Privacy Policy

1. Controller and contact

Sudokudle is a free, non-commercial project. For questions about this policy or to exercise your privacy rights, contact the Sudokudle operator at info@sudokudle.com.

2. Scope

This policy covers personal data processed when you use the Sudokudle web service through sudokudle.com, supported third-party platforms, Discord leaderboard features, or role features on the official Sudokudle community server. When you access Sudokudle through Discord, Discord also processes data under the Discord Privacy Policy.

3. Data processed by Sudokudle

Discord identity and context

When you access Sudokudle through Discord, Sudokudle receives your Discord user ID, username, display name, avatar reference, and the guild and channel context from which the service is opened. Discord OAuth credentials are used to authenticate the session and are not stored in the Sudokudle database. Short-lived authentication and launch information may be held temporarily in an operational cache.

Website identity

When you play directly on the website, Sudokudle creates a random pseudonymous player ID. A secret browser credential is stored in your browser's local storage so the same browser can resume games and retain results. Only a cryptographic hash of that credential is stored in the database. You can optionally link the website profile to Discord. In that case, anonymous website progress is merged into the Discord profile and multiple browser credentials can provide access to the same synchronized profile. Discord OAuth access and refresh tokens are used transiently to identify the account and are not retained by Sudokudle. A raw IP address can be processed transiently for network delivery and security, but Sudokudle does not store the raw IP address in its application database.

Daily and training gameplay

Depending on how you use the service, the following data can be stored:

• puzzle and training-puzzle identifiers, difficulty, status, and timestamps;
• current grid values, notes, selected cell, elapsed time, pause state, and recent heartbeat;
• completion time, streak, rank, global percentile, and leaderboard position; and
• achievement progress, including training accomplishments and discovery of hidden features.
• durable profile statistics such as started and completed attempts, active play time, total completed solve time, best times, difficulty, and first and most recent activity dates.

Discord leaderboards and community roles

In Discord server channels, your display name, avatar, completion time, activity status, and rank can be displayed to other people in that channel. Leaderboard reminders can mention eligible players. On the official Sudokudle community server, the bot checks completed daily and training puzzles, solve times, and achievements to assign or remove progression roles. These roles are visible to other server members.

Requests, logs, and service operation

If you contact Sudokudle, your email address, message, and information needed to handle the request are processed. Hosting, security, and infrastructure systems can also process IP addresses, request times, requested paths, response status, browser or device information, and similar technical log data.

4. Purposes and legal bases

• Providing the game and requested Discord features: Article 6(1)(b) GDPR, to provide the service you choose to use, save progress, calculate results, and operate leaderboards and roles.
• Reliable, fair, and secure operation: Article 6(1)(f) GDPR, based on the legitimate interests in preventing abuse, troubleshooting errors, protecting the service, and maintaining fair rankings.
• Aggregate product and performance measurement: Article 6(1)(f) GDPR, based on the legitimate interest in understanding whether Sudokudle works reliably and which features are useful.
• Legal requests and obligations: Article 6(1)(c) GDPR where processing is required by law, and Article 6(1)(f) GDPR where needed to establish, exercise, or defend legal claims.

The browser credential stored in local storage is technically necessary to provide the persistent website game identity and saved progress requested by the user. It is not used for advertising or cross-site tracking.

5. Cloudflare Web Analytics

The public website uses Cloudflare Web Analytics to obtain aggregate page-view and performance information. According to Cloudflare, this analytics product does not use cookies or local storage, does not fingerprint visitors for analytics, and discards the source IP address at Cloudflare's edge instead of storing it in its analytics databases. Sudokudle uses these aggregate insights to monitor reach and technical performance, not to build advertising profiles.

6. Recipients and service providers

Data is disclosed only where necessary to operate Sudokudle or where required by law. Recipient categories are:

• Discord, when you authenticate through Discord or use Discord messages, leaderboards, presence, or roles;
• content-delivery, network-security, and cookie-free analytics providers;
• hosting, database, email, infrastructure, and internal monitoring providers; and
• public authorities or professional advisers where disclosure is legally required or necessary for legal claims.

Sudokudle does not sell personal data and does not disclose it for behavioural advertising.

7. International data transfers

Some providers, including Discord and Cloudflare, operate internationally and may process data outside the European Economic Area. Where required, transfers rely on an applicable adequacy decision, such as the EU–US Data Privacy Framework for certified recipients, or on safeguards such as the European Commission's Standard Contractual Clauses. You can ask for further information using the contact address above.

8. Retention

• Short-lived Discord authentication cache entries expire after approximately five minutes.
• Discord service launch credentials used for message updates expire after approximately fourteen minutes.
• Unfinished daily sessions are deleted after they have remained inactive for 48 hours.
• Core profile, completion, leaderboard, training, and achievement records are retained while needed to provide history, rankings, role progression, and aggregate statistics. They are deleted when a valid deletion request is fulfilled or when continued storage is no longer necessary, subject to legal duties.
• Support correspondence and technical logs are retained only as long as reasonably necessary for the request, security, troubleshooting, legal obligations, or legal claims. Provider-controlled records follow the relevant provider's retention rules.

Clearing the website's local storage removes your browser credential from that browser and prevents access to the associated history, but does not by itself delete the server-side pseudonymous records. Logging out of a Discord-linked website profile similarly removes only that browser's access and does not delete the profile. Contact info@sudokudle.com if you want to exercise a privacy right.

9. Your rights

Subject to the conditions of the GDPR, you may request:

• access to and a copy of your personal data;
• correction of inaccurate data;
• deletion or restriction of processing;
• data portability for data covered by that right; and
• withdrawal of consent for any processing based on consent, without affecting earlier processing.

You may object at any time to processing based on Article 6(1)(f) GDPR for reasons arising from your particular situation. You also have the right to lodge a complaint with a data-protection supervisory authority, particularly in the EU country of your habitual residence, place of work, or the alleged infringement.

Sudokudle does not make decisions producing legal or similarly significant effects through automated decision-making or profiling.

10. Security

Sudokudle uses measures intended to protect data against unauthorised access, alteration, loss, and misuse, including encrypted transport, restricted administrative access, pseudonymous website identifiers, and hashed browser credentials. No internet service can guarantee absolute security.

11. Changes to this policy

This policy may be updated when the service, providers, or legal requirements change. The effective date above identifies the current version.