Your data, clearly explained.
Last updated: 12 September 2026
Who controls your data
Last Brain Standing is an independently operated UK trivia website and is the controller of the personal data described here. Use the privacy request form below to contact the operator.
What we collect
- Account details: email address, public display name, password salt and one-way password hash, age confirmation, account dates and suspension information where applicable.
- Game activity: live-event entries, answers, response times, eliminations, results, ranks, wins and achievements.
- Security data: a short-lived, hashed rate-limit identifier derived from details such as IP address, email or account identifier. The original values cannot be recovered from that identifier.
- Technical data: essential session-cookie information and hosting or security logs that may include IP address, browser type and request details.
- On your device: sound preference, solo progress, personal bests and recently seen solo-question identifiers.
Why we use it
We do not sell personal data, run behavioural advertising or use advertising analytics.
Who handles it
Cloudflare hosts the website and database and provides network security. Resend delivers password-reset emails and records their delivery status. These providers process data under their own security and data-protection arrangements. If an international transfer occurs, we rely on the provider’s applicable contractual or legal transfer safeguards.
Quiz generation may use OpenAI. Only the quiz topic and draft question content are sent for that purpose; player account data is not included.
Cookies and local storage
The lbs_session cookie keeps signed-in players authenticated. It is HTTP-only, uses SameSite=Lax and is marked Secure on HTTPS. It expires after 30 days. Browser local storage remembers sound settings and solo-game progress. These technologies provide features you request; they are not used for advertising or cross-site tracking. You can clear them using your browser controls, though doing so signs you out or resets local solo progress.
How long we keep data
- Accounts and game history remain while the account is open and are deleted when the account is deleted.
- Sessions expire after 30 days and expired records are removed automatically.
- Password-reset records expire after 30 minutes and are removed within 24 hours after expiry.
- Hashed rate-limit records are removed within 24 hours.
- Administrative security records are retained for up to 12 months.
- Resend and Cloudflare may keep limited delivery, security or infrastructure logs under their published retention policies.
Your choices and rights
You can sign out or permanently delete your account from Privacy & account in the game menu. UK data-protection law may also give you rights to access, correct, erase or restrict your data, object to particular uses and receive portable data. Use this form to exercise a right. We may ask for information needed to verify the request.
You may complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.
Children
Players must confirm that they meet the minimum age permitted in their country. The service is not directed at children who cannot lawfully consent to use it. A parent or guardian who believes a child has created an account without valid permission should contact us for deletion.
Automated decisions and security
Very fast quiz responses may be marked for integrity review, but the marker does not make a legal or similarly significant decision. Passwords are protected with a unique salt and a slow one-way derivation; session and reset tokens are stored as hashes. No internet service is perfectly secure, so please use a unique password.
Changes
Material changes will be shown on this page with a new update date. If a change materially affects how existing account data is used, we will provide an appropriate notice.