Privacy Policy

Effective date: 2026-06-13 · Last updated: 2026-06-13

This Privacy Policy explains what personal information the Hardest Sudoku service (the "Service") collects, how that information is used, how long it is kept, the third parties that process it, and how you can exercise your rights. By signing in to the Service you agree to the practices described below.

1. Who we are

The Service is operated by an individual developer ("Jang Han", "we", "us") as a Sudoku practice application. For any privacy-related question, contact [email protected].

2. Information we collect

We collect only the minimum information needed to operate the Service.

Google account identifiers — Google OAuth subject identifier (sub) and the email address associated with your Google account. Received from Google when you sign in; we do not store your Google password.
Profile attributes — your display nickname and an inferred country code (derived from request metadata at sign-up time).
Account timestamps — the date and time your account was created and last signed in.
Technical signals — your IP address, browser user-agent string, and a device fingerprint computed by your browser at sign-in time. These are retained to help detect abuse such as Sybil (multiple-account) signups and automated solving.
Gameplay telemetry — for each puzzle attempt we record input events (cell selections, value entries, pencil marks, hint requests, pause and resume events), server-authoritative timestamps, mistake events, hint usage, and pause durations. This is the core signal used to calibrate puzzle difficulty and to learn anti-abuse patterns.

We do not collect payment information, precise location, contacts, photographs, microphone or camera input, or any health-related information.

The Service is supported by advertising. To display and measure ads, our advertising provider (Google) and its partners may set cookies and read device advertising identifiers. We do not provide your account, email, or gameplay telemetry to advertisers. See Section 6A (Advertising) for details and your choices.

3. How we use the information

Service operation — authenticate you, render puzzles, and persist your progress.
Difficulty experimentation — aggregate gameplay telemetry to calibrate puzzle difficulty levels (clean-clear rates, time-to-solve distributions, mistake densities per seed).
Abuse detection — compute and store heuristics that may flag automated solving, Sybil accounts, or coordinated cheating. During the current release these flags are used for research only and do not affect your account status.

We do not sell your personal information and do not share it with third parties except as described in Section 6.

4. How we store and protect

Personal information is stored in a managed PostgreSQL database provided by Railway. Transport between your browser and the Service is encrypted with TLS. Session credentials are issued as HTTP-only, cryptographically signed cookies; mutating requests must additionally carry an HMAC-derived CSRF token. Access to the production database is limited to the operator.

5. Retention

Profile data (nickname, country, email, Google sub, account timestamps) is retained while your account is active. If you request deletion (Section 7), profile data is removed within 30 days.
Gameplay telemetry (puzzle attempts, input events, mistake logs, hint events, pause durations) is retained indefinitely. After your profile is deleted, telemetry records remain only with an internal pseudonymous identifier and are no longer linked to your Google email or nickname.
Technical signals (IP, fingerprint) recorded at sign-in are retained for the lifetime of the account and are removed together with the profile.

6. Third-party services

Google LLC — provides the OAuth identity service used for sign-in. Google receives an authentication request from your browser and returns a signed identity token to the Service. We do not share any gameplay data with Google.
Railway Corp. — provides hosting, web serving, and database infrastructure used to operate the Service.

These providers act as data processors on our behalf and are subject to their own privacy practices and terms.

6A. Advertising

The Service is free and supported by advertising provided by Google: Google AdSense on the web, and Google AdMob in any mobile-app version of the Service. When ads are shown, Google and its advertising partners may use cookies, web storage, and device advertising identifiers (such as the Google Advertising ID on Android or the Identifier for Advertisers on iOS) to serve, personalize, and measure ads. In this role Google acts as an independent advertising provider, not merely as our processor, and its use of such data is governed by Google's "How Google uses information from sites or apps that use our services" policy.

What advertisers receive — ad-related signals such as advertising identifiers and general device/usage data needed to serve ads. We do not share your Google account identifier, email, nickname, or gameplay telemetry with advertisers.
Your choices — you can manage or turn off personalized ads at Google My Ad Center. On mobile devices you can reset or limit your advertising identifier in the operating-system settings. On Apple devices, personalized ads also require your consent through Apple's App Tracking Transparency prompt; if you decline, you will still see ads, but they will not be personalized using your device identifier.
Children — users under the age threshold in Section 9 are not shown personalized advertising.

7. Your rights

You may:

Request a copy of the personal information we hold about you.
Request that your account and profile data be deleted; please review the Retention section for what happens to telemetry.
Request correction of inaccurate profile data (nickname, country).
Withdraw consent — by deleting your account you withdraw consent for further collection of personal information from you.

To exercise any of these rights, contact [email protected]. We respond within 30 days.

8. International transfers

The Service is hosted on infrastructure operated by Railway Corp. and uses authentication services operated by Google LLC. Both are based in the United States, and processing your personal information involves international transfer to and storage in the United States. By signing in you consent to such transfer.

9. Children's privacy

The Service is not directed to children. We do not knowingly collect personal information from children under the age of 13 (or under 14 where local law sets a higher threshold). If you believe a child has provided personal information to us, contact us and we will remove the account. We do not knowingly show personalized advertising to users in this age group (Section 6A).

10. Changes to this policy

Material changes will be announced on this page with an updated effective date. Continued use of the Service after the effective date constitutes acceptance of the changes.

The Service may in the future be transferred to, or operated by, a different legal entity (for example, if the operator incorporates the Service into a company). If the party responsible for your personal information changes, we will update the operator details on this page and announce the change before it takes effect; your information will continue to be handled under a policy at least as protective as this one.

11. Contact

For any privacy question or to exercise the rights described in Section 7, contact [email protected].