Privacy Policy
Last updated: [DATE -- fill in before publishing]
⚠ Draft notice: This document was drafted to accurately reflect what this specific application actually does with user data, but it is a starting point, not a finished legal document. It has not been reviewed by an attorney. Before relying on this for a real product with real users -- especially once payment processing is added -- have it reviewed by a lawyer familiar with privacy law in the jurisdictions your users are in (this matters a lot: GDPR for EU users, CCPA for California users, and others have specific, non-optional requirements this draft does not fully address).
What we collect
If you create an account:
- Email address -- used to identify your account and, in the future, for account-related communication (password reset, billing receipts once payment processing exists).
- Password -- never stored in plain text. We store a salted, one-way cryptographic hash (PBKDF2) that cannot be reversed to recover your actual password, even by us.
- Display name (optional) -- shown in place of your email in the app if you set one.
- Solve history -- which puzzle topics you've played, difficulty level, how long puzzles took you, how many hints you used, and whether you completed each puzzle. This is used to power personalized difficulty and topic recommendations, and the stats dashboard.
If you use the app without an account (the free trial):
- A random identifier is generated and stored in your browser's local storage. It is not linked to your email, name, or any other personal information -- it exists only to apply a fair usage limit to the free trial. See "Anonymous trial identifiers" below.
How your topic input is used -- a specific disclosure worth reading
When you type a topic to generate a custom puzzle, or ask us to reword a clue, that text is sent to Anthropic (the company behind Claude, the AI model that generates puzzle content) to process your request. We do not control how Anthropic handles data sent to their API beyond what's described in their own privacy policy. Please avoid entering personal or sensitive information as a puzzle topic.
Local storage / "cookie-like" technology
This app does not use traditional cookies, but it does use your browser's local storage to keep you logged in between visits (a session token) and to track the anonymous trial identifier described above. This data stays in your browser and is sent to our server only when needed to authenticate your requests. Clearing your browser's site data will log you out and reset your anonymous trial status.
Third parties we use to run this service
We don't sell your data. We do use the following services to actually run the app, each of which may process data as part of providing that infrastructure:
- Anthropic -- generates puzzle content from the topics you provide (see above)
- A hosted database provider (Supabase or Neon, depending on current configuration) -- stores account and solve-history data
- Render -- hosts the backend server that processes your requests
- GitHub Pages -- hosts the web page you're using right now
Your rights, and an honest limitation
You can request:
- Access to the personal data we hold about you
- Correction of inaccurate data (e.g. updating your display name, which you can already do directly in the app)
- Deletion of your account and associated data
Currently, deletion requests must be handled manually -- there is not yet a self-service "delete my account" button in the app. If you'd like your account and data deleted, contact us at [CONTACT EMAIL -- fill in] and we will process the request. We're aware this should eventually be a self-service feature and consider it a known gap.
Children's privacy
This service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. We do not currently verify the age of users at signup. If you believe a child has provided us with personal information, contact us at [CONTACT EMAIL] and we will delete it.
Data retention
We retain your account data for as long as your account is active. Solve history is retained to power personalization features; you may request its deletion at any time using the contact method above.
Security
Passwords are hashed, never stored in plain text. Sessions use signed tokens (JWT) that expire automatically. No system is perfectly secure, and we cannot guarantee absolute security of any data transmitted to or stored by this service.
Changes to this policy
We may update this policy as the service changes. Material changes will be reflected by updating the "Last updated" date above.
Contact
Questions about this policy or your data: [CONTACT EMAIL -- fill in]