Privacy Policy

Who we are

Cryptogramly (the "Service") is the data controller for the personal data described here. This policy covers the data we handle when you visit the site or use an account. Questions or data requests can be sent to the contact address at the end.

What we collect

We keep this deliberately small:

• Account data (if you register): your name, email address, and — for email/password accounts — a securely hashed password (we never store your password in readable form). If you sign in with Google, we store a Google account identifier and the basic profile info Google returns (name and email) instead of a password.
• Gameplay data: records of puzzles you start and complete, with timestamps, so we can provide no-repeat selection and show basic stats.
• Guest identifier: for players without an account, a random identifier is stored in your browser's local storage to enforce the daily guest puzzle limit. It is not tied to your identity.
• Technical data: standard server logs (such as IP address and browser type) generated when any website is accessed, used for security and reliability.

How we use your data

To operate and secure the Service; to run your account and the no-repeat/daily-limit logic; to understand and improve how the puzzles are used; and to communicate with you about your account or important changes. We do not sell your personal data.

Cookies & local storage

We use a small amount of browser storage:

• An authentication token (a JWT) is stored so you stay signed in. This is essential to the Service.
• The guest identifier described above (essential for the daily limit).
• Analytics: we use Statsig, a third-party product-analytics and feature-flag service, to understand usage and roll out features. It may set identifiers to distinguish devices in aggregate.

We do not currently show third-party advertising. If that changes, we will update this policy and, where required, ask for your consent first.

Third parties we share data with

We share data only with service providers that help us run Cryptogramly, under their own privacy terms: Google (for "Sign in with Google", if you use it), Statsig (analytics, as above), and our hosting/infrastructure provider. We may also disclose data where required by law.

Legal bases (EEA/UK)

Where GDPR applies, we rely on: performance of a contract (to provide the account features you request); our legitimate interests (to secure and improve the Service); and consent where required (for example, any future advertising or non-essential tracking).

Data retention

We keep account and gameplay data for as long as your account is active. If you delete your account or ask us to, we delete or anonymize your personal data unless we must retain some of it to meet legal obligations.

Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or object to the processing of your personal data, and to withdraw consent. To exercise any of these, email us at the address below and we will respond within the time the law requires.

Children

Cryptogramly is not directed to children under 13 (or the minimum age of digital consent in your country, where higher), and we do not knowingly collect their personal data. If you believe a child has provided us data, contact us and we will remove it.

International transfers

Your data may be processed in countries other than your own. Where required, we rely on appropriate safeguards for such transfers.

Security

We use reasonable technical and organizational measures — including password hashing and encrypted connections — to protect your data. No method of transmission or storage is perfectly secure, however, and we cannot guarantee absolute security.

Changes to this policy

We may update this policy; the "Last updated" date above reflects the latest version. Material changes may also be signalled in the Service.

Contact

For any privacy question or request, email us at familyflow.dev@gmail.com.