Privacy Policy

This Privacy Notice for Cypher ("we," "us," or "our") describes how and why we collect, store, use, and share ("process") your personal information when you use our services ("Services"), including when you visit our website at cypherpuzzle.com.

Cypher is operated by an individual based in Portugal, who acts as the data controller for the purposes of the GDPR.

If you do not agree with our policies and practices, please do not use our Services. If you have any questions, you can use the report a bug button in the footer, or contact us directly at pedrobpmascarenhas@gmail.com.

1. What Information Do We Collect?

Information you provide through Google sign-in: Cypher has no passwords of its own. When you sign in with Google (Google OAuth), we receive and store:

• Your name
• Your email address, and whether Google has verified it
• Your Google profile picture, if you have one
• Authentication tokens issued by Google that let us keep you signed in

Information we create as you play: Once you have an account, we store gameplay data linked to it, including:

• Your current streak, your longest streak, and the date you last played
• A per-puzzle history: how long you took, how many hints you used, whether you solved it, and which letters you revealed

Information collected automatically: We use Vercel Analytics to understand general site performance. This data is aggregated and privacy-friendly — it does not use cookies and does not identify you personally. It includes general technical details such as page views and broad device or browser type.

Where this data lives: Your account and gameplay data are stored in our database, hosted by Neon in the European Union (Frankfurt). Your browser also keeps a local copy of your active game progress (in local storage) so the game loads instantly. That local copy is a cache: it holds only game data, never your identity or login credentials.

2. How Do We Process Your Information?

We process your personal information for the following core reasons:

• To facilitate account creation and authentication. We use your Google account data and the associated tokens to log you in and maintain your session.
• To save your progress. We use your account to track your puzzle statistics, streaks, and game history.
• To operate, secure, and improve the game. We analyze general usage data to fix bugs and optimize the experience.

Our legal bases (GDPR):

• Performance of a contract (Art. 6(1)(b)) — to create your account, authenticate you, and save your progress so we can provide the game you asked for.
• Legitimate interests (Art. 6(1)(f)) — to keep the Services secure and working and to understand general usage so we can improve them.

3. Cookies, Local Storage & Analytics

Because we do not run advertising, our use of cookies is minimal and strictly functional. We use essential cookies and session data to keep you logged into your account, and local storage to securely cache your active game progress directly on your device.

For analytics we use Vercel Analytics, which is cookieless and does not collect personally identifiable information. Because it sets no non-essential cookies and does not track you across sites, no cookie consent banner is required. We do not run third-party advertising or ad-tracking cookies.

4. When Do We Share Your Information?

We do not sell, rent, or trade your personal information. We share it only with the service providers that run Cypher: Google (sign-in), Vercel (hosting and analytics), and Neon (database hosting). These providers process data on our behalf to keep the Services running.

Our database is hosted in the EU (Frankfurt). However, Google and Vercel are based in the United States, so some processing may take place outside the EEA. Where that happens, those transfers are covered by appropriate safeguards such as the EU–U.S. Data Privacy Framework or Standard Contractual Clauses.

5. How Long Do We Keep Your Information?

We keep your account and gameplay data for as long as your account is active. If you delete your account, all of it is removed from our database immediately (see Section 6). When we have no ongoing legitimate need to process your information, we delete it.

6. What Are Your Privacy Rights?

Under the General Data Protection Regulation (GDPR), you have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing.

Account Deletion: You can delete your account yourself at any time from your profile settings on cypherpuzzle.com. Deletion is immediate and permanent: it removes your account, your sign-in tokens and sessions, and your entire gameplay history from our database.

For any other request, contact us at pedrobpmascarenhas@gmail.com. You also have the right to lodge a complaint with your local data protection authority — in Portugal, the Comissão Nacional de Proteção de Dados (CNPD).