Privacy

The controller of your personal data is Loubna Channouf Cherradi, 50 rue de la gare, 3771 Tétange, Luxembourg.

For anything in this notice, write to hello@playmuddle.com or use the contact page. We have not appointed a Data Protection Officer, which at this size we are not required to do.

Nothing that identifies you is collected. Your puzzle progress, your streak and your settings are kept in your own browser, in local storage. They never leave your device unless you sign in, and clearing your browser data erases them permanently — we cannot restore them because we never had them.

When you make a move, it is sent to our server to be marked, because the answer is not in the page. We store the move, the result, and a random identifier generated by your browser so that the moves of one session hang together. That identifier is not linked to you, and we use it only to see how hard a day actually turned out to be.

Legal basis: legitimate interest (Article 6(1)(f)) — running the game and understanding whether its puzzles are fair.

We store:

• your email address, and a password that is only ever kept as a secure hash;
• if you sign in with Google, your email address and Google account identifier — we never receive your Google password;
• the display name you choose, which is shown publicly on the leaderboard;
• which puzzles you have played, whether you solved them, and the points scored.

Legal basis: performance of a contract (Article 6(1)(b)) — you asked us to keep your record, and this is what keeping it requires.

• No advertising, no ad networks, no tracking pixels.
• We do not sell or rent your data, and we never will.
• No advertising or analytics cookies, so there is no cookie banner. The only things stored in your browser are your own game progress and, if you sign in, the cookie that keeps you signed in.
• No profiling, and no automated decisions that have any effect on you.

These companies process data on our instructions, under contract, and may not use it for anything of their own:

• Supabase — the database and the sign-in system.
• Hostinger — hosting, which means our servers and our domain.
• Titan — email delivery, for confirmation and password-reset messages.
• Google — only if you choose to sign in with Google.

Some of these are based outside the European Economic Area. Where data is transferred there, it is covered by the European Commission’s Standard Contractual Clauses. Copies are available on request.

• Account data — until you delete your account, and then removed within 30 days.
• Play records tied to an account — deleted with the account.
• Anonymous move data — kept for up to 24 months to tune difficulty, then deleted. It is not linked to any person.
• Emails you send us — kept for up to 24 months so we can follow up.

Under the GDPR you have the right to:

• ask what we hold about you, and get a copy;
• correct anything wrong;
• have it deleted;
• restrict or object to how it is used;
• receive it in a portable format;
• withdraw consent at any time, where consent was the basis.

Email hello@playmuddle.com and we will respond within one month. It is free. We will not ask you for anything beyond what is needed to confirm the account is yours.

If you think we have handled your data badly, you can complain to a supervisory authority. Ours is the Commission nationale pour la protection des données (CNPD) in Luxembourg. You may also complain to the authority in the country you live in, whichever is easier for you.

Muddle is for a general audience and is not aimed at children. If you are under 16, please ask a parent before creating an account. If we learn we hold the data of a child under 16 without that permission, we delete it.

Connections use HTTPS, passwords are hashed by our sign-in provider and never stored in a form we could read, and the database is locked so that a browser cannot read anything beyond what belongs to its own account.

No system is perfect. If there is ever a breach that puts your rights at risk, we will tell the relevant authority within 72 hours and tell you without undue delay.

If this notice changes in a way that matters, the date at the top changes and, if you have an account, we will email you before it takes effect.