Privacy Policy

Last updated: 11 September 2026

Sudoku Chaos is a small, free puzzle site. It uses no analytics and no third-party trackers, and it asks for no personal details — not even an email address. The one third-party exception is a single advertisement on the home page, shown only to visitors who are not signed in and described below. This page explains exactly what is stored and how to get rid of it.

Who is responsible

The controller for the data described here is Willem Mevius, who runs sudokuchaos.com as a personal project. For anything on this page — questions, access requests, deletion requests — write to privacy@sudokuchaos.com.

What is stored, and why

If you play without an account

Nothing about you is stored on the server. The puzzle you are solving is stored on our side without any link to you, and your progress in it is saved in your own browser.

If you create an account

• Your chosen name. This is the only identifier we hold. It is shown publicly on the daily and weekly leaderboards, so please don't use your real name if you'd rather not be identifiable.
• Your password, stored only as a salted PBKDF2-SHA256 hash. It cannot be read back, by us or by anyone who obtained a copy of the database.
• Your daily-puzzle activity: when you started a daily puzzle, your solving time when you finish it, and how many times you used the mistake-check. This is what the leaderboards are built from.

We do not collect an email address, a real name, a date of birth, a profile, or anything else. We do not know who you are.

Stored in your browser, not on our server

The site uses your browser's local storage — not cookies — for three things, all of which exist purely to make the site work as you asked it to:

• sudoku_auth_token — keeps you signed in, set only when you log in.
• sudoku_lang — remembers the language you picked.
• sudoku_progress_… — your unfinished puzzles, so you can come back to them.

None of it is used to track you, profile you, or follow you to other sites, and none of it leaves your device except the sign-in token, which is sent to our server to identify your session. You can delete all of it at any time by clearing site data in your browser.

Cookies

This site sets no cookies of its own. Our network provider, Cloudflare, may set a __cf_bm cookie, which distinguishes real visitors from bots, expires after about 30 minutes, and is strictly necessary for security. Advertising cookies exist only if you are not signed in and accepted them in the ad consent message — see Advertising above.

Server logs

Our hosting provider processes the technical information every web request carries, including your IP address, so that the service can run and be protected from abuse. We do not build our own logs of visitors, and we do not combine this with your account.

Advertising

To help cover the running costs, the home page can show one advertisement, served by Google AdSense. It is shown only to visitors who are not signed in: play with an account and you will never see an ad, and your browser will not talk to Google at all.

If you are in the EEA, the UK or Switzerland, a consent message appears before the first ad. You can refuse with one click; Google then limits itself to non-personalised ads, which rely on the page you are viewing rather than on you. If you consent, Google may set advertising cookies and use identifiers to personalise and measure ads, as described in how Google uses information from sites that use its services and the Google Privacy Policy. You can change your choice at any time via “Ad privacy settings” in the footer of the home page.

We never pass your account data to Google — no name, no results. Google acts as an independent controller for the data it processes to serve these ads.

Legal basis

Where the GDPR applies, we rely on:

• Performance of a contract (art. 6(1)(b)) for your account, sign-in and the daily puzzle and leaderboards you signed up for.
• Legitimate interests (art. 6(1)(f)) for keeping the service running, secure and free of abuse.
• Consent (art. 6(1)(a)) for advertising cookies and personalised ads — asked for in the consent message, and withdrawable at any time.

How long it is kept

• Your account: until you delete it.
• Daily results and leaderboard entries: about 60 days, after which they expire automatically.
• Sign-in sessions: they expire 90 days after you last used them, and immediately when you log out.

Who else can see it

Nobody buys, receives or licenses this data. It is never used for advertising and never sold. Three suppliers process it on our behalf, under their standard data-processing terms:

• Fly.io — hosting. The application and database run in Fly's Paris (France) region.
• Upstash / Fly Redis — the database that holds accounts and results.
• Cloudflare — DNS, network protection and email forwarding for our contact address.

These suppliers are US-headquartered companies serving the data from the EU; their processing agreements include the European Commission's Standard Contractual Clauses to cover any transfer outside the EEA.

Your rights

You have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable form. In practice:

• Erasure is self-service. Sign in, click your name on the home page, and choose "Delete my account". That removes your account, every device you're signed in on, and your daily results and leaderboard entries. It is immediate and cannot be undone.
• For anything else, email privacy@sudokuchaos.com and we will respond within one month. Because we hold no email address, we can only answer requests from someone who can sign in to the account concerned.

If you think we've handled your data badly, you can complain to a data protection authority — either the one in your own country, or ours, the French CNIL.

Children

Sudoku suits every age, and the game itself can be played without an account or any data at all. If you are under 16, please ask a parent or guardian before creating an account.

Changes

If this policy changes, the new version appears here with a new date at the top. There is no mailing list to notify, since we hold no addresses.