Privacy policy
Last updated: 2 November 2026. The French version prevails in case of disagreement.
In short
- Puzclic only collects what is needed to play. No ads, no analytics, no data selling.
- Other players see your username, country, avatar and scores. Never your email.
- You can download all your data and delete your account yourself from your profile.
Controller: [First Last name], publisher of Puzclic (see legal notice), [[email protected]].
The data, one by one
Account
- Data
- Email, password (never stored in clear: only an encrypted hash), username, country, language, sign-up date, accepted terms version and date
- Why
- Create and secure your account, show your country ranking
- Legal basis
- Contract
- Retention
- Until you delete your account, or 3 years without a visit (warning email one month before)
Activity
- Data
- Day of your last visit
- Why
- Delete inactive accounts
- Legal basis
- Legitimate interest (limit retention)
- Retention
- With the account
Game
- Data
- Pieces revealed, guesses, points, start and end times, streak, friends, leagues
- Why
- Run the game, rankings and leagues
- Legal basis
- Contract
- Retention
- With the account
Anti-cheat
- Data
- “To review” mark and its reason
- Why
- Keep rankings fair
- Legal basis
- Legitimate interest
- Retention
- With the account
Puzclic+
- Data
- Stripe customer ID, plan, start and end dates, cancellation, reminder sent, chosen avatar
- Why
- Manage the subscription and legal duties (reminder, cancellation)
- Legal basis
- Contract and legal obligation
- Retention
- With the account; accounting records 10 years (French Commercial Code)
Payment
- Data
- Card, billing address, payment history
- Why
- Charge, refund, prevent fraud
- Legal basis
- Contract and legal obligation
- Retention
- Handled by Stripe, never by Puzclic
Notifications
- Data
- Push subscription ID of your device
- Why
- Send the daily alert
- Legal basis
- Consent (“Turn on notifications” button)
- Retention
- Until you turn them off
Emails
- Data
- Email address, content of service emails
- Why
- Confirm your account, password reset, subscription confirmations, mandatory reminders
- Legal basis
- Contract and legal obligation
- Retention
- Sending logs kept a few weeks by Resend
Technical
- Data
- IP address, browser type, login date and time
- Why
- Security, fighting bots and attacks
- Legal basis
- Legitimate interest
- Retention
- Short-lived security logs (Supabase, Cloudflare)
Statistics
- Data
- Totals computed from the data above (number of players, games, subscribers…), with no names
- Why
- Run the game: picture difficulty, attendance
- Legal basis
- Legitimate interest
- Retention
- Computed on demand, nothing extra stored
Contact
- Data
- Your message and email address
- Why
- Reply, handle a report or request
- Legal basis
- Legitimate interest or legal obligation
- Retention
- While handling the request, then 1 year
Who can access it
The publisher and, only to run the service, its processors: Supabase (database and accounts, servers in the EU), Cloudflare (website hosting, security and Turnstile anti-bot), Stripe (payments; Stripe is also a controller for its own duties such as fraud prevention), Resend (emails), OneSignal (notifications, only if you turn them on). Some are located in, or give access from, the United States: these transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses.
Data may also be disclosed to authorities that lawfully request it.
Automated decisions
An automated check spots improbable results and temporarily removes the account from public rankings. This has no legal effect and is always reviewed by a person; you can contest it by writing to the publisher (see the terms of use).
Security
Encrypted connections (HTTPS), hashed passwords, data access only through controlled functions, login rate limiting and anti-bot checks, admin access restricted to the publisher.
Your rights
You can ask for access, correction, erasure, restriction and portability of your data, and object to processing based on legitimate interest. You can withdraw consent to notifications at any time. You can also leave instructions about your data after your death (French law).
- Self-service: profile → “Download my data” (full file) and “Delete my account”.
- By email: [[email protected]]. Reply within one month. Proof of identity may be requested if in doubt.
- Complaints: your data protection authority; in France the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr.
Minors
Puzclic is for players aged 15 and over. Under 15, a parent's permission is required; a parent can ask at any time for their child's account to be deleted through the Contact page.
Cookies and storage
See the cookie policy: only necessary storage, so no consent banner.
Changes
If this policy changes significantly, players are told in the game or by email.