Privacy Policy

Last updated: 2026-07-11

1. Who we are

PuzzleArena (Your street, 1000 City, Belgium) is the data controller for your personal data processed on this site. Contact: privacy@puzzlearena.games.

2. What we collect

• Account data: email address, username, display name, password hash (never the password itself), profile avatar URL.
• Gameplay data: sessions, solve times, moves, hints used, XP transactions, achievements, streak history.
• Social graph (Phase 2): friend links and challenges between users.
• Technical data: IP address processed for rate-limiting only, stored in Upstash Redis with a 24-hour expiry. Never logged persistently or sold.

3. Legal basis

• Contract performance (Art. 6(1)(b) GDPR): account and gameplay data needed to run the service you signed up for.
• Legitimate interest (Art. 6(1)(f) GDPR): rate-limiting and abuse prevention.
• Consent (Art. 6(1)(a) GDPR): optional analytics and marketing emails, opt-in only.

4. Retention

Account data is kept until you request deletion. When you request deletion, it is hard-deleted after a 30-day grace period. Session tokens expire 30 days after creation. Rate-limiting keys expire 24 hours after the last request.

5. Third-party processors

• Neon (US) — managed PostgreSQL. SCCs apply.
• Vercel (US) — hosting and edge delivery. SCCs apply.
• Upstash (US) — rate-limiting cache (Redis) and scheduler (QStash). SCCs apply.
• Brevo (EU) — transactional email delivery. EU-based, no transfer required.

6. Your rights

You can:

• Access and port: download your full data as JSON from Settings → Data.
• Rectify: update your profile from Settings.
• Erase: request deletion from Settings → Data. 30-day grace period, then permanent removal.
• Withdraw consent: toggle notification preferences in Settings at any time.
• Complain: lodge a complaint with your local data protection authority (in Belgium: Autorité de protection des données).

7. Cookies

We use only two cookies by default: a session cookie (HttpOnly, Secure, SameSite=Strict) for sign-in, and a CSRF token. Analytics cookies are off unless you opt in via the cookie banner. We do not use tracking pixels.

8. Minors

PuzzleArena is intended for users 13 and older. You confirmed your age at registration. If you are a parent and believe a child under 13 has registered, contact us at privacy@puzzlearena.games and we will delete the account immediately.

9. Security

Passwords are hashed with bcrypt (12 rounds). All traffic is served over HTTPS. Data is encrypted at rest by our processors. We never sell or share your data for advertising.

10. Changes

We will update this policy as the service evolves. We'll notify you by email of material changes.