Privacy policy

Who is responsible

The operator below is responsible for personal data processed through Deductidle:

Playing without an account

When you test an example, request a hint, check answers or reveal a rule, the browser sends the relevant puzzle information to our server. This can include the day, stage, category, examples you tested and your answer choices. The server uses it to run the game and return a result. Please enter puzzle examples rather than personal or sensitive information.

You can play without an account. Guest progress stays in your browser and is not kept as a server-side player history. Where the GDPR applies, processing needed to provide and secure the game is based on our legitimate interests under Article 6(1)(f).

Optional accounts and synced progress

If you create an account, we process an internal user ID, your verified email address, account and session records, and the daily progress you choose to sync. With Google sign-in, Google supplies its account ID and may supply your name and profile picture through the basic openid, email and profile scopes. Google access, refresh and ID tokens are discarded before account storage. We retain the Google account link, email and verification status, display name or profile image, and authorization scope needed to identify the account. We do not request access to your contacts, Drive files or other Google services.

We use this information to sign you in, isolate your saves, merge guest progress and sync your progress and streak between devices. Providing it is optional; the account service is performed at your request under Article 6(1)(b) GDPR. The account database is configured in Cloudflare D1's European Union jurisdiction. Synced progress and account records remain until you delete the account, subject to any records we must retain by law. You can download your progress or permanently delete the account on the Account page.

Sign-in security and email delivery

A sign-in session uses a necessary secure cookie and expires after 30 days. Session records can include IP address and browser information for authentication and abuse prevention. The browser also remembers the last active account ID so it can keep each account's local cache separate.

Email sign-in sends a six-digit code through Resend to the address you enter. Codes expire after 10 minutes, are stored only in hashed form and have limited attempts. Rate-limit records help prevent repeated requests. Resend processes the destination address, message and delivery data as our email service provider; see Resend's Privacy Policy and Data Processing Addendum. Google processes Google sign-in under its Privacy Policy. These providers may process data outside the EEA using the safeguards described in their terms.

Browser storage and cookies

The game uses local storage to remember daily stages, examples and answers, tries, strikes, hints, results, theme, sound setting and whether you dismissed the introduction. Signed-in progress is also cached locally so play can continue when syncing is unavailable. Practice rounds are not saved as daily progress.

These entries use names beginning with deductidle.. They have no automatic expiry and remain until you clear this site's data, your browser removes them, you delete your account, or a future version replaces them. Signing out does not erase that account's local cache.

The application does not set advertising or analytics cookies. Cloudflare may use necessary security cookies when protecting the site; see its cookie information. To remove local saves and preferences, clear stored site data for deductidle.com.

Hosting and technical requests

Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, hosts and protects this website. It processes information such as your IP address, requested URL, request time, browser and device headers, and the data needed to handle a game request. Delivery, reliability and protection against abuse are our legitimate interests under Article 6(1)(f) GDPR.

Cloudflare operates a global network, so processing may take place outside the European Economic Area, including in the United States. Cloudflare describes its processing, retention criteria and international transfer safeguards in its Privacy Policy and Data Processing Addendum, including standard contractual clauses where applicable. Technical and security records may be retained for service operation, investigating abuse and meeting legal obligations; their retention depends on the service and purpose.

Contact and sharing

If you contact the operator, your email address and message are used to handle your request. This is based on our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR), or Article 6(1)(b) when needed for a contract-related request. Correspondence is retained while needed to resolve the enquiry and any related legal obligations or claims.

Email sent to contact@deductidle.com passes through Cloudflare Email Routing and is delivered to the operator's Gmail inbox. Cloudflare and Google process the message and associated delivery information to provide these services. Google explains its processing, retention and international transfers in its Privacy Policy.

Sharing a result is your choice. The Share result button copies text to your clipboard; Save image downloads an image to your device. Pasting or uploading the result elsewhere shares it with the destination you choose. That destination's own privacy rules apply.

Your rights

Where the GDPR applies, you can request access, correction, erasure, restriction of processing and, where applicable, data portability. You can object to processing based on legitimate interests for reasons relating to your situation. Contact the operator above to make a request.

You may complain to a data protection authority, particularly in the country where you live, work or believe an infringement occurred. The European Data Protection Board maintains a directory of supervisory authorities.

We do not use your data for decisions with legal or similarly significant effects, or for advertising profiles. You do not need to provide an account identity to play; the technical requests described above are needed to deliver and evaluate the game.