Privacy Policy

• You can play without an account. Guest games are saved without anything that identifies you.
• An account needs an email address, a username and a password. Everything else is optional.
• Your username, icon, country (if you set one) and progress are shown on the leaderboards.
• There are no ads and no trackers, and your data is never sold. We count visits with Cloudflare Web Analytics, which uses no cookies and doesn’t follow you.
• You can delete your account, and everything linked to it, at any time in Settings.

When you create an account and play:

• Your email address, used to log in and to send you the emails described below.
• Your username, as you typed it.
• Your password, stored only as a secure one-way hash: nobody can read it, us included.
• Your profile icon, and your country if you choose one.
• Your games: which puzzles you were given and solved, with time, mistakes and hints used, and the days you solved the Daily sudoku.
• The game you’re playing: the board, your notes and the time so far, so you can carry on later or on another device.
• Your steps, shells and hints, and every change to them with its reason.
• The games you share, and your results on the boards of links you played.
• Your steps challenges: the ones you create, join or are invited to, the steps you walk while they run, and their results, including any shells won.
• Your sessions: a session cookie, and for each session the IP address and browser it was started from and when it expires.

As a guest, the puzzles you play and their results are saved without anything that identifies you, to keep each puzzle's statistics (times played, times finished, best time).

Like every website, our servers record each request with its IP address and time, to keep the site running and secure, for example to block abuse. IP addresses are also held in memory for a minute to limit how often the site can be called.

When you sign up, a check by Cloudflare Turnstile makes sure you’re a person and not a bot, usually without you doing anything. During the check Cloudflare sees your IP address and some information about your browser and device, and uses them only for this check. It runs on the sign-up page only, and sets no cookies on our site.

To understand how people find and use the site, for example how many visit each day, which pages they read and which website sent them, we use Cloudflare Web Analytics. When a page loads, a small script from Cloudflare sends it the page’s address (without anything after a ?), the website you came from, your browser and device type, your country (worked out from your IP address) and how fast the page loaded.

It sets no cookies and stores nothing in your browser, and it doesn’t use your IP address or browser to recognise you, so it can’t follow you from one visit to the next or across other websites. We only ever see totals, never individual visitors.

When you send a message with the contact form, we receive your email address, the topic and your message, and, to help us answer, your username if you’re logged in, the page you came from and your browser. It reaches us as an email; nothing of it is stored on the site itself.

• To provide the service you signed up for (your account, saved games, steps, shells, leaderboards and account emails): this is needed to perform our agreement with you (Article 6(1)(b) GDPR).
• To keep the site and your account secure (server logs, session IP addresses, limits on failed log-ins, sign-ups and requests, and the sign-up check) and to keep play fair: this is our legitimate interest in a safe, fair service (Article 6(1)(f) GDPR).
• To understand how many people visit, which pages they read and which websites send them, so we can improve the site (visitor statistics, without cookies): this is our legitimate interest in running and improving the site (Article 6(1)(f) GDPR).
• To answer your messages from the contact form: this is our legitimate interest in helping the people who write to us (Article 6(1)(f) GDPR).

The leaderboards show everyone your username, icon, country flag (if you set a country), your place on the trail and the steps you've walked. Your email address is never shown to anyone.

When you share a game, anyone with its link sees your username, icon and place on the trail, with that game's time, mistakes and hints. When you solve a puzzle through someone's link, your username, icon, time and mistakes appear on that link's board. Guests are never named.

In a steps challenge, anyone who opens its link, guests included, sees the players’ usernames and icons, the steps each walked during it, and who won. If its creator opens it to anyone, it’s also listed, with the usernames and icons of its creator and players, under Open challenges until it starts.

Your player page, linked from the leaderboards, also shows your Daily streak, how many puzzles you have solved at each difficulty, how many of the solving techniques you have met, how many steps challenges you have won (never against whom), and the month you joined.

We only send emails about your account: confirming your email address, resetting your password, and telling you when your password or email address has changed. We don't send newsletters or marketing.

We use one kind of cookie: a session cookie that keeps you logged in. It’s strictly necessary, so it doesn’t need your consent. Guests get no cookies. We don’t use any tracking, advertising or analytics cookies: our visitor statistics work without them.

We also keep a few things in your browser’s storage, only for features you use: the game you’re playing, so you can carry on after closing the page; your light or dark mode choice; how many practice puzzles you’ve played today; and, once you’re logged in, the steps you had when you last opened the trail map, so your icon can walk to a new place. They’re needed for those features, so they don’t need your consent either. None of them tracks you, and you can clear them at any time in your browser’s settings.

• Your account and everything linked to it: until you delete your account.
• The game you’re playing: until it’s finished, you start another, or 30 days after you last played it.
• An account whose email address was never confirmed: deleted after 7 days.
• A session: until you log out, or at most 30 days.
• Server logs: at most 30 days.
• Visitor statistics: Cloudflare keeps the details of page views for 7 days, then only a reduced sample, for at most six months.
• Backups of the database: 30 days. A deleted account is gone from them within 30 days of its deletion.
• A message from the contact form: in our inbox for as long as we need it to answer you and deal with what you asked, then deleted, and at most one year.
• When your account is deleted, each puzzle's anonymous statistics (times played, times finished, best time) stay, but nothing in them points to you.

The site and its database run with Scaleway SAS, a French company, on servers in the Netherlands and France, and our emails are sent through Scaleway’s email service. On the sign-up page, Cloudflare, Inc. checks that you’re a person, and on every page it counts visits for our visitor statistics (above). They process your data only on our instructions.

The site and its database stay in the European Economic Area. Cloudflare, a US company, may handle the sign-up check and the visitor statistics outside it; that transfer is covered by the EU-US Data Privacy Framework, under which Cloudflare is certified, and by the Standard Contractual Clauses in its data processing terms.

• Access: ask us for a copy of your data.
• Correction: change your email, username, icon and country in Settings, or ask us.
• Deletion: delete your account in Settings → Account. It deletes your data at once.
• Restriction and objection: ask us to limit or stop a use of your data.
• Portability: ask us for your data in a machine-readable format.
• Complaint: you can complain to the Romanian supervisory authority (ANSPDCP, www.dataprotection.ro) or to the authority of the EU country where you live.

Write to hello@sudokuhike.com to use any of these rights. We answer within one month.

You need to be at least 16 to create an account, or have a parent's or guardian's permission.

When we change this policy, we update the date at the top. If a change matters to how your data is used, we'll tell account holders by email before it applies.