Privacy Policy

Last updated: November 1, 2026

This page explains what Puzzle Temple (the Sudoku, Climb Sudoku and Jigsaw games on this site) collects about you, why, who else handles it, how long it is kept, and what you can do about it. We have written it in plain language. If anything is unclear, email contact@puzzletemple.com and we will explain or fix it.

Who is responsible

The site is run by Vanja Radulovic (Serbia), referred to as "we" and "us". Under data protection law (the EU and UK GDPR for visitors it applies to, and Serbia's data protection law) that makes us the "controller" of the personal data described here. You can reach us at contact@puzzletemple.com.

What we collect, why, and for how long

Your account. A username, your email address, and a password that we store only as a one-way hash (we cannot read it), plus whether your email address is verified and when the account was created. We use it to run your account: signing you in, sending verification and password-reset emails, and showing your username next to your scores. Kept until you delete your account.
Playing as a guest. A random device identifier, kept in a cookie on your device, and the display name you choose. It lets a room recognise you after a reload and lets a room's creator keep out a player they removed. The cookie lasts a year and is not removed when you sign out.
Scores and your public profile. When you are signed in with a verified email address and finish a Sudoku or Climb Sudoku game, the result (time, mistakes and hints, or height) is saved automatically and shown on the leaderboards with your username. Anyone can open your profile page, which shows your username, your best Sudoku times and your best Climb Sudoku height. Kept until you delete your account.
Jigsaw rooms. The room code, difficulty and mode, where the pieces are, how long the puzzle has been played, and the display names of everyone who joined (the other players in the room can see them). A signed-in user's unfinished rooms are kept until they delete them (the 50 most recently active are kept). A finished room is closed once everyone has left it. A guest's room is deleted about five minutes after its last activity, once nobody is connected.
Photos you upload. A photo is stored only to run your puzzle. Its web address is long and random and is given only to the players in your room, but anyone who has that address can open the photo, so share it with care. It is deleted when its room is deleted, or an hour after the upload if no room was made with it. Our nightly backup also copies uploaded photos, and a deleted photo can stay in that backup for up to 30 days. If a photo is reported we may look at it and remove it (see the terms).
Your finished puzzles. If you are signed in, finishing a Jigsaw saves a small picture of it, with the time, number of pieces, difficulty and mode, in a gallery that only you can see. Kept until you delete the entry or your account.
Your IP address and device code, to keep rooms safe. When you create or join a room we keep your IP address, and a short code (a hash) made from ordinary browser and device settings (browser type, language, screen size and colour depth, time-zone offset, number of processor cores, platform), on the room's list of players. This is how a player the creator has removed is kept out. It is cleared 30 days after you were last seen in the room; when a player is removed, the ban entry keeps its own copy until the room is deleted. Separately, our server uses your IP address, in memory only, to limit how fast one address can sign in, sign up or send requests; that is not written anywhere.
Web server log. Our web server writes a line for every request: the time, your IP address, the address you asked for (the secret part of one-time links in emails is removed), the response status, and what your browser sends along such as its type, language and the page you came from. It never writes your cookies. We use it for security and to find faults, and keep it for at most 30 days.
Counting visitors. To see roughly how many people use the site each day, we keep for each day which account or guest identifier was active. For visitors with neither, the site sends one "someone visited" note per browser session: our server turns your IP address and browser type into a one-way code with a secret that is thrown away every day, and keeps only that code and the date. It cannot be turned back into your IP address or matched from one day to the next. Nothing is sent if your browser sends a Do Not Track or Global Privacy Control signal. Kept for 14 months; your account identifier is removed from this when you delete your account.
Usage events. When someone signs up, creates a room, saves a Sudoku or Climb Sudoku score or finishes a Jigsaw, we record the kind of event, the account or guest identifier, the mode and difficulty, and the country the visit came from (reported to us by Cloudflare; we do not look your IP address up anywhere). Kept for 14 months. When you delete your account the account identifier is removed from these records and only the anonymous count remains.
Messages you send us. A contact-form message (with any screenshots you attach, the email address if you give one, the page and browser you wrote from, and your username if you are signed in) is emailed to us and is not stored in our database. So is a "Report this photo" report, with the room code, your note and your account or guest identifier. An email you send to contact@puzzletemple.com arrives in our private mailbox. We keep such messages as long as we need to answer them and deal with what they are about.
Emails we send you. A verification link (valid for 24 hours; sent when you sign up, change your email address or ask for a new one), a password-reset link (valid for 1 hour), and a notice when your account is deleted. We do not send marketing email.

We do not sell your data, we do not show advertising, and the site loads nothing from third-party advertising or tracking services. If that changes, we will update this page first.

Who else handles your data

Hetzner Online GmbH (Germany) hosts the site on a server in Nuremberg and keeps our backups on a storage box. The database backup is encrypted and kept for up to 30 days. The copy of uploaded photos is not encrypted; deleted photos stay in it for up to 30 days.
Cloudflare, Inc. (USA) provides our domain name service and the network in front of the site: your requests to the site pass through Cloudflare, which therefore sees them, including what you type and upload, in order to deliver them. It tells us the country a visit came from, and forwards mail sent to contact@puzzletemple.com to our private mailbox.
Resend (USA) sends the emails listed above, so it sees your email address and the message. The contact form's messages reach us through it too.
Authorities if the law requires us to hand something over.

Cloudflare and Resend are US companies. For personal data that leaves the EU/EEA they rely on the EU Standard Contractual Clauses and are certified under the EU-US Data Privacy Framework. Our own server is in Germany.

Cookies and similar storage

We use only what the site needs to work; there are no advertising or tracking cookies, so there is no cookie banner.

access_token keeps you signed in (or identifies your guest session). Not readable by page scripts. Lasts 7 days for an account and 30 days for a guest session.
XSRF-TOKEN is a security token that stops other websites making requests on your behalf. Lasts as long as the sign-in above.
device_id is set when you play as a guest, so a guest identity survives a reload. Not readable by page scripts. Lasts a year.
pt-visit is a note in your browser's session storage holding today's date, saying this visit has already been counted. It disappears when you close the tab.
pt-theme is a note in your browser's local storage holding the theme you picked for the site. It stays on your device and is never sent to us. It is removed when you choose "Match my device" or clear your site data.

Why we may process your data

To provide the game you asked for (your account, rooms, scores, gallery and uploaded photos): it is necessary to run the service you use.
Our legitimate interests in keeping the service secure and fair (rate limits, the web server log, keeping removed players out), in counting how many people use it, and in fixing faults. We keep these to the minimum and the periods above.
The law, where we must keep or hand over something.

We do not rely on consent for anything above, and we make no decisions about you by automated means.

Your rights

You have the right to:

See and export your data: in Settings, "Download my data" gives you everything tied to your account as one file.
Correct it: you can change your username, email and password in Settings.
Delete it: in Settings, "Delete account" removes your rooms and photos, your seats in other rooms, your gallery, scores and tokens, and your identifier from usage records. Data in backups disappears with them within 30 days.
Object to or restrict processing based on our legitimate interests.
Complain to a data protection authority: in Serbia, the Commissioner for Information of Public Importance and Personal Data Protection; in the EU, the authority of your country.

For anything the settings page cannot do (for example, data about you that is not tied to an account, such as a guest device or an IP address in a room), email contact@puzzletemple.com. We answer within one month.

Children

You must be at least 16 to create an account. The site is not aimed at children under 13 and we do not knowingly collect their personal data. If you believe a child has an account, email us and we will delete it.

Security

The site is served over HTTPS only, passwords are stored as one-way hashes, and the database backup is encrypted. No system is perfectly secure; if you find a problem, please tell us at contact@puzzletemple.com.

Changes to this policy

When this policy changes we update the date at the top of this page, and for a change that matters to you (a new provider, or a new kind of data) we will say so on the site.