pzlhub

Privacy policy

Last updated: 23 October 2026

Less data. Clear rules. More room to play.

Who is responsible

The controller for pzlhub.com is Ioannis Orfanidis. Privacy, rights requests and support: ioan.orfanidis@gmail.com. This policy covers the current online beta of the game.

What we store

Pressing Start creates a random guest identifier and a session. The server stores your player name, attempts, level progress, times, mistakes, hints, solutions and personal best scores. Community features store puzzles you publish, likes and feedback (rating, difficulty and comment). A real name is not required; we recommend a nickname.

Sign in with Google

Google is the social sign-in currently available. We request only openid and profile to verify your identity. We retain the provider, its unique account identifier and your display name. We do not request Gmail, Drive, contacts or email access, and do not retain access/refresh tokens or your Google photo. Your initial Google name can appear on public leaderboards; change it in Profile before playing if you prefer a nickname. TikTok/Facebook options labelled “Soon” are inactive. We do not post to your social profile.

Purposes and legal bases

Account operation, score storage and publication of content you choose are necessary to provide the service you request (GDPR Article 6(1)(b)). Security, abuse prevention and technical operation rely on our legitimate interest in a safe, working service (Article 6(1)(f)). We handle support and rights requests to respond and meet legal obligations (Article 6(1)(c), where applicable). We do not use your data for targeted advertising or sell it.

What is public

Other players can see your player name, scores and leaderboard position. Published puzzles, like counts and feedback comments/ratings may also appear with your name. Guest attempts are stored for gameplay but do not enter the Global Top 100. Successful registration transfers eligible guest attempts to your account. Do not publish your own or anyone else’s personal details.

Cookies and device storage

The necessary pl_session cookie links your browser to a session and expires after 90 days. Temporary social sign-in verification cookies last up to 10 minutes. Cookies use HttpOnly and SameSite, with Secure over HTTPS. Your device stores language, appearance, sound, difficulty and kids activity preferences, bookmarks and generated avatars. An activity age group is a preference, not age verification. You can remove these through your browser’s site-data settings; this does not erase server data. The current version uses no advertising cookies or marketing analytics tools.

Language and technical data

Automatic language selection compares the connection IP against a local DB-IP country database. This yields an approximate country/language, not GPS or a precise location. This feature does not send the IP to a geolocation service or add an IP log. A manual language choice takes priority. The hosting provider may process ordinary technical logs such as IP, request time and path for operation and security.

Providers and transfers

The infrastructure is hosted at Diskspace. Google receives the information needed when you choose Google sign-in, under its own policy as well. The game loads Google Fonts, which means the browser contacts Google and sends technical connection information, including an IP address. These public policy pages use system fonts. Google services may process data outside the EEA using the safeguards described in their policies. See Google’s privacy policy and Google Fonts privacy information. Data may be disclosed when legally required. It is not sold or shared with advertisers.

Retention

Accounts, results and content are retained as needed for game continuity and the features you choose, until deletion following a request or closure of the relevant service. Cookie expiry does not automatically erase server records. The current beta has no automatic purge of inactive guest records. Temporary social verification data expires after 10 minutes; expired records are cleared during subsequent sign-in flows. Limited retention may be necessary for security or legal claims. Residual data may remain in backups until they are replaced; backups are not used to restore a deleted active profile.

Your rights and deletion

Subject to GDPR conditions, you can request access, correction, erasure, restriction or portability, or object to processing based on legitimate interests. Contact ioan.orfanidis@gmail.com. We will request only the information necessary to verify ownership, never your password. We respond without undue delay, normally within one month, and will explain any lawful extension. See the deletion instructions. You can complain to the Hellenic Data Protection Authority or your local supervisory authority.

Children, security and updates

The beta does not support independent child accounts or a parental-consent verification system. Kids activities are intended for adult-supervised play using a nickname, without children’s personal information. Parents can request deletion. We use HTTPS, private credential storage and restricted access to data files; no service can guarantee absolute security. Game scoring does not make decisions with legal or similarly significant effects. We update the date of this policy when it changes and highlight material changes within the app.