Last updated: 27 October 2026
The short version
To let you use the Bryza console for your Team, we keep your account: your email address, and if you sign in with Google, your Google account id and first and last names. We use it to sign you in, show you your Team's Games, show your name on the feedback you give, and keep the service secure. We do not use it for advertising, we do not sell it, and we set no tracking cookies.
Who we are
Edge Solutions SRL, Rue Saint Roch 20, 4920 Aywaille, Belgium, enterprise number 1012.938.930, which operates Bryza at bryza.app, is responsible for this processing (the "controller"). Contact: privacy@bryza.app.
What we collect and where it comes from
- From the invite: the email address a Team Admin, or we, typed to invite you, the Team and the role, who invited you, and when.
- From Google, if you sign in with Google: your Google account's id, its email address, whether Google verified that address, and your first and last names. We ask Google for the scopes
openid email profile; we do not keep your profile picture. We get these again at each sign-in. - If you sign in by email: your address, and a short-lived record of each code we mail you (stored only as a hash) and of wrong codes typed.
- From your use of the console: your sessions (when they started and were last used), the feedback you give on the analysis (thumbs up or down and an optional note), and a security log of what you do (see below).
We do not store passwords, your Google access tokens, your profile picture or your IP address.
Why we use it, and on what legal basis
- To give your Team the service: create your account, sign you in, show you your Team's Games, show your name on the feedback you give, let your Team Admins manage members, tell your Team Admins about changes to the service or these terms, and, if fees apply, bill your Team. Your Team has a contract with us, and you use the service as part of its team; we process your data to perform that contract (Article 6(1)(b) GDPR).
- To keep the service secure: we log sign-ins (allowed and refused), invite claims, sign-outs and actions in the console, with our internal user and Team ids, the action and its outcome, to detect and investigate misuse and as evidence in disputes. This is our legitimate interest in securing the service (Article 6(1)(f) GDPR). The log holds no email address, name or IP address.
Providing your email address, and your Google account if you use Google, is necessary to have an account: without it you cannot sign in.
We make no decision about you by automated means.
Who sees it
- Your Team: members see each other's names on the feedback they give. Team Admins also see the email address of every member and invite of the Team. You see your own email address in the console.
- We, the operator of the service, see every user's account and feedback, and alone see the security log.
- Our service providers, who process data only on our instructions:
- hosting of the service and its database: a cloud provider in the Netherlands (EU);
- our domain's DNS and the mail sent to our addresses: Cloudflare (Cloudflare, Inc., United States), which forwards what you write to privacy@bryza.app or contact@bryza.app to us, and redirects www.bryza.app to bryza.app, seeing the IP address and request of whoever opens that address;
- email: Resend (Plus Five Five, Inc., United States), which sends sign-in codes and invites, and receives your address and the mail it sends: the code, or the invite's Team, role and link;
- error monitoring: Sentry (Functional Software, Inc., United States), which stores reports of errors in the service in the EU (Frankfurt). A report says what went wrong and where in our code; we remove email addresses, request contents, cookies and user details from it before it is sent.
- AI model providers, reached through OpenRouter (OpenRouter, Inc., United States), read review text and other content to produce the analysis, as listed in our privacy notice for Steam reviewers. They receive none of your account data.
- Google, if you sign in with Google. Google authenticates you under its own terms and privacy policy, as an independent controller of your Google account, and learns that you signed in to our service. We send Google no personal data: your browser talks to Google directly.
Transfers outside the European Union
The service and its database are hosted in the Netherlands. Cloudflare is a US company: mail to our addresses passes through its network, under the EU-US Data Privacy Framework and the standard contractual clauses in its data processing agreement. Resend is a US company: it keeps account data and delivery logs in the United States, under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses in our data processing agreement. Sentry stores error reports in the EU; as a US company it may access them from the United States, under the EU-US Data Privacy Framework and the standard contractual clauses in its data processing agreement. Google may process data in the United States under its own terms.
How long we keep it
We have not set fixed periods yet. Today:
- a session ends when you sign out, after 1 day without use, or after 30 days at most;
- when a Team Admin or we remove you, your sessions end at once and your email address and names are erased; a record with our internal ids only is kept so that the security log still reads "a removed member";
- an invite expires after 14 days;
- records of mailed sign-in codes are deleted once they are a day old, when the next code is asked for, and when you are removed; a count of wrong codes typed is deleted once a day has passed since the last one, when anyone next asks for a code;
- the security log is kept for 12 months.
Cookies
We set only cookies that are strictly necessary to sign you in, from our own web server:
__Host-session: keeps you signed in. It is encrypted, cannot be read by scripts, and is deleted when you close your browser; the session behind it ends as described above.__Host-login: lasts 10 minutes, only while you sign in, to secure the sign-in.
We use no analytics, advertising or tracking cookies. Cookies strictly necessary to provide a service you asked for are exempt from consent (Article 5(3) of the ePrivacy Directive 2002/58/EC, as applied in Belgian law), so we show no cookie banner.
Google user data
If you sign in with Google, we receive from Google only your account id, email address, whether it is verified, and your first and last names (scopes openid email profile). We use them only to sign you in, to match you to your invite, to show your email to you and your Team Admins and your name on your feedback, as described above. We do not sell this data, use it for advertising, or share it with anyone beyond what this notice describes, and we do not use it to train AI models. We keep no Google access or refresh token, so we cannot act in your Google account.
To delete it, ask your Team Admin to remove you or write to us; your email address and names are then erased as described above. You can also remove our access in your Google account settings.
Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your rights
You can ask us to access, correct or erase your data, to restrict its use, to receive the data you gave us in a portable format, and you can object to the security log on grounds relating to your situation. Write to privacy@bryza.app. We answer within one month.
You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be), or the authority where you live or work.
Changes
We will update this page if what we collect, why, or who receives it changes, and change the date at the top.