Privacy policy

This policy describes personal data used by Sudoku.so’s current website and account service. It follows the service’s implemented features and is updated as those features change.

Who operates the service

Sudoku.so is operated by Jonas Arnklint. Keep passwords, reset links and private account information confidential.

Information processed

When you register, the account service stores your email address, a password hash, verification status and account timestamps. Passwords are hashed rather than stored as readable text. Sessions and one-time verification or reset tokens are stored as hashes with expiry times. If you use an available external sign-in provider, the service also stores the provider and its user identifier to link the login to your account.

These details support account creation, authentication, security and account recovery. Verification and password-reset emails are sent through Postmark. Open tracking and link tracking are disabled in the email-sending code.

Saved games and scores

When you use account-based game saving, Sudoku.so stores your current puzzle and progress, previous games and submitted completion times with your account identifier. This lets you resume play, review games and use the score features.

Website analytics

Sudoku.so loads PostHog to understand usage and improve the game. This can involve technical information about your browser and device, page visits, interactions and browser or session identifiers. PostHog also provides feature flags. Depending on provider settings, usage tools may collect interaction recordings.

The application explicitly sends PostHog events for launching a game, starting a new game with its difficulty, and finishing a game with its completion time. PostHog requests use ph.sudoku.so, with the project configured for PostHog’s EU service. This address does not mean all analytics data stays within Sudoku.so’s own systems.

The current website loads PostHog automatically. See the cookie policy for the current behavior and browser controls.

Technical requests and embedded videos

Hosting and account infrastructure receive technical network information, such as your IP address and requested resources, to deliver and secure the service. Articles containing YouTube embeds can also cause your browser to send network information to Google when embedded content loads.

Service providers

The website is configured for Vercel hosting. The account service uses Cloudflare Workers and D1, and Postmark handles account emails. PostHog provides usage tools. An external sign-in provider or embedded-video provider receives information when you use its features.

Providers may process data in other countries under their applicable terms and safeguards. Their privacy information explains their own processing; this page does not promise that every provider processes data exclusively in the EU.

Retention

Account sessions expire after 30 days. Email verification links expire after 24 hours, password-reset links after 1 hour, and external sign-in cookies after 10 minutes. Token expiry limits use of the token; it does not itself guarantee deletion of the underlying database row.

Account records, saved games and scores remain stored by the service until removed. The application does not currently define an automatic deletion period for all account data, analytics data or infrastructure logs. Analytics retention depends on provider and project settings. Clearing browser cookies does not remove server-side records.

Your choices and rights

You can play without creating an account. Signing out invalidates the current account session. Browser privacy controls can restrict analytics requests and storage, as described in the cookie policy.

Depending on applicable data-protection law and the processing involved, you may have rights to access, correct or erase personal data, restrict processing, object to processing or request data portability. The website does not currently offer a self-service account-deletion control. You can also contact your local data-protection authority, such as Sweden’s Integritetsskyddsmyndigheten.

More information

Last updated: 28 October 2026.