Privacy Policy

Who we are

Puzzleable is a site for making and solving personalised crosswords, daily puzzles and small games, at puzzleable.co.uk. The data controller is Daedalus Works Ltd, company number 16266136, of 8 Devonshire Square, London, EC2M 4YJ, United Kingdom. Data protection enquiries go to admin@puzzle-builder.com, or through the contact page.

Accounts have no email address

We sign you in with an access code such as KITE-7798 and a six-digit PIN, not an email address and password. We store the code, a protected form of the PIN and an internal account identifier. We do not ask for or hold your name, email address or postal address, and there is no password-reset email — the code is the account. If you choose to add an email address (see "Email, and the two separate consents" below) we hold that too; otherwise we hold none.

This is good for privacy and awkward for support: see "Your rights" below for what it means in practice when you contact us.

What we collect, and why

• Account data — your access code, the protected PIN, your display name and any recovery details you add. Purpose: to sign you in, keep your puzzles attached to you and let you back in if you lose the code.
• Puzzle content — the words, clues, titles, messages and themes you enter, plus the share codes and links generated for them. Purpose: to build, store and display your puzzles to whoever you share them with. Anything you choose to publish publicly is visible to everyone.
• Solving and leaderboard activity — solve times, hints used, completion counts, ratings, daily and Alphabet Puzzle results, league standings and co-solve activity. Purpose: to run timers, personal statistics, leaderboards and leagues.
• Technical logs — error reports including the page you were on, browser and device details, and an IP address at the point of the request. Purpose: to find and fix faults and to protect the site from abuse.
• Analytics — aggregate counts of pages viewed and features used. Purpose: to understand which parts of the site are worth building on.
• AI usage counts — how many clue and theme generations you have used today. Purpose: to apply your plan's fair-use limit.
• Billing — if you become a Supporter, Stripe takes the payment and we store only your subscription status and Stripe customer reference. We never see or hold your card number.

Our lawful bases are performance of a contract (running your account and puzzles) and our legitimate interests (keeping the site working, secure and financially viable), except for advertising and analytics cookies, which rely on your consent.

Email, and the two separate consents

Giving us an email address is entirely optional. We ask once, on the screen after you publish a puzzle, and never during sign-up. Publishing, solving and sharing all work exactly the same if you skip it. We store the address against your account id on our recovery record — not on your public profile — and it never becomes your sign-in identity: the access code and PIN stay as they are.

Nothing is sent to an unconfirmed address. We send one email containing a confirmation link. Until you click it, the address sits unused, and if you never click it, nothing further is ever sent.

• Service email — sending you your access code when you ask for it, and telling you when someone solves a puzzle you made (batched to at most one email per puzzle per day). Lawful basis: performance of a contract, and our legitimate interest in telling you about activity on your own puzzles. This is not marketing and carries no marketing content.
• Puzzleable news — occasional messages about new features, occasion packs and seasonal prompts. Lawful basis: your consent. The box is separate, never pre-ticked, and we record the date and time you ticked it. Every one of these emails carries an unsubscribe link.

Withdrawing. You can untick the news consent at any time in your dashboard or by using the unsubscribe link, which stops promotional email while leaving service email working. You can also delete the address outright from your dashboard, which removes it and both consent records — after that we hold no way of contacting you, and code recovery by email stops working. Either choice is free and takes effect immediately.

We keep the address for as long as the account exists, and delete it when you remove it or the account is deleted. We never sell it, and we never pass it to anyone other than the email delivery provider that carries the message.

Cookies and similar technology

Necessary storage keeps you signed in, remembers your theme choice and remembers your advertising choice. It cannot be turned off without breaking the site, and it is not used to track you across other sites.

Advertising and analytics. Free accounts see adverts supplied by Google AdSense, which pay for the site. Google and its partners may set cookies or use device identifiers to serve and measure adverts. By default adverts are served in non-personalised mode, which does not use your browsing history to target them. They become personalised only if you choose "Agree to ads" on the consent banner shown to UK and EU visitors, and you can change your mind at any time. Google's own controls are at policies.google.com/technologies/partner-sites.

Supporters, and creators who qualify for free ad-free access, see no adverts at all — on those accounts advert requests are switched off entirely.

Who processes your data

We use a small number of named processors, each under contract and only for the purpose listed:

• Supabase — database and authentication hosting; stores your account, puzzle and play data.
• Lovable — the platform the site is built and hosted on, including basic usage analytics.
• Sentry — receives technical error reports so faults can be diagnosed.
• Google AdSense — serves and measures the adverts shown on free accounts.
• Stripe — takes and manages Supporter payments.
• OpenAI — generates suggested clues and themes; it receives the words or theme you submit for that request.

Some of these process data outside the UK. Where they do, transfers rely on the UK International Data Transfer Addendum or the equivalent standard contractual clauses. We do not sell your data.

How long we keep it

• Account, puzzle and play data — kept for as long as the account exists, because the account is the only way your puzzles stay reachable. Ask us to delete it and we remove it, normally within 30 days.
• Error reports — retained by Sentry for 90 days, then deleted automatically.
• Analytics — held in aggregate, with no access-code-level profile kept.
• Billing records — kept for six years after the end of the relevant financial year, as UK tax law requires.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, restrict how we use it, object to processing based on our legitimate interests, and withdraw consent to advertising cookies at any time. Email admin@puzzle-builder.com and we will respond within one month.

One practical limit. Because we hold no email address, we cannot connect an incoming email to an account by itself. To act on a request about a specific account or puzzle we need the access code, or the share code or link of the puzzle in question. Without one of those we have no safe way to identify your data — and no way to be sure we are not handing someone else's puzzles to the wrong person.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline on 0303 123 1113.

Children

Puzzleable is intended for adults and is not aimed at children under 13. We do not knowingly collect data from under-13s, and there is nothing on the site that asks for a date of birth. If you believe a child under 13 has created an account, email us and we will delete it.

Changes to this policy

We update this policy when what we do changes; the date at the top shows the current version. This policy describes our actual practice and has not been reviewed by a solicitor.