1. Who is responsible
The Service is operated under the name Puzzles Almanac. For anything privacy-related — questions, requests, complaints — contact [email protected]. This policy covers the puzzlesalmanac.com website, the pzzl.ist short-link domain, and our iOS and Android applications (together, the “Service”).
2. What we collect
Account data. Your email address (and an optional backup email), a display name if you set one, your preferred language, and your account tier. Sign-in uses one-time email codes — we never store a password.
Content you create. Word lists, clues, puzzle projects, suggested themes, and feedback messages you send us.
Activity data. Which puzzles you have solved (for streaks and archives), your saved preferences such as text size, and — if you entered or scanned a book code — which book brought you to the site and how you arrived (this is stored once, when you first sign in, and used to group readers by book).
Licence details. If you unlock a printable pack with a code from one of our books, we store the name you ask the licence to be issued to, the code you used, and the licence number. The name is kept as it was at the moment the licence was issued — editing your account later does not change an issued licence — and we keep a copy on your account only to fill the form in for you next time.
Country. The country an account signs in from, as a two-letter code — nothing finer than that. We work it out on our servers from the IP address of the request and store it on your account; if it is still empty on a later visit we try once more. We never ask your device where it is, and our apps never send a location. It tells us which countries our players are in; it is not used to target anything at you.
Sign-up platform. Whether an account was created on our website or in our iOS or Android app — one of three words, and nothing about your device beyond that. We store it on your account to see which platforms our players use. It is not a device identifier and cannot be used to recognise your device.
Technical data. Standard server logs (IP address, browser type, pages requested) kept briefly for security and debugging, and aggregate usage statistics via Google Analytics (see the Cookie Policy). To resolve the country described above, the IP address of a request is sent to an external geo-IP service, which returns a country code and nothing else — see section 6.
3. Playing without an account
Our mobile apps are fully playable without signing up. To make that work, the app creates a random identifier for itself the first time it runs — an installation identifier. It is generated on your device, belongs to that one installation of that one app, and is not an advertising identifier.
The app sends that identifier to us to open a guest session, along with the platform, the app version and the device language. We store it and issue a session that lasts 30 days. The cases you open and the progress you make as a guest are attached to that session — that is what lets you close the app and come back to an unfinished puzzle.
It is never used to track you, on this Service or anywhere else, and it is never combined with data from other apps or companies. If you later sign in, your guest progress is moved onto your account and the guest session is closed. Deleting and reinstalling the app produces a new identifier and starts over.
4. How we use it
- To provide the Service: sign you in, save your projects, remember your preferences, track solved puzzles and daily limits.
- To send transactional email: sign-in codes and account notices (email changes, deletion confirmations).
- To send an occasional newsletter and new-book announcements, if you have an account. Every such email includes an unsubscribe link, and unsubscribing never affects your access to the Service.
- To understand how the Service is used in aggregate (analytics) and to improve it.
- To keep the Service secure and prevent abuse.
Where GDPR applies, our legal bases are: performance of our contract with you (providing the Service), our legitimate interests (security, analytics, improving the Service, and telling existing users about our books), and your consent where we ask for it. You can object to marketing at any time via the unsubscribe link or by emailing us.
5. What we never do
- We do not sell or rent your personal information — to anyone, ever.
- We do not show third-party advertising or share your data with ad networks.
- We do not send daily marketing email — at most a weekly touchpoint, always with an unsubscribe link.
6. Who we share data with
Only service providers that help us run the Service, and only what they need for that job:
- Hosting and database providers that run the website and store its data.
- Backblaze (cloud file storage) for generated and uploaded files such as PDFs.
- Email delivery providers to send sign-in codes and newsletters.
- Google Analytics for aggregate traffic statistics — the only third-party analytics/cookie service we use (details in the Cookie Policy).
- ip-api.com (geo-IP lookup), which receives the IP address of a request when we need to resolve the country for an account, and returns a country code. We send it nothing else — not your email address, not your account, not anything you have created.
- Telegram, used internally to notify our own administrators of events like a new sign-up or a feedback message; these notifications can include your email address and message text and are visible only to our admins.
Beyond that, we disclose personal data only if the law requires it, or to protect the Service and its users. Data may be processed in the United States and other countries; where required, we rely on appropriate safeguards for such transfers.
7. Cookies
We use a small set of cookies: essential ones (your sign-in session, daily puzzle limits), preference ones (text size, a book code you entered), and Google Analytics. The full list, with lifetimes and purposes, is in the Cookie Policy.
8. How long we keep data
Account data and your content are kept for as long as your account exists.
When you delete your account — from Account Settings on the website, or from Settings in the app; both do exactly the same thing — we remove, in one operation: your puzzle progress, the record of which cases you opened, the record of which days you played, your account itself with everything attached to it (your email addresses, display name, preferences, projects, saved country and any printable licence issued to you), and any unused sign-in codes sent to your email address. Content you had made public is removed, and themes and tags you suggested are de-linked from you and kept without any connection to you. Deletion is immediate and cannot be undone; copies persist only in backups until those age out on their fixed schedule.
A guest session in the app stops working 30 days after it was last used, and the app starts a new one the next time you play. The identifier and the guest progress attached to an old session are not deleted automatically — they stay in our database until we remove them. If you have played as a guest and want that data deleted, write to [email protected] and we will delete it. Server logs and backups age out on short, fixed schedules.
9. Your rights
Wherever you live, you can access, correct, or delete your data — most of it directly from your dashboard, and the rest by emailing [email protected]. We answer within 30 days.
If you are in the EU/EEA or UK (GDPR): you have the rights of access, rectification, erasure, restriction, data portability, and objection, and the right to lodge a complaint with your local supervisory authority.
If you are a California resident (CCPA/CPRA): you have the right to know what personal information we collect, to delete it, and to non-discrimination for exercising those rights. We do not sell or share personal information as those terms are defined in the CCPA, so there is nothing to opt out of.
10. Children
Accounts require a minimum age of 13, and we do not knowingly collect personal information from children under 13. Public puzzles can be enjoyed by all ages without an account. If you believe a child under 13 has created an account, contact us and we will delete it.
11. Mobile applications
Our iOS and Android apps collect the information necessary to run the game: your email address, if you choose to sign in; the installation identifier described in section 3, if you play as a guest; the country and the sign-up platform described in section 2; and your puzzle progress (found words, entered deduction answers, and solved status).
Puzzle progress is used to save and resume your game sessions across launches, and in aggregate to monitor puzzle-pool consumption and plan upcoming cases. Gameplay data is processed by us and the necessary infrastructure service providers described in section 6; it is never sent to ip-api.com, advertising networks, or tracking providers.
The apps contain no advertising SDKs and no third-party analytics SDKs. They never ask for your precise location, your contacts, your photos or your microphone. Platform operators (Apple and Google) may collect standard diagnostic metrics under their own privacy policies.
Guest gameplay data can be deleted upon request by emailing [email protected]. Registered members can delete their account from Account Settings on the website or by emailing [email protected]. Current Android releases operate in anonymous guest mode and do not implement in-app account creation.
12. Security
Data is encrypted in transit, sign-in codes expire in minutes, and administrative access is restricted to a small number of named administrators. No online service can promise perfect security, but we keep the surface small: no passwords stored, no payment data handled, no data resold.
13. Changes and contact
When this policy changes materially, we update the effective date above and, for significant changes, give notice on the site or by email. Questions or requests: [email protected].