Privacy Policy
Mt. Sudoku is a free, non-commercial puzzle site. It shows no advertising, has no user accounts, and sets no tracking cookies. This page explains the little personal data that is processed when you use mtsudoku.com, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Controller
The data controller responsible for processing personal data on this site is Stuart Bell.
Email: [email protected]
2. What we process and why
a) Server logs. When you load any page, our hosting and content-delivery providers automatically record technical information so the page can be served and protected against abuse: your IP address, user agent, the URL requested, the response status, and the timestamp. Lawful basis: Article 6 (1) (f) GDPR (legitimate interest in operating a secure site). Retention: typically up to 30 days at the provider level.
b) Visitor statistics. We use Cloudflare Web Analytics to count page views and see which pages are used. It sets no cookies, uses no local storage, and does not fingerprint your device or build a profile of you; only aggregated figures are reported to us. Lawful basis: Article 6 (1) (f) GDPR (legitimate interest in understanding how the site is used).
c) Local game state. Your in-progress board, statistics, streak, difficulty choice, and colour-mode preference are kept in your browser's localStorage so the site remembers them between visits. This data stays on your device and is never sent to us. You can clear it at any time through your browser's site-data settings.
d) Email. If you write to us, we use your email address and message only to reply. Lawful basis: Article 6 (1) (f) GDPR. Retention: until the conversation is finished, unless a longer period is required by law.
3. Recipients
We use the following processors to operate the site. Each one processes data on our behalf under a data-processing agreement according to Article 28 GDPR.
| Provider | Purpose | Location of processing |
|---|---|---|
| Vercel Inc., USA | Application hosting | Global edge; primary region: EU (Frankfurt) |
| Cloudflare, Inc., USA | DNS, content delivery, security, visitor statistics, email routing | Global edge |
| Supabase Inc., USA | Database for the daily puzzles (no personal data) | EU (Frankfurt, eu-central-1) |
| Google Ireland Limited, Dublin, Ireland | Mailbox for emails sent to the contact address | EU and global; US transfers covered by the EU–US Data Privacy Framework |
4. Transfers outside the EU/EEA
Vercel, Cloudflare, and Supabase are organised in the United States. Where data is processed in the United States, transfers are protected either by certification under the EU–US Data Privacy Framework or by Standard Contractual Clauses adopted by the European Commission. You can request a copy of the relevant safeguards at [email protected].
5. Cookies and similar technologies
This site sets no cookies. It uses your browser's localStorage only for the strictly necessary game and display settings described in section 2 (c). Because nothing beyond what is strictly necessary is stored on your device, no consent banner is shown.
6. Your rights
Under the GDPR, you have the right to:
- request access to the personal data we hold about you (Article 15)
- have inaccurate data corrected (Article 16)
- have your data erased (Article 17)
- have processing restricted in defined cases (Article 18)
- receive your data in a portable format (Article 20)
- object to processing based on our legitimate interests (Article 21)
To exercise any of these rights, write to [email protected].
7. Right to lodge a complaint
You have the right to complain to a supervisory authority if you believe our processing of your data is unlawful. The competent authority is:
Berliner Beauftragte für Datenschutz und InformationsfreiheitAlt-Moabit 59–6110555 Berlin[email protected]https://www.datenschutz-berlin.de
8. Changes to this policy
We update this policy when our processing changes. The date below shows the most recent change.
Last updated: 15 October 2026