Privacy Policy

Last updated: 17 August 2026

1. Who is responsible

Cruciga is operated by Jan Sekulowicz, who decides how and why your personal data is used and is the data controller under the General Data Protection Regulation. You can reach us at privacy@cruciga.com about anything on this page.

2. What we collect

To run your account we store your email address in encrypted form, your display name, and either a password hash or, if you use Google sign-in, the identifier Google gives us. As you play we store your progress: puzzles played and the answers you gave, experience points, achievements, ratings and the words you bookmark. We also store what you contribute: forum posts, word and clue suggestions, and reports. We never ask for payment details and we never collect special-category data.

3. Why we are allowed to use it

Account and gameplay data is processed to perform the contract you enter into by creating an account. Security measures such as rate limiting and abuse prevention, error monitoring, and aggregate audience measurement rest on our legitimate interest in keeping the service running and improving it. Where we rely on legitimate interest you may object at any time using the contact details below.

4. Cookies and local storage

Cruciga sets a session cookie to keep you signed in, which is strictly necessary and lasts seven days. Your chosen language is remembered in a cookie and your theme in your browser's local storage, so the site looks the way you left it. We set no advertising cookies, no third-party tracking cookies, and nothing that follows you to other sites. Because our audience measurement stores nothing at all on your device, there is no cookie banner to dismiss.

5. How we measure audience

We count visits ourselves rather than using a third-party analytics service. Each event records an area of the app, an action and sometimes a short label such as a puzzle size or a word identifier. To avoid counting the same visitor twice in one day without identifying them, we derive a one-way code from your IP address and browser user agent using a secret that changes every day; your IP address is never stored, and the code cannot be linked back to you or matched across days. We also derive a country from your IP address and keep only that country code. Browsers sending Do Not Track or Global Privacy Control are not counted at all.

6. Who else processes your data

Amazon Web Services delivers our verification and password reset messages from its European region. Sentry receives technical error reports, configured to exclude personal data. Google authenticates you if you choose to sign in with Google, and also hosts the mailbox that receives anything you write to us. Cloudflare serves the site, protects it from attack, and forwards mail addressed to our domain to that mailbox. Each acts on our instructions under a data processing agreement, and none of them may use your data for their own purposes.

7. Where your data goes

Our servers are in the European Union. Sentry, Google and Cloudflare are established outside the European Economic Area, so those transfers rely on the European Commission's adequacy decisions or on standard contractual clauses, together with the safeguards those providers publish.

8. How long we keep it

Account and gameplay data is kept for as long as your account exists. When you delete your account your email address is overwritten, your name is removed and your sign-in details are erased immediately, while your contributions stay available to other players with no name attached, as the Terms explain. Raw audience measurement events are deleted after roughly thirteen months; the daily totals derived from them contain no identifiers and are kept indefinitely.

9. Your rights

You may ask for a copy of your data, correct it, have it erased, restrict or object to how we use it, and receive it in a portable form. You can change your name and email address, and delete your account outright, from your account settings. For anything else, write to us using the contact details below. You also have the right to complain to your national data protection authority.

10. Changes to this policy

If we change how we handle your data we will update this page and change the date shown at the top. Where a change materially affects you we will tell you in the app before it takes effect.

11. Contacting us

Write to privacy@cruciga.com with any question about this policy or about the data we hold on you. We aim to answer within thirty days, the period the General Data Protection Regulation allows.