Privacy Policy

Sudoku Academy is a sudoku puzzle site. We collect the bare minimum needed to run your account, save your progress, and process subscriptions. We do not sell your data. You can delete your account and everything tied to it at any time from the Dashboard.

• Account: username, optional email, hashed password.
• Gameplay: puzzles played, times, hints used, streaks, leaderboard entries.
• Subscription state: whether you're on Free or Premium, and Stripe's customer & subscription IDs.
• Technical: IP address, browser type, and request logs (for security & abuse prevention).
• Optional social sign-in identifiers: Google sub or Apple sub if you sign in with those providers.

We do not collect location, contacts, biometric data, health data, or advertising identifiers. There are no ads in the app today.

• Signing you in and keeping you signed in (HttpOnly cookies).
• Saving your streaks, stats, and leaderboard position.
• Processing your Premium subscription through Stripe.
• Sending you password-reset emails via Resend when you request them.
• Detecting abuse, brute-force logins, and puzzle-generation exploits.

• Stripe — processes your Premium subscription. Stripe sees your name, email, card details, and country. We never see or store your card. See Stripe's privacy policy.
• Google Sign-In — if you use it, Google shares your Google ID, email, and display name with us.
• Sign in with Apple — if you use it, Apple shares a stable ID and (optionally) a private-relay email.
• Resend — delivers transactional email (password reset). Resend sees the destination email address and the message body.
• Google Analytics 4 — aggregate, anonymized (anonymize_ip) usage analytics. No cross-site tracking.
• Microsoft Clarity — session recordings and heatmaps used to improve UX. Recordings are stripped of form inputs by default.
• PostHog — product analytics for identified users only. No anonymous person profiles are created.

We use two kinds of cookies:

• Essential (HttpOnly): access_token and refresh_token for keeping you signed in. These are SameSite=None; Secure to allow the app to work under both the default host and the custom domain.
• Analytics: Google Analytics, Clarity, and PostHog set their own cookies. You can block these in your browser settings without breaking the game.

We keep your account and gameplay data until you delete your account or ask us to. Deleted-account data is purged immediately from our primary database; backup snapshots roll off within 30 days. Anonymous aggregate stats (e.g. "how many people solved Level 7 this week") may be retained indefinitely.

You can, at any time:

• Delete your account from Dashboard → Danger Zone — this removes your user record, sessions, stats, streaks, leaderboard entries, referrals, and subscription reference.
• Export your gameplay data — email us atprivacy@sudokuacademy.org and we'll send you a JSON dump within 30 days.
• Ask us to correct anything — same email.

Sudoku Academy is intended for ages 13+. We don't knowingly collect data from children under 13. If you believe a child has created an account, emailprivacy@sudokuacademy.org and we'll delete it.

If we make a material change, we'll update the "Last updated" date at the top and — if you have an account with an email on file — send you a notice. Continued use of the app after a change constitutes acceptance.

Questions? privacy@sudokuacademy.org