Privacy Policy
Last updated: 20 September 2026.
This policy explains what personal data Sudoku Flags collects, why, who sees it, how long we keep it and what rights you have. It covers sudokuflags.com and the services on it: the games, rankings, accounts, printable puzzles, the launch list and the feedback form.
Who is responsible
The controller of your personal data is SIA STRAUME AG ("we", "us"), a limited liability company registered in Latvia, registration number 40203488120, registered address Rīga, LV-1039, Latvia. To ask a question or use one of your rights, write to us through the feedback form or by email at sudokuflags@gmail.com. Cookies and similar browser storage are covered in the Cookie Policy, and the rules for using the site are in the Terms of Use.
What we collect
What you give us
- Account. Email address, password, first and last name, the country (flag) you play for, your nickname and your interface language. Our sign-in provider stores your password only as a hash, so we cannot read it.
- Profile. A profile picture if one is set (for example the picture from your Google or Apple account), and any changes you make to your details or country.
- Launch list. If you pre-register: email address, first and last name, country and language.
- Feedback. Your name, email address, message and any file you attach (PNG, JPEG, HEIC or PDF) when you write to us through the feedback form.
- Subscription. Your plan, its status and its dates. Paid subscriptions are not open yet. When they open, payments will go through Stripe, and we will receive transaction records, not your card number.
What is created when you use the site
- Finished games. When you solve a game, we save the mode, difficulty, score, time, points per flag, whether it counted for rankings, the result of our fair-play check and the date. If you are signed in, the result is linked to your account and the country you play for. If you are not, it is saved without your identity.
- Moves. When a game ends, the sequence of your moves is sent to our server so we can recalculate and verify the score. We do not keep the moves afterwards.
- Status. Your monthly points, status tier and the history of both.
- Printable puzzles. Each time you open a printable PDF we log the settings you chose (language, type, difficulty, number of puzzles, paper size, whether answers were included) and whether you had Premium. If you are signed in, the entry is linked to your account.
What we collect automatically
- Technical data. Your IP address and browser details reach our servers and our hosting provider, Vercel, with every request and appear in their security and error logs.
- Approximate location. Our hosting provider tells us which country your IP address belongs to. We use it on the spot to pre-select the country in the site header, and we do not store it unless you pick a country yourself.
- Abuse protection. To stop spam and guessing attacks, short-lived counters tied to your IP address (or, for password resets, to the email address) limit how often a form or sign-in can be used. They expire within 15 minutes.
- Browser storage. Small entries kept in your browser, listed in the Cookie Policy.
What other companies send us
If you sign in with Google or Apple, that company shares your name, email address and, if available, profile picture with us. We never receive your password for those accounts.
What we use it for and why
| Purpose | Legal basis | Data used |
|---|---|---|
| Creating and running your account, signing you in, sending emails such as address confirmation and password reset | Contract | Email address, password hash, name, country, language, nickname |
| Saving results, calculating rankings and status, showing the public player leaderboard | Contract | Nickname, country, finished games, monthly points and status |
| Keeping the game fair: verifying scores, holding suspicious results, dealing with cheating | Legitimate interests (an honest game and honest rankings) | Finished games, moves during verification, account status, technical data |
| Security and abuse prevention | Legitimate interests (keeping the service safe) | IP address, technical data, short-lived counters |
| Pre-selecting your country | Legitimate interests (convenience) | Country derived from your IP address, not stored |
| Answering your messages | Legitimate interests (helping users); contract if you are a user | Name, email address, message, attachment |
| Telling you about the launch | Consent, which you can withdraw at any time | Launch-list details |
| Subscriptions and, when they open, payments | Contract; legal obligation for accounting records | Plan, status, dates, transaction records |
| Understanding how the service is used, for example how often printable puzzles are opened | Legitimate interests (improving the service) | Finished games and printable download logs, in aggregate |
| Meeting legal obligations and handling legal claims | Legal obligation; legitimate interests | Whatever the obligation or claim requires |
What is public
Your nickname, the flag of your country and your status (tier and streak) appear on the public player leaderboard. Flag standings show points per flag only, never individual players. Your real name and email address are never shown to other players. If you prefer not to be recognised, choose a nickname that does not reveal who you are.
Who we share data with
We do not sell personal data. These companies process data for us to run the site:
| Company | What it does for us |
|---|---|
| Vercel | Hosting and delivery of the site. Receives technical request data (IP address, browser details) and keeps security and error logs. |
| Supabase | Database, sign-in (including Google and Apple sign-in) and file storage. Holds accounts, game results and statuses. Its data centre is in Ireland. |
| Upstash | Keeps the short-lived counters that limit how often forms and sign-in can be used. |
| Resend | Sends our emails, such as address confirmation and password reset. |
| Telegram | Delivers messages from the feedback form, with attachments, to our team. |
| Google and Apple | Sign-in, if you choose it. Google Tag Manager also loads on the site; see the Cookie Policy. |
| Stripe | Card payments and subscription billing, once paid subscriptions open. Stripe handles payment details under its own privacy policy; we receive transaction records, not card numbers. |
We may also share data with professional advisers, with authorities when the law requires it, and with a buyer if the business is sold, in which case this policy continues to apply to your data.
Transfers outside the EEA
Our database is in the EU (Ireland). Some of the companies above, such as Vercel, Stripe, Telegram, Resend, Upstash and Google, may process data outside the European Economic Area. Where that happens, we rely on an adequacy decision of the European Commission or on the standard contractual clauses it has approved, together with the provider's data processing terms.
How long we keep it
- Account and game data: while your account exists. When you ask us to delete the account, we delete it, or anonymise what we need for statistics, without undue delay and within one month at the latest.
- Results saved without an account: kept without your identity, for statistics.
- Launch-list details: until we have told you about the launch, or until you ask us to remove them.
- Feedback messages and attachments: as long as we need to deal with your request and a reasonable time afterwards, then we delete them.
- Printable download logs: while they are useful for statistics. If your account is deleted, the link to it is removed.
- Abuse-protection counters: up to 15 minutes.
- Server logs: for the standard, short periods our providers apply.
- Records of a ban for cheating: for as long as needed to keep the ban in force.
- Payment records, once they exist: for five years (60 months) from the transaction date, to meet tax and accounting obligations. They stay even if you delete your account, no longer linked to it, and are deleted when the period ends.
Automated checks
Some fair-play checks are automated. For example, a game with implausibly fast moves is held back from the rankings until it is reviewed. That can affect your points or status. If you think a result was held by mistake, write to us and a person will look at it.
Your rights
Under the GDPR you can ask us to:
- tell you what data we hold about you and give you a copy;
- correct data that is wrong (you can also edit your name, nickname and country yourself in your profile);
- delete your data;
- restrict how we use it;
- give you the data you provided in a common format;
- stop using it where we rely on legitimate interests.
Where we rely on your consent, you can withdraw it at any time; this does not affect what happened before. Write to us through the feedback form and we will answer within one month. We may ask you to confirm that the account is yours before we act. You also have the right to complain to your data protection authority; in Latvia that is the Data State Inspectorate (dvi.gov.lv). If you live outside the EU, the rights your local law gives you apply too.
Age
The Service is intended for people aged 16 and over. We do not knowingly collect data from anyone younger. If you think a child has given us data, tell us and we will delete it.
Security
Connections to the site are encrypted, passwords are stored only as hashes, and access to personal data is limited to the people and systems that need it. No online service can be completely secure, so please use a strong password that you do not use anywhere else.
Advertising and analytics
We do not use your personal data for advertising or analytics at the moment. The site loads Google Tag Manager, set up so that nothing of that kind can run until a consent tool exists. If we add advertising or analytics, we will update this policy and the Cookie Policy first and ask for your consent where the law requires it.
Other websites
The site may link to other websites. Their privacy practices are their own, so please read their policies.
Changes to this policy
When we change this policy we update the date at the top. If a change matters to you, for example a new purpose for your data, we will announce it on the site before it applies.