Privacy Policy
Last updated: 16 March 2026
This policy explains what information Daily Sudoku collects and how it is used. The site is operated by Paul Round (United Kingdom). Contact: pauledwardround@gmail.com — please mention Daily Sudoku in the subject line.
Summary
- Solo play does not require an account. Progress is stored mainly in your browser.
- Leagues (optional) use a free email sign-in; finish times and usernames are stored on our database provider to run standings and invites.
- Advertising on the play page may use Google AdSense. In the UK and EEA, Google’s certified consent messaging handles advertising cookies and choices.
- We do not sell your personal data.
Data controller
Paul Round is the data controller for personal data described here. Hosting and league infrastructure use third-party processors listed below.
Solo play — stored on your device
When you play without signing in, the site may store the following in your browser localStorage (and similar storage):
- In-progress puzzle state (grid, notes, timer, mistakes, hints used)
- Theme preference (light or dark)
- Last difficulty selected for a given puzzle day
- League race timing helpers when you open a league puzzle link
This information is not sent to us automatically for solo play. You can delete it by clearing site data for this website or using in-game reset controls.
Leagues — account and leaderboard data
If you use Leagues, we process data through Supabase (authentication and database):
- Email address and authentication identifiers (when you sign up or sign in)
- Username you choose (shown on standings)
- League membership, invite codes, and league settings (name, difficulty)
- Daily puzzle completion: date, difficulty, pass/fail, time in seconds, submission counts
This data is used to operate invite links, today’s standings, and fair daily races. It is not used for unrelated marketing unless you separately agree to that. Supabase acts as a processor; see Supabase’s privacy policy.
Advertising and cookies
We may display advertising through Google AdSense on the main play page. Ad units are placed below the grid controls, not over interactive play elements. Google may set cookies or use similar technologies to serve and measure ads.
Visitors in the UK and European Economic Area see Google’s Privacy & messaging consent flow (a Google-certified CMP under IAB TCF). Your choices there control personalised advertising cookies. You can also manage ad personalisation via Google Ads Settings and your browser controls. See Google’s Privacy Policy and How Google uses cookies in advertising.
We publish an ads.txt file authorising our AdSense inventory.
Other third-party services
- Netlify — hosts static pages and puzzle files (standard web server logs).
- Supabase — leagues auth and database (see above).
- Google / AdSense — display advertising and consent messaging on the play page.
- jsDelivr CDN — delivers the Supabase client library on league and play pages that use sign-in.
We do not embed social login widgets or unrelated analytics trackers beyond what is listed here.
Legal bases (UK / EEA GDPR)
- Contract / service — running the game, leagues, and standings you ask for.
- Consent — non-essential advertising cookies where required.
- Legitimate interests — security, abuse prevention, and keeping the service reliable, balanced against your rights.
Retention
- Browser-stored solo data — until you clear it or reset a puzzle.
- League account and standings — while your account exists and as needed for daily leaderboards; contact us to request deletion.
- Emails you send us — as long as needed to respond, unless law requires longer retention.
Your rights
Depending on where you live, you may have rights to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability. League users can request account deletion by email; we will delete or anonymise league rows tied to your account where feasible.
Children
Sudoku is suitable for a general audience. Leagues require an email address and are intended for users who can lawfully consent to online accounts in their jurisdiction (typically 13+ or with parental consent). We do not knowingly collect personal data from young children without appropriate consent.
International transfers
Supabase and Google may process data in the United States and other countries. Providers use appropriate safeguards (such as standard contractual clauses) where required.
Changes
We may update this policy. The “Last updated” date will change when we do. Material changes will be described on this page.
Contact
About · How to play · FAQ