Privacy Policy

Who we are and this policy's scope

Puzzle Battle is operated by Dosagas LLC, 306 W Redwood St STE 201, Baltimore, MD 21201. For privacy questions or requests, email hello@puzzlebattle.games.

This policy applies to the current Puzzle Battle website and to a later Puzzle Battle service only when that service expressly links to this policy after its actual practices have been reviewed. We will review and update this policy before launching a materially different data practice or a new service.

Information we process

Information you provide

Joining the waitlist is voluntary. We process your email address, a record of your assent (including the current consent version, time, signup source, and limited attribution such as the selected game), a representation that you are at least 13, and limited operational information about the submission and email synchronization. Email addresses are normalized to lowercase.

After joining, you may choose to answer an optional survey. It is linked to your waitlist submission and may include your game preferences, choices about competitive play, and free-text feedback. Do not include information you do not want us to process in free-text responses. We also process messages and feedback you send us.

Gameplay and challenge information

Starting a fixed-target race creates a record of the game, random seed, selected solved-puzzle target, start time, completion time when finished, and any reused challenge relationship. It also has an eight-character public short ID. A person with a finished challenge link can view the game, target, and completion time and can replay the same seeded puzzle sequence. The seed is used to replay the challenge but is not returned in the public result response. Challenge links are not secret credentials, and users may copy or disclose them.

When you create a share link, we also create an opaque, random referral token associated with that finished challenge. The token does not contain your name, email address, race result, or browser identifier. If someone opens a valid token, we record that an aggregate referral link was opened and which game it promoted; we do not learn the recipient's identity or sharing destination.

Technical, security, and analytics information

We and providers operating the website may process IP address, request URL and headers, timestamps, browser, device, user-agent, referrer, operational, and error information. Our API routes use the first x-forwarded-for value for in-memory rate limiting; the application does not persist that rate-limit value in its own database.

When configured, PostHog initializes an in-memory pseudonymous identifier for the current page load; it does not use PostHog cookies or persistent browser storage. Its current browser setup disables automatic capture, pageviews, page-leaves, and session recording. We use a small set of product events for game-route views, user-selected game changes, fixed-target race starts and results, player-initiated shares, opened referral links, and an accepted voluntary waitlist signup. Where a link contains our controlled campaign parameters, we also process the source, campaign, message, and creative IDs to understand which entry points lead to play. We do not call PostHog identify or intentionally send email addresses, free-text responses, board input, survey answers, challenge IDs, referral tokens, full URLs, or raw referrers to PostHog. This does not make analytics information anonymous.

Sources and how we use information

We receive information directly from you, automatically from your browser or request, and from service providers that operate the service. We use it to:

• provide puzzle gameplay, fixed-target races, and shareable challenge links;
• maintain waitlist and optional survey state, and send requested product, waitlist, marketing, or playtest messages;
• understand product usage and return behavior, debug, and improve the service;
• secure the service, rate limit, prevent abuse, and investigate errors; and
• comply with law and establish, exercise, or defend legal claims.

Cookies and similar storage

We use a 30-day, HttpOnly, Secure, SameSite=Lax cookie named puzzle_battle_waitlist after a waitlist signup. It contains an opaque random value; our database stores a digest rather than the raw value. It lets us associate that browser with a signup so the optional survey can be loaded and saved. For up to 30 days after this rename, we also accept the preceding cookie name only to preserve access to an existing survey.

We also use session storage for waitlist-modal state (until the browser session ends) and local storage for per-game “how to play” state (until cleared or replaced). When analytics is enabled, local storage also holds a pseudonymous, 30-minute inactivity-bounded analytics-session record and controlled campaign context. These are functional preferences or analytics storage as applicable. When configured, PostHog uses memory only for the current page load and does not set PostHog cookies or write persistent browser storage. Blocking or clearing storage may affect saved preferences or analytics-session continuity, but browser settings are not a substitute for a consent choice where law requires consent.

An EEA/UK analytics choice before nonessential analytics storage is not yet implemented. Before enabling analytics for EEA/UK traffic, we must implement that consent choice; this policy is a transparency notice, not consent where consent is required.

Legal bases for EEA/UK visitors

Where EEA/UK law applies, we rely on consent for marketing email and voluntary survey processing, and on consent for nonessential analytics or storage where required. We rely on performance of your request and/or legitimate interests for requested gameplay and challenge functionality; legitimate interests for proportionate security, fraud prevention, debugging, and service improvement where allowed; and legal obligations or legal claims where applicable. Withdrawing consent does not affect processing already lawfully performed.

Processors and disclosures

We use Netlify for application hosting, serverless functions, networking, and operational logs; Neon for PostgreSQL database services; Kit for waitlist subscriber management and email delivery; and PostHog for product analytics. We may also disclose information to professional advisers, authorities or other parties when legally required or needed for safety and security, and a successor in a merger, financing, acquisition, reorganization, or sale, subject to appropriate notice or protection where required.

We do not sell personal information, use cross-context behavioral advertising, or operate third-party ad networks. We do not currently respond to Do Not Track signals because our PostHog setup does not explicitly enable that setting. Because we do not sell or share information for cross-context behavioral advertising, we do not currently offer a Global Privacy Control sale/share opt-out.

International processing and retention

Dosagas LLC is based in the United States. Our providers or their subprocessors may process information in the United States or other countries, where protections may differ. We will use appropriate safeguards where required, but do not make claims here about particular transfer mechanisms or provider agreements that have not been verified.

The waitlist-association cookie and its associated submission state expire after 30 days. Session storage lasts for the browser session, and local preferences remain until cleared or replaced. We retain unfinished race sessions for up to 48 hours and finished challenge results for up to 90 days. We retain identifiable survey answers for up to 18 months. We retain active waitlist records while you remain subscribed or until a valid deletion request; after that, we retain only a minimal suppression or compliance record where needed. We retain PostHog analytics events for up to 90 days. Share referral tokens stop resolving after 90 days, and their challenge association is retained under the same up-to-90-day challenge schedule. We review these schedules manually while the service is in its early validation phase. Provider logs may have their own operational retention periods.

Your choices and rights

You can unsubscribe using the link in our emails. To withdraw marketing permission or request access, correction, deletion, restriction, objection, or portability where those rights apply, email hello@puzzlebattle.games. We may need to verify your identity before responding. We do not currently provide self-service survey deletion or an in-product analytics preference control.

Authorized agents may make requests where permitted by law, subject to verification. We will not unlawfully discriminate against you for exercising applicable privacy rights. You may have a right to appeal a decision about a request or complain to a regulator; EEA/UK visitors may complain to their local supervisory authority. Residents of applicable U.S. states may use the same contact address for state privacy requests.

Children, security, and automated decisions

Puzzle Battle is a general-audience service and is not directed to children under 13. Ordinary gameplay does not have an age gate. We do not knowingly seek personal information from children under 13; children under 13 should not submit waitlist email or survey information. Joining the waitlist requires a person to represent that they are at least 13, but we do not collect birth dates or otherwise verify age. A parent or guardian may ask us to delete such information at hello@puzzlebattle.games.

We use reasonable administrative, technical, and organizational safeguards, but no service can guarantee absolute security. The current service does not use personal information to make decisions with legal or similarly significant effects. Gameplay generally does not require an email; an email is needed only to join the waitlist, the survey is optional, and some technical processing is necessary to deliver and secure the website.

Third-party links, sharing, and changes

The service may link to third-party websites or use your browser's share or clipboard features. Your browser, operating system, or chosen sharing app may process a sharing action; Puzzle Battle does not receive the destination or recipient merely because you use those features. A valid Puzzle Battle referral token lets us measure that the shared link was opened, but does not identify the recipient. Third-party services have their own privacy practices.

We may update this policy as the service changes. For a material change, we will provide appropriate notice and update the date above. We will review this policy before launching a materially new data practice or a new service. Questions may be sent to hello@puzzlebattle.games.