Privacy Policy
Last updated: 28 August 2026. This Policy explains what PuzzForge does with your information when you use our website and tools (the "Service"). It describes both the processing that is active today and the advertising integration that is explicitly identified below when it is enabled.
PuzzForge is operated by Hamza Hassni, an individual (sole proprietor) based in Morocco, who is the data controller responsible for your information under this Policy. You can read more about the Service on the about page.
1. What we collect
Information you give us
- Account details. Your email address and a password when you sign up, and your name if you choose to enter one. You can instead sign in with Google, in which case Google confirms your identity to us and we receive the email address on that account.
- What you create. If you save a project to your account, its title and its content — your words, clues, questions and settings — are stored so you can open it again. Projects saved without an account stay in your browser and are never sent to us.
- Shared puzzles. If you create a share link, the finished puzzle and its solution are stored so the link works for whoever opens it.
- Messages. If you use the contact form we keep your email address, your name if you gave one, and the message, so we can reply.
- Newsletter. If you enter your email in the footer sign-up box, we store that address and send you one email asking you to confirm. Nothing else is sent unless you click that link. We also keep the date you signed up and the date you confirmed, which is how we can show that you asked for it, and a token that makes the unsubscribe link work.
- AI prompts. What you type into the AI helper — see section 5.
Information collected automatically
- Usage events. Only with your consent: which generators and guides are opened, how many times a share link is viewed, and the two-letter country your visit came from. These are counters kept in our own database, not a profile of you.
- AI usage counts. A daily count of AI requests, so the free allowance can be enforced. For signed-in users this is counted against your account. For visitors without an account it is counted against your IP address, because there is nothing else to count against.
- Contact-form abuse prevention. When the contact form is submitted, we temporarily keep one-way keyed hashes of the IP address and email address so we can enforce submission limits. The limiter does not store the raw IP or email, and stale counters are removed.
- Subscription state. If you subscribe, we store the identifiers described in section 4.
- Provider logs. Our hosting and database providers keep their own technical logs, which normally include IP addresses. Those are held by them, under their own terms.
What we do not collect. There is no file upload for users anywhere in the Service. We do not ask for your address, phone number or date of birth. We never receive your card or bank details. We do not buy data about you, and we do not sell your personal data.
2. Why we use it, and on what basis
The legal bases below apply if you are covered by the GDPR or a similar law. This is a plain description, not legal advice.
| What we do | Why | Basis |
|---|---|---|
| Create and run your account | So you can sign in and reach your work | Performance of a contract |
| Save and sync your projects | So your work is there next time | Performance of a contract |
| Send your prompt to an AI provider | To return the suggestion you asked for | Performance of a contract |
| Handle subscriptions | To give and end paid access correctly | Performance of a contract |
| Answer your messages | To provide support | Performance of a contract, or legitimate interests |
| Anti-bot checks on sign-in forms | To keep accounts and the AI allowance from being abused | Legitimate interests |
| Count AI requests per day | To enforce the free allowance fairly | Legitimate interests |
| Limit contact-form submissions | To prevent spam and protect the support service | Legitimate interests |
| Usage counters and country of visit | To see which parts of the Service are used | Consent |
| Keep your email from the footer box | To send an update if we start sending them | Consent |
3. Cookies, local storage and consent
PuzzForge does not set cookies of its own: the Service keeps what it needs in your browser's local and session storage instead. Two third parties we rely on may set their own cookies — Cloudflare, for the anti-bot check on the sign-in forms, and PayPal, on the pricing page once its checkout loads. Everything is listed below by name.
Essential — always on
The Service does not work without these, so there is no choice to offer.
| Name | Type | What it does |
|---|---|---|
| sb-…-auth-token | Local storage | Keeps you signed in between visits. Set by the Supabase authentication library. |
| pf-session-ephemeral | Local storage | Marks a sign-in you asked not to be remembered, so the session is cleared when you leave. |
| pps_consent | Local storage | Stores your cookie choice and its date, so we do not ask again for twelve months. |
| Cloudflare Turnstile | Set by Cloudflare | Runs the anti-bot check on the sign-up, sign-in and password-reset forms. |
| PayPal | Set by PayPal | Only on the pricing page, and only once the PayPal button loads, to run its checkout. |
Preferences — always on
These remember your settings and your own work. They stay in your browser and are never sent to us, which is why they are not behind a consent switch.
| Name | Type | What it does |
|---|---|---|
| pps_theme | Local storage | Remembers light or dark mode. |
| pps_ai_lang | Local storage | Remembers the language you last asked the AI helper to work in. |
| pps_trial_offer_hidden | Local storage | Remembers that you dismissed the free-trial banner. |
| pps_projects | Local storage | Holds projects saved without an account. This never leaves your browser. |
| pps_logo_… | Local storage | Holds the logo you add to your sheets. It is not uploaded to us. |
| pps_wordbanks | Local storage | Caches generated word lists so a theme does not have to be rebuilt. |
| pps_best_… | Local storage | Your best time on a puzzle you played. Not sent to us; there is no leaderboard. |
Analytics — only with your consent
Counters written to our own database. No third-party analytics service is involved, and this data is not linked to advertising. If you do not consent, nothing is recorded.
| Name | Type | What it does |
|---|---|---|
| pps_visit_tracked | Session storage | Stops one browsing session being counted more than once. |
| pps_src_tracked | Session storage | Stops a referral source being counted more than once. |
Advertising — currently disabled
Advertising is currently disabled in the site configuration. The codebase is prepared for Google AdSense, but it does not load the AdSense script until a valid publisher client is configured and advertising is explicitly enabled. Before enabling it, we also configure a Google-certified consent message for regions where that is required.
Google explains how it uses information from sites that use its services on its partner sites and apps page, and its general privacy policy applies to its processing.
The PuzzForge Cookie preferences control covers our first-party usage analytics only; it is not an advertising CMP. You can change that analytics choice at any time from the footer, or . We ask again after twelve months. Advertising choices, when ads are enabled, are managed through the Google-certified privacy message described above.
4. Who else is involved
These are the third parties that receive data through the Service, plus Google AdSense when advertising is enabled. Each is listed with what it does and a link to its documentation.
- Supabase — our database, sign-in system and file storage. Your account, projects, shared puzzles, messages and subscription records are stored there. Supabase privacy policy.
- Vercel — hosting. Requests to the site pass through Vercel, which also tells us the two-letter country of a visit. Vercel privacy policy.
- Cloudflare — the Turnstile anti-bot check on the sign-up, sign-in and password-reset forms. Cloudflare privacy policy.
- PayPal — subscription payments. You enter your payment details on PayPal, not here. We never see or store your card or bank information. We receive and store a PayPal subscription identifier, the plan, its status, the billing cycle and the date the current period ends, plus the notification messages PayPal sends us about your subscription. PayPal privacy statement.
- An AI provider — see section 5.
- Google AdSense — only when advertising is enabled. Google and participating ad technology providers may process cookies or similar identifiers, IP addresses, browser/device information, ad interactions and consent signals to serve, limit, personalise where permitted, and measure advertising. AdSense is deliberately disabled on legal, authentication, account, payment and actual puzzle-game routes. See Google's partner-sites explanation.
- Google Fonts — the typefaces used across the site are requested from Google's servers, which means your IP address reaches Google when a page loads. Google's own page on Google Fonts and privacy states that the API does not set or log cookies, and that Google receives the IP address, the requested URL and the browser headers. Google's general privacy policy covers the rest. The Fonts request is separate from AdSense advertising.
Signing in with Google is optional; if you use it, Google confirms your identity to us under its own privacy policy, linked above.
5. The AI helper
When you ask the AI helper for words, clues or questions, the text of your request is sent to an external AI provider so it can answer. Depending on how the Service is configured at the time, that provider is Groq, Google (Gemini) or Anthropic. Their handling of that text is governed by their own terms.
Please do not put personal information about yourself or anyone else into an AI prompt. The feature is there for puzzle topics and word lists, and it does not need anything personal.
We do not use your projects, prompts or puzzle content to train AI models. We keep a daily count of how many AI requests were made, as described in section 1, but not a copy of the prompts themselves.
6. Where your data is held
Our providers operate internationally, so your information is likely to be processed on servers outside your own country, including outside the European Economic Area. Each provider describes its own transfer arrangements in the documentation linked in section 4. We are not in a position to add to what they publish, so we do not claim more than that here.
7. How long we keep it
We keep information for as long as it is needed for the purpose it was collected for, and for legitimate business or legal reasons after that. In particular:
- Your account and projects — for as long as your account exists. Deleting your account removes them, as described in section 9.
- Shared puzzles — a share link expires 30 days after it is created unless you choose a different period, up to a year. After that the link stops working.
- Newsletter email addresses — kept until you unsubscribe, until you delete your account if the address matches it, or until the mailing is discontinued. An address that never gets confirmed stays inactive and is never mailed again.
- Support and usage records — kept only while they remain reasonably useful for support, security, service operation or aggregate usage reporting. The Service does not currently enforce a single automatic deletion period for every record in these categories.
- Billing and security records — some records received from PayPal, including subscription identifiers and webhook notifications, may be retained after account deletion where reasonably necessary for accounting, fraud prevention, dispute handling or legal obligations. We do not keep payment-card or bank-account details.
8. Security
Traffic to the site is encrypted in transit. Passwords are handled by our authentication provider and are never visible to us. Database access is restricted by row-level security rules, so an account can generally reach only its own rows, and administrative access is limited. Anti-bot checks protect the sign-in forms.
No service can promise perfect security, and we do not. If we become aware of a breach affecting your personal data, we will act on it and notify you where the law requires.
9. Your rights and your account
Depending on where you live you may have the right to access your data, correct it, delete it, restrict or object to how it is used, receive a copy in a portable form, and withdraw consent you have given.
Some of these you can exercise yourself:
- Delete your account. There is a delete option in your account settings. It removes your saved projects, your support messages, your shared puzzles, your subscription record, your profile and your login. If you have an active Premium subscription you need to cancel it in PayPal first, because deleting the account here does not stop PayPal billing you.
- Change your details. Your name and password can be changed from your account.
- Withdraw consent. Use the Cookie preferences link in the footer for PuzzForge analytics. When AdSense advertising is enabled, use Google's Privacy and cookie settings control for advertising choices.
Every newsletter email carries an unsubscribe link that works in one click, without signing in. For anything else — a copy of your data, a correction you cannot make yourself, or an objection — please contact us and we will deal with it. You also have the right to complain to your local data-protection authority.
10. Children
PuzzForge is made for adults — teachers, tutors, parents and creators — to produce materials, and accounts are intended for them. Much of what you can make here is meant for children to solve, but that is the finished worksheet, not an account. A child can solve a printed puzzle or open a shared puzzle without creating an account or deliberately providing identifying information to PuzzForge.
We do not knowingly collect personal information from children. If you believe a child has created an account or sent us personal information, please tell us and we will remove it.
11. Changes to this Policy
We may update this Policy as the Service changes. The date at the top always shows the current version, and material changes will be described on this page. If we introduce something that collects data in a new way, this page is updated before it goes live.
12. Contact
For any privacy question or request, use our contact page or email contact@puzzforge.com. Our terms of service cover the rest of the relationship, and the FAQ answers the questions that come up most often.