Privacy Policy

Effective October 5, 2026

Who runs Puzz

Puzz is made and run by Noah Sanz, an individual based in Georgia, USA, who is responsible for the data described here (the "data controller", in GDPR terms). "We" and "us" on this page mean Noah. You can reach us using the contact details at the bottom of this page.

What we collect

The first time you open Puzz, your browser generates a random identifier (a "uid") and a matching secret token, and stores both in your browser's local storage (Puzz doesn't use cookies). Nothing about either one identifies you personally — they're just random strings your device made up. From then on, our server (a small Cloudflare Worker) associates a few things with that identifier:

• Daily results — which daily puzzles you've completed and how long they took, kept for 3 days so the app can show "already played today" and a same-day leaderboard.
• Streaks — a running count of consecutive days played per game, kept indefinitely (deleting it after a few days would break the whole point of a streak).
• A profile — a display name, if you choose to set one, plus two short codes: a public ID (for friends to add you) and a private "link code" (for linking a second device to the same identity). None of this requires your real name. Your display name is visible to anyone who has your public ID or anonymous identifier (for example, friends you share them with), so don't use anything you'd want kept private.
• A friends list — the identifiers and nicknames of players you've added, so a "friends leaderboard" can work across your devices. This is stored the same way as everything else: attached to your anonymous ID, not to you.
• Error reports — if a game hits an unexpected error, it sends us the error message, technical details about where in the code it happened, and the address of the page you were on (which can include your anonymous ID). These are kept for 7 days and used only to find and fix bugs.

Like any web service, our hosting provider (Cloudflare) briefly processes standard connection metadata — such as your IP address — to deliver requests and protect against abuse. Our own server uses your IP address in just one way: a short-lived counter, deleted within about an hour, that limits how many requests can come from one address. It isn't attached to your Puzz identity or kept anywhere else.

What we don't collect

• No email address or phone number, and we never ask for your real name
• No password (there's nothing to log into)
• No location data
• No payment or financial information
• No advertising identifiers, and no data sold or shared with advertisers
• No third-party analytics or tracking scripts

Multiple devices

If you want your progress, name, and friends list to follow you to a second device, Profile → Link Device gives you a private "link code" to enter there. Anyone who has that code can link a device to your identity, so treat it like a password and only share it with a device you actually own.

Deleting your data

Profile → Link Device → Disconnect clears everything Puzz stores on that device and starts it fresh. At the moment this only removes the copy on your device — the anonymous record on our server isn't deleted, just orphaned (no device can reach it again unless you saved its link code first). If you'd like that record deleted outright, contact us below and we'll remove it by identifier.

Your rights

Wherever you live, you can ask us to:

• tell you what data we hold about your Puzz identity and send you a copy of it
• correct it (for example, your display name)
• delete it

Depending on where you live (for example, the EU or UK under the GDPR, or California under the CCPA), you may also have the right to object to or restrict how we use it, and to complain to your local data protection authority. We don't sell or share personal information, and we don't use it for advertising or profiling.

To make a request, contact us with your Account ID (shown under Profile → Add Friend). Because an Account ID isn't secret, we may ask for your link code to confirm the identity is yours before changing or deleting anything. We'll respond within 30 days.

Why we use your data, and where it's stored

We use the data above only to run Puzz — showing your results, streaks and friends, keeping them in sync across your devices, fixing bugs, and preventing abuse. Under the GDPR, that's our legitimate interest in providing the games you chose to play. Everything is stored and processed by Cloudflare, our hosting provider, on its global network, which means it may be handled in the United States and other countries.

Children's privacy

Puzz doesn't ask anyone, including children, for personal information: there's no signup, and we never ask for a real name, age, or contact details. The only free-text field is the optional display name. If you believe a child has entered personal information there, contact us and we'll delete it.

Changes to this policy

If this policy changes — for example, if we ever add analytics, ads, or an account system — we'll update this page and its effective date above.

Contact

Questions, or want your data deleted? TBD