This policy explains what personal data we handle when you use our puzzle app, why we handle it, and the rights you have. We have tried to write it in plain English. If anything is unclear, please contact us and we will happily explain.
Who we are
The app is provided by Shattered Sun Ltd, a company registered in England & Wales. We are the "controller" of your personal data, which means we decide how and why it is used.
- Registered address: Belmont Suite, Paragon Business Park, Chorley New Road, Horwich, Bolton, England, BL6 6HG
- Contact email: support@puzzleforge.co.uk
If you have any question about your data or this policy, email us at the address above.
What we process
We keep the amount of personal data we hold to a minimum. When you use the app we process:
- Your email address and/or phone number — used only as the way you log in. We send a one-time code to it so you can sign in, and we store it as your account's login identifier. We do not use it for marketing.
- A random account ID — a randomly generated identifier (a UUID) that represents your account in our systems.
- Your token balance and transaction history — the tokens on your account and a record of your purchases and credits.
- The puzzles you generate — the crossword and word-search puzzles you create in the app.
We want to be equally clear about what we do not do:
- No advertising — we show no ads and share nothing with ad networks.
- No analytics or tracking — we do not run third-party analytics or track you across apps or websites.
- No selling of data — we never sell or rent your personal data to anyone.
Cookies
Our website sets no non-essential cookies. There is no cookie banner because there is nothing to consent to.
Who delivers our login codes and payments
To run the app we rely on a small number of trusted providers. They only ever receive the data they need to do their specific job.
- Resend, Inc. (United States) — delivers login codes by email. Your email address passes through Resend so the code can be sent. Resend processes it only to deliver the message and keeps short-term delivery logs.
- Telnyx LLC (United States) — delivers login codes by SMS. Your phone number passes through Telnyx in the same way, and it keeps short-term delivery logs.
- Apple and Google — process your payments when you buy tokens. Your payment details go to the app store, not to us.
- RevenueCat, Inc. (United States) — records your purchases so we can keep your token balance correct. This record is keyed to your random account ID.
- Our servers — the app's API and its database run on our own virtual server, hosted in Germany (EU).
Why we process your data and our legal bases
Under data protection law we must have a lawful basis for using your data. Ours are:
- To provide the service you asked for (contract) — creating and running your account, sending your login codes, keeping your token balance, and processing your purchases. Without this we cannot give you an account.
- Our legitimate interests — keeping the service secure, preventing fraud and abuse, and keeping the app working reliably. We only rely on this where it does not override your rights.
International data transfers
Some of our providers are based in the United States, so your data may be transferred there. Where the provider is certified under the EU-US Data Privacy Framework and its UK Extension, we rely on that framework for the transfer. Where a provider is not certified, we rely on the Standard Contractual Clauses (and the UK International Data Transfer Addendum) in that provider's data processing agreement. You can ask us for a copy of the safeguards that apply to any transfer.
How long we keep your data
We keep your account data for as long as your account exists. When you delete your account we delete your data, except where we need to keep a limited amount briefly for security, fraud-prevention or legal reasons. Login codes are not stored by us as a record; the short-term delivery logs held by our email and SMS providers expire in line with each provider's own retention policy.
Your rights
You have the following rights over your personal data:
- Access — ask for a copy of the data we hold about you.
- Rectification — ask us to correct data that is wrong.
- Erasure — ask us to delete your data.
- Restriction — ask us to limit how we use your data.
- Objection — object to processing based on our legitimate interests.
- Portability — ask for your data in a portable format.
- Withdraw consent — where we rely on your consent, withdraw it at any time.
You can exercise most of these yourself from the account page, or by emailing us at support@puzzleforge.co.uk. To delete your account, see "Deleting your account and data" below.
If you think we have handled your data wrongly, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, or to your local data protection authority if you are in the EU.
Complaining to us
If you want to complain to us directly, please use the form on our support page or email support@puzzleforge.co.uk. We will acknowledge your complaint within 30 days, in line with the UK Data (Use and Access) Act 2025.
Deleting your account and data
You can delete your account and its data at any time:
- In the app — an in-app account deletion option is coming with the app's release.
- On the website — you can delete your account yourself from the account page. Our account deletion page explains exactly how it works and what happens.
Deleting your account erases your account, your login identifier (email address or phone number), the puzzles you generated, your token balance, your transaction records, and our customer record held with RevenueCat. We may keep a limited amount of data briefly where we must for security, fraud-prevention or legal reasons, and our providers' short-term delivery logs expire in line with their own policies.
Automated decision-making
We do not make any decisions about you by solely automated means, and we do not profile you.
Children
The app is for people aged 13 and over. It is not directed at children under 13. If we become aware that an account belongs to someone under 13, we will delete it.
Changes to this policy
This policy is dated at the top. If we make material changes, we will announce them in the app and on this website. Please check back from time to time so you know how your data is handled.