Data used | Legal basis in the EEA and UK | Basis under Kazakhstan law |
|---|---|---|---|---|
| 1 | Providing the Service: creating and operating your account, signing you in, running puzzles, tracking progress, showing results | Account data, sign-in data, training activity | Performance of a contract (Art. 6(1)(b) GDPR) | Your consent; performance of the contract with you |
| 2 | Personalising training: recommending puzzles, adapting difficulty, simplifying a position after a mistake, building your knowledge profile | Training activity, account data | Performance of a contract | Your consent |
| 3 | AI features: generating explanations and puzzles from your prompts | AI feature data | Performance of a contract | Your consent |
| 4 | Improving NeuraTap and training our own models: analysing how puzzles and features perform, and training and evaluating the models that choose puzzles for you, split a position into simpler ones and find puzzles by theme | Training activity, AI feature data, product analytics (de-identified where possible) | Legitimate interests (running and improving an adaptive learning service) | Your consent |
| 5 | Security and abuse prevention: rate limiting, fraud prevention, incident investigation | Sign-in data, product analytics, training activity | Legitimate interests (security); legal obligation | Legal obligation; legitimate interests |
| 6 | Communicating with you: the password email at registration, service emails, replies to your requests | Account data, communications | Performance of a contract; legitimate interests | Performance of the contract |
| 7 | Understanding how the Service is used | Product analytics | Consent where the law requires it; otherwise legitimate interests | Your consent |
| 8 | News about NeuraTap (adult users only) | Account data | Consent; or legitimate interests where the law allows email marketing to existing users with an opt-out | Your consent |
| 9 | Legal compliance and protection of rights: responding to lawful requests, enforcing our Terms, establishing or defending claims | Any of the above, as relevant | Legal obligation; legitimate interests | Legal obligation |
Where we rely on legitimate interests, we have checked that our interest does not override your rights and freedoms. You can object at any time (Section 12).
4.1 Details of your consent under Kazakhstan law
When you tick the consent box at registration (or a parent or legal guardian ticks it for a user under 18), you give NeuraTap your consent to the collection and processing of personal data on these terms:
- Data covered: the categories listed in Section 3.
- Purposes: the purposes listed in Section 4.
- Transfer to third parties: yes, to the recipients described in Section 7.
- Cross-border transfer: yes, as described in Section 8.
- Dissemination in publicly available sources: no, except content that you yourself choose to share (Section 13).
- Term: the consent is valid for as long as you have an account and for the retention periods in Section 10, or until you withdraw it.
- Withdrawal: at any time in your account settings or by writing to hello@neuratap.ai. We will stop processing within the period set by law, except processing that the law requires or allows without consent.
5. AI features and your data
5.1 What is sent. When you use Tappy or the puzzle generator, we process the text of your prompt, the board position and moves in question, and minimal context (for example, the puzzle's theme and difficulty). We do not include your name, email address or account ID in the data we send to AI model providers.
5.2 Who processes it. Prompts are processed by our own models on our infrastructure and by third-party AI model providers acting on our behalf (OpenAI, United States), through their business API. Under our agreements with them, these providers may process the data only to generate the response and to monitor for abuse of their services; they do not use it to train their models; and they delete it typically within 30 days, except content that their safety systems flag, which they may keep longer to enforce their policies.
5.3 Our own models. We use solving data and AI feature data to train and improve NeuraTap's own models: the models that choose puzzles for you, split a position into simpler ones and find puzzles by theme. Where possible we do this on de-identified data.
5.4 Human review. We may review prompts that our safety filters flag or that users report, to keep the Service safe and suitable for children.
5.5 Labelling. Puzzles and explanations produced by AI features are labelled as AI-generated in the Service.
5.6 Automated personalisation. NeuraTap automatically selects puzzles and adapts difficulty based on your training activity. These decisions only change which puzzles you see next; they never affect your rights, and you can always choose puzzles yourself. Decisions to suspend an account are reviewed by a person before they take effect, and you can appeal them (Terms of Service, Section 8.3). Where the law gives you the right to ask how an AI feature produced a particular result, write to hello@neuratap.ai.
6. Users under 18
6.1 Who creates the account. Accounts for users under 18 are created by a parent or legal guardian, who selects the age group and confirms at registration that they are creating the account for the child. This applies in every country. The parent or guardian is responsible for the email address on the account.
6.2 What we collect about a child. The same minimal data as for any user (Section 3): the email address on the account, nickname, age group, country, training activity, prompts to AI features and product analytics. Nothing else. Prompts are free text, so please tell your child not to type personal details into them; if we notice personal details in a child's prompts, we remove them.
6.3 No advertising, no sale, no marketing to children. We do not show third-party advertising in the Service, do not sell personal data, and do not send news or marketing to accounts in the children or teenager age groups. We use children's data only to provide and improve chess training, to keep the Service secure and to comply with the law.
6.4 No contact with strangers. AI features are not a chat with other people, and the Service does not allow users to message each other.
6.5 Control by parents and guardians. A parent or legal guardian can see, correct, export and delete the child's data at any time in the account settings or by writing to hello@neuratap.ai; we verify requests through the email address on the account.
6.6 If a child registers alone. If we learn that a person under 18 created an account without a parent or legal guardian, we delete the account and its data. The parent or guardian can then create a new account for the child. If you believe a child has given us personal data without a parent or guardian, write to hello@neuratap.ai.
7. Who we share data with
We do not sell personal data. To run the Service we use third-party services, and each of them receives only what it needs for its task:
- cloud hosting with servers in Kazakhstan, where the Service runs and data is stored;
- an AI model provider that generates explanations and puzzles (Section 5): it receives prompts and positions without your name, email or account ID;
- an email delivery service: it receives the email address and the text of the email;
- PostHog, product analytics: it receives data about actions in the Service (Section 3, row 6);
- Google, if you sign in with your Google account: Google learns that you signed in to NeuraTap; your Google account is governed by Google's privacy policy (policies.google.com/privacy).
These services are bound by contracts that limit their use of your data to our instructions and require them to protect it. Beyond them, we may pass the necessary minimum of data to authorities and courts when the law requires it, and to a successor if the Service is transferred to a company (for example, a legal entity created to operate NeuraTap); in that case we will notify you, and this Policy will continue to apply.
We also share what you choose to share through the sharing features, with the people you share it with (Section 13).
8. Where your data is stored and international transfers
8.1 Our servers are located in the Republic of Kazakhstan. The third-party services in Section 7 (the AI model provider, the email delivery service, analytics, Google) may process data in other countries, including the United States and countries of the European Union.
8.2 Kazakhstan. The database containing personal data of our users is located in the Republic of Kazakhstan; some data is processed abroad by the services in Section 7. Under Kazakhstan law we transfer personal data across borders on the basis of the consent you give at registration (Section 4.1) and agreements with our providers that require an adequate level of protection.
8.3 EEA and UK. Because we are based in Kazakhstan, your data is processed there when you use the Service. Where the GDPR or UK GDPR applies and we pass data to providers in the United States or other countries without an adequacy decision, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum included in our agreements with those providers, together with additional measures where needed. You can ask hello@neuratap.ai for more information about these safeguards.
9. Cookies and similar technologies
| # | Type | Examples | Purpose | Consent |
|---|---|---|---|---|
| 1 | Strictly necessary | Session and sign-in cookies (including sign-in with Google), security and rate-limiting cookies, cookie-preference cookie | Needed to run the Service and keep it secure | No consent needed |
| 2 | Functional | Language, board theme, sound and other settings | Remembering your choices | Asked where the law requires it |
| 3 | Analytics | PostHog cookies and browser storage | Understanding how the Service is used | Asked where the law requires it (for example, EEA and UK); you can also block these cookies in your browser |
9.1 Where the law requires consent, our cookie banner lets you accept or reject analytics cookies with one click and change your choice later through the cookie settings link in the footer. You can also delete or block cookies in your browser; blocking strictly necessary cookies will stop the Service from working.
9.2 We do not use advertising cookies or pixels.
9.3 Session cookies expire when you close your browser. Persistent cookies expire after a set period of at most 24 months, or earlier if you delete them.
10. How long we keep your data
| # | Data | How long |
|---|---|---|
| 1 | Account data and training activity | For as long as your account exists. Deleted within 30 days after you delete the account or we delete it under the Terms of Service; copies in backups disappear within a further 30 days (row 8). We may keep de-identified statistics that no longer identify you |
| 2 | AI feature data (prompts and responses) | Linked to your account for up to 12 months, then deleted or de-identified; deleted earlier if you delete the account. AI model providers keep them typically for 30 days, longer for flagged content (Section 5.2) |
| 3 | Sign-in and security data | 90 days, or longer if needed for an ongoing security investigation or legal claim |
| 4 | Product analytics | 12 months in pseudonymous form, then only as aggregated statistics |
| 5 | Inactive accounts | If you have not signed in for 24 months, we email you; if you do not sign in within a further 30 days, we delete the account and its data |
| 6 | Communications with support | 24 months after the last message in the conversation |
| 7 | Consent and preference records | For as long as the consent is valid and 3 years after it is withdrawn, so that we can demonstrate compliance |
| 8 | Backups | Rolling backups are kept for 30 days. Data deleted from the Service disappears from backups within that period |
| 9 | Cookies | See Section 9 |
11. Security
11.1 We protect personal data with technical and organisational measures appropriate to the risk, including encryption of data in transit, encryption at rest where our providers support it, access controls and least-privilege access for our team, logging and monitoring, rate limiting, regular backups and review of the providers we use.
11.2 Passwords. You can change the password sent to you at registration in your profile at any time. Repeated failed sign-in attempts trigger a temporary block. Our sign-in screens do not reveal whether an email address is registered.
11.3 No system is completely secure. If a security incident affects your personal data, we will notify you and the relevant authorities as required by applicable law.
11.4 If you discover a security vulnerability in the Service, please report it to hello@neuratap.ai with "Security" in the subject line.
12. Your rights
12.1 Everyone. Wherever you live, you can:
- ask whether we process your personal data and receive a copy of it;
- correct inaccurate or incomplete data;
- delete your account and data;
- receive the data you gave us in a machine-readable format;
- withdraw consent at any time, without affecting processing that took place before withdrawal;
- object to processing based on legitimate interests, and to marketing at any time;
- ask us to restrict processing while a request is being checked;
- complain to a data protection authority.
12.2 Kazakhstan. You also have the rights set out in the Law of the Republic of Kazakhstan "On Personal Data and Their Protection", including the right to know whether we process your personal data, to receive information about the processing, to request correction, blocking or destruction of your data, and to withdraw your consent. You can complain to the authorised body for personal data protection of the Republic of Kazakhstan.
12.3 EEA and UK. You have the rights in Articles 15 to 22 of the GDPR (or the UK GDPR). You can complain to the supervisory authority of the country where you live or work, or, in the United Kingdom, to the Information Commissioner's Office.
12.4 United States. Depending on your state, you may have the right to know, correct or delete personal data, and to opt out of the sale of personal data, of sharing for targeted advertising and of profiling. We do not sell personal data and do not use targeted advertising. We honour requests where state law applies to us.
12.5 How to exercise your rights. Use your account settings (for export and deletion) or write to hello@neuratap.ai from the email address linked to your account. To protect your data, we verify requests through the email address on the account. For a user under 18, the parent or legal guardian who created the account exercises these rights.
12.6 Timing and cost. We respond within one month, or within the shorter period that applicable law requires. Where the law allows, we may extend this period for complex requests and will tell you if we do. Requests are free of charge, unless they are clearly unfounded or excessive.
13. Sharing features and public content
13.1 When you share a puzzle, a result card or a link through a sharing feature, the shared item becomes visible to anyone who has the link or, where the feature says so, to other users. Recipients can copy shared items further, and we cannot control those copies.
13.2 Shared items show only the nickname of the account that solved the puzzle. We recommend a nickname that does not reveal a child's real name.
13.3 You can stop sharing an item in the Service or by writing to us; we will remove it from the Service, but copies already made by others may remain.
14. News and marketing emails
14.1 We send news about NeuraTap only to adult users, and only where you have agreed to receive it or where the law allows us to email existing users about similar services with an opt-out.
14.2 You can unsubscribe at any time using the link in every such email or in your account settings. We will still send service emails that are needed to run your account (Terms of Service, Section 3.5).
14.3 We never send news or marketing to accounts in the children or teenager age groups.
15. Changes to this Policy
We may update this Policy. For material changes we will notify you at least 5 days before they take effect, by email to the address on your account or by a notice in the Service. The date at the top shows when the Policy was last updated. Earlier versions are available on request.
16. Contact
Email for all matters, including personal data: hello@neuratap.ai