PuzPuz Privacy Policy
PuzPuz is a daily puzzle app made by PuzPuz Media Inc., Peterborough, Ontario, Canada. This policy explains what information the PuzPuz app keeps, where it keeps it, why, and how to get it back or have it deleted. It covers the PuzPuz web app at puzpuzpostcard.ca and the PuzPuz Android app. Our company website has its own, shorter policy.
The short version
- You join PuzPuz with an invite code, or by signing up with your email. Either way we create an account for you on our servers. It does not hold your name. If we invited you, it can be linked through our invite list to the name and contact details we used to invite you.
- When you join, you set up email sign-in: your account also holds the email address you give us and a scrambled form of your password. We use them only to sign you in. We send email to that address for two reasons only: to confirm it is yours, and to send a password-reset link when you ask for one.
- You must be 18 or older to join.
- Your puzzle progress, points and settings stay on your device, in your browser or in the Android app. We do not receive them.
- To keep you signed in, your device holds a sign-in token. Your email and password get you back into your account on a new device, and a link we email you resets a forgotten password. If you joined before November 1, 2026, you were also shown a recovery code. It keeps working, and it also resets a forgotten password.
- We use no advertising, no analytics and no tracking. We do not sell or share your information for marketing.
- You can ask to see your information, correct it or have it deleted. Write to [email protected].
1. Who is responsible
PuzPuz Media Inc. is responsible for the information described here. Our founder is our designated Privacy Officer and can be reached at [email protected].
2. What we keep on our servers, and why
When you join
Entering your invite code, or signing up with your email, creates, all at once:
| What | What it is | Why |
|---|---|---|
| An account identifier | A random number that stands for "a PuzPuz player". It is not your name. | So your access belongs to you, not to one device |
| A record of this device | One per device you sign in on, linked to your account identifier | So one account can be used on more than one device |
| Your sign-in | A long random token. We keep only a scrambled form of it (a hash). It lasts up to one year. | So the app can show that a request comes from a signed-in player |
| Your recovery code (only if you joined before November 1, 2026) | Shown to you once. We keep only scrambled forms of it (hashes) and cannot show it again. | So you can get back into your account on a new device |
| Your founding access | A record that you have founding-member access, if your invite gives it or you signed up while founding seats were left | So that access follows you to every device |
| Your invite (if you joined with one) | The invite wave it belongs to, when it was used, and which app used it (web, Android or iOS) | To run the invite waves and recognize founding members |
Your invite code is single-use. Once used, it is linked to the account it created. If you sign up with your email, we also keep the email address and a scrambled form of your password, as described next, and, while founding seats are left, your account takes one.
If you set up email sign-in
You set up email sign-in when you join (or, if you joined before November 1, 2026, the next time you open the app). You can change it later in Settings.
| What | What it is | Why |
|---|---|---|
| Your sign-in email address | The address you type, in lower case, and whether you have confirmed it | So you can sign in on any browser or device |
| Your password | We keep only a scrambled form of it (a hash). Nobody at PuzPuz can read it. | So we can check it when you sign in |
| Email links | A link to confirm your address, and a password-reset link when you ask for one. We keep only a scrambled form of each link. A link works once, and expires after 24 hours (confirm) or 30 minutes (reset). | So only the owner of the address can reset the password |
We send email to your sign-in address for these two reasons only, from our puzpuzmedia.ca mailbox, and never for marketing. A reset link is sent only to an address you have confirmed. Each time you sign in, we create a new sign-in for that device, as in the table above. Changing your password, or resetting it with a link or your recovery code, ends every other device's sign-in. An email address can belong to only one PuzPuz account, so if you enter one that another account already uses, we tell you so.
Our invite list. We invite people individually. Separately from the app, we keep a list of the people we invited, in a Google Sheet. For each person it can hold: a preferred name; the email address or handle we used to contact you; the wave you were invited to; whether you use Android or the web; the dates your invitation was sent, expires, was used and became active; whether you completed onboarding and first opened the app; whether you have finished a first puzzle; any open support request; whether you are eligible for founding-member recognition; and short operational notes. When we issue a code to someone on that list, the code carries a reference to their entry, so your account can be connected to your name and contact details through that list. We use the list to run the invite waves and to recognize founding members. We send invitations by email from our puzpuzmedia.ca mailbox.
While you play
- Fetching puzzles. The app asks our servers for each day's puzzles, sending your sign-in token so we know the request comes from a signed-in player.
- Your puzzle moves are not sent to us. The letters you enter and the hints you use stay on your device.
- Technical logs. Our server logs each request: the time, the address requested, the result, your IP address, and the headers your browser or app sends (such as the browser type and language). It removes your sign-in token and any cookies before logging. We use these logs to run and secure the service, find and fix faults, and limit abuse. Our host, Render, keeps them on its own schedule. To limit abuse, the server also counts recent requests per IP address, in memory only. Cloudflare, which serves the web app's files, also receives your IP address when your browser loads them.
We do not receive your puzzle progress, your puzzle moves, your points, your stamps or your settings.
When you write to us
If you email us for support or about your privacy, we keep your email address, your message and our reply in our Google Workspace mailbox, to answer you. Section 6 says how long.
3. What stays on your device
The app keeps these on your device so that it works without an account for every detail:
- your puzzle progress, points, routes, deliveries and stamps;
- your settings and accessibility preferences;
- a copy of the puzzles you have already downloaded, so you can keep playing offline;
- a random identifier for your device, which stays on your device;
- your account identifier and your sign-in token (and, if you joined before November 1, 2026, your recovery code until you confirmed you had saved it).
On the web, these live in your browser's local storage for the PuzPuz site. Anyone who can use your browser profile, or any script running on the PuzPuz site, could read them. If your browser blocks storage for the site, for example in some private-browsing modes, your progress lasts only until you close or reload the page. The web app also stores its own program files in your browser so it can open offline. Those files hold nothing about you.
On Android, your sign-in token and your recovery code are kept in the phone's secure storage, and everything else in the app's private storage. Each time the Android app starts, it checks Expo's update service for a newer version of the app, sending a random install identifier kept on the phone, the app version and, as with any connection, your IP address.
Clearing your browser's data for the PuzPuz site, or uninstalling the Android app, removes all of this from that device. That signs you out and deletes your puzzle progress on that device, because we do not keep a copy of it. Your account stays on our servers until you ask us to delete it (section 7), and your email and password are how you get back into it.
The app itself sets no cookies.
4. Who processes your information for us
| Provider | What it does | Where |
|---|---|---|
| Render | Runs our servers and keeps their technical logs | United States (Virginia) |
| Supabase | Hosts our database | United States (Virginia) |
| Cloudflare | Serves the PuzPuz web app's files | Cloudflare's global network, usually the location nearest you |
| Google (Google Workspace) | Our email, including the confirmation and password-reset emails the app sends, and the Google Sheet that holds our invite list | Google's data centres, which may be outside Canada |
| Expo (650 Industries) | Android app update checks (section 3) | United States |
Your information is therefore stored and processed outside Canada, and may be accessible to courts and authorities there.
5. What we do not do
We do not collect your name, phone number, location, contacts or photos in the app. The app collects an email address only if you set up email sign-in. We use it to sign you in, and email it only to confirm it and to send a password-reset link you ask for, never to market to you. We do not use advertising, analytics or tracking tools. We do not sell, rent or trade your information, and we do not use it to market to you.
6. How long we keep it
- Your account and the records in section 2 are kept until you ask us to delete it. That includes your email sign-in, which is replaced when you change it.
- Your sign-in on our servers expires after one year at most, or sooner if we end it. There is no sign-out button. Clearing your browser data or uninstalling the app removes the sign-in from that device; on our servers it lasts until it expires or your account is deleted.
- Technical logs and database backups expire on our hosts' own schedules. They are not erased when you delete your account; they age out on those schedules.
- Our invite list is kept for as long as we run invite waves and recognize founding members. When you delete your account, we remove your entry from it.
- Emails you send us are kept until your request is closed, then deleted.
7. Your rights: see, correct, delete
Canadian privacy law (PIPEDA) gives you the right to know what we hold about you, to have it corrected, and to withdraw your consent. The account is needed to play, so withdrawing your consent means deleting your account (below).
To ask, email [email protected]. We may ask you to show that the account is yours, for example by writing back to us from your sign-in email address; we will never ask for government ID or your password. We answer in full within 30 days. If we need longer, as the law allows, we tell you within those 30 days why and when to expect an answer. If we cannot give you something, we tell you why.
Deleting your account.
- In the Android app: Settings, then Delete your account.
- On the web: there is no delete button yet. Email [email protected] from the email address you sign in with. We write back to that address, and delete the account once you reply from it, which shows the address is yours. Never send us your password. If you joined before November 1, 2026 and have your recovery code, you can include it instead; we use it once, to delete the account, and then delete your email.
What deletion removes: your account, every device's sign-in, your recovery code, your email sign-in (the email address, password hash and any unused email links), your founding access record and your used invite. It cannot be undone. Deleting does not remove what is stored on your devices; clear your browser data or uninstall the app for that.
If you can no longer use your sign-in address and want your account deleted, write to us anyway. We will work out with you whether the account can be identified.
If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada. If you live in Quebec, you can also complain to the Commission d'accès à l'information du Québec.
8. Keeping it safe
We store your sign-in, your recovery code and your password on our servers only in scrambled (hashed) form. We limit how many sign-in attempts can be made from one place. The app talks to our servers only over encrypted (HTTPS) connections, and our server's connection to the database is encrypted and its certificate verified. On Android, your sign-in is kept in the phone's secure storage. On the web, the browser's local storage is not encrypted, so use a password you do not use anywhere else, and if you have a recovery code, keep it somewhere other than the device you play on.
If a breach of our safeguards creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner of Canada as the law requires.
9. Children
PuzPuz is for adults. You must be 18 or older to join, whether with an invite or by signing up, and we do not knowingly admit anyone younger.
10. Changes to this policy
When the app starts doing something this policy does not describe, we update the policy before the change reaches you, and change the version and date at the top. For a significant change, we also email you at the address we used to invite you, or your sign-in address, before the change takes effect.
11. Contact
PuzPuz Media Inc., Peterborough, Ontario, Canada.
[email protected]