Privacy

In short

• You don't need to sign up and we don't show ads.
• We only use two technical cookies, needed to find your games again and to remember your language: that is why there is no cookie banner.
• Your email, if you give it to us, is only used to send you the sign-in link and code. No newsletters.
• We don't sell data and we don't profile anyone.
• You can delete all your data at any time from the Account page.

Who is the data controller

The data controller is Denis Casanuova. For any question about your data write to privacy@tt4.info.

The game and your device

Data

A random code in the sm_device cookie, your games (sudoku, difficulty, times, moves, date and time), your streak of days, your language and where your first visit came from (the code of a shared link, the landing page and the utm parameters of the link, if any).

What happens

When you start a game the site creates a player without a name (a “guest”) and writes the sm_device cookie in your browser: on the server we only keep its fingerprint, not the code itself. With that cookie we find your games again and work out your streak, your statistics and the anonymous comparison with the other players of the same sudoku, without showing any names.

What we keep

Your games and your streak stay as long as your player exists. A player without an email who doesn't come back for 400 days is deleted automatically, together with their games. The cookie lasts 400 days from the last time you used the site.

Why

To give you the service you ask for: finding your games, streak and statistics again (Article 6(1)(b) GDPR). The cookie is technical and necessary, so no consent is needed.

Sharing a game

Data

The time, the difficulty and the streak of a completed game.

What happens

When you complete a daily sudoku, the site prepares a public code for that game, so that sharing starts right away: until you share the link, nobody knows it. Whoever opens the /s/… link sees the difficulty, the time, the streak and the nine coloured boxes, with no name and no email.

For how long

As long as the game exists: if you delete your data, the link stops working.

Why

To do what you ask for when you tap “Share” (Article 6(1)(b)).

The share buttons (WhatsApp, Facebook, X, Telegram, email) are plain links: until you tap one, no data goes to those services and the pages load nothing from them. If you tap one, the service's site or app opens with the text and the link to share, and from then on its own privacy rules apply.

Email and signing in

Data

The email address you type and the language of the request.

What happens

We send you a message with a link and a 6-digit code, both valid for 15 minutes: they let you find your games again on another device, or in the app on your Home Screen. The message is sent through Amazon SES (in Frankfurt). Until you open the link or type the code, the address stays “pending” and is not confirmed.

What we keep

The confirmed address. We don't save the code: we only keep its fingerprint, an HMAC computed with a secret key, for 15 minutes and at most 5 attempts. For the limits against abuse (see below) we keep the email address and the number of requests in memory for one hour at most.

For how long

Until you delete your data from the Account page: your email, games and streak are removed.

Why

To give you the service you ask for, which is finding your games on several devices (Article 6(1)(b)). The email is optional: without it you keep playing, and your games stay on this device. We don't send newsletters or any other messages.

Limits against abuse

To protect the site from people who create thousands of players or try codes over and over, we count requests. For one hour at most we keep in memory the IP address they come from (for the sign-in link, also the email address) and how many requests were made; for game writes we count per player, for one minute. Then they disappear on their own, and restarting the server resets them. They end up in no archive. The legal basis is our legitimate interest in the security of the site (Article 6(1)(f)).

Your browser's memory

Data

Your settings, the games in progress and the sync queue, in the browser's local storage (the keys that start with sm:), and the sm_locale cookie with the language you chose.

What happens

They stay on your device. The app uses them to play without a connection, to remember the theme, the text size and the language, and to send your games to the server when the connection comes back.

For how long

The sm_locale cookie lasts 400 days; the rest until you delete it. “Delete my data” on the Account page also removes the local storage, except for the settings of the device.

Why

They are technical tools needed for the app to work (Article 6(1)(b)): that is why no consent is needed.

Website statistics

To count visits and understand which features are used we use Umami, statistics software installed on one of our servers (analytics.sudokumania.com). It sets no cookies and does not store IP addresses: it records the page visited, the referring site, the browser, the operating system and the type of device, the screen size, the language and the country, region and city worked out from the connection, together with an anonymous session identifier computed without storing the IP address. It also records a few anonymous usage events (for example a game started or finished, with the difficulty and the time, or a tap on “Share”), with no name and no email, and it ignores whatever follows the ? in the address. This data is not shared with third parties and helps us understand which pages and features are useful (our legitimate interest, Article 6(1)(f)).

Server logs

Like any website, our servers and the proxy in front of them log requests: IP address, page requested, date and time, browser and referring page. They serve security and understanding errors (our legitimate interest, Article 6(1)(f)), not identifying visitors. They are kept for a short time: they are fixed-size files and, when they are full, the oldest entries are overwritten.

Error reporting

If Sudokumania runs into an error, it reports it to Sentry, a monitoring service, so that we can fix it. The report contains the type of error, the place in the code where it happened, the address of the page and a few request headers (for example the browser and the language). It does not contain the content of requests, nor cookies, nor IP addresses. Sentry processes the reports on servers in the United States. The legal basis is our legitimate interest in fixing defects (Article 6(1)(f)).

Backups

Every night the server makes a compressed copy of the database (players, games, emails) and keeps the last 14: older ones are deleted automatically. The same night another copy, encrypted so that it can only be opened with a key that is not on the server, goes to Amazon S3, in Frankfurt: these copies are deleted automatically after 90 days at most. They let us restore the data if a wrong change damages it or if the server breaks down (our legitimate interest, Article 6(1)(f)). If you delete your data, it remains in the copies already made for 14 days at most on the server and 90 days at most on Amazon S3.

Who processes data on our behalf

• Contabo: the servers the site runs on, in the European Union.
• Amazon Web Services: sending the sign-in emails with Amazon SES and the encrypted backups on Amazon S3, in Frankfurt.
• Sentry: reporting technical errors.

The statistics do not go through third parties: Umami runs on our own server. We don't sell or pass on data to anyone and we don't do profiling or automated decision-making. Some providers may process data outside the European Economic Area, with the safeguards the GDPR provides for (an adequacy decision or standard contractual clauses).

Your rights

You can ask us for access to the data about you, rectification, erasure, restriction of processing and, where the conditions are met, portability, and you can object to the processing (Articles 15 to 22 of the GDPR). You can delete your data yourself at any time from the Account page. For anything else write to privacy@tt4.info: we reply within one month. If you believe the processing breaks the law you can lodge a complaint with the supervisory authority (in Italy, the Garante per la protezione dei dati personali).