Privacy Notice
1.Who is responsible
| Controller | Stefan Topalov, Bulgaria, operating the site as a private individual |
| Contact | privacy@thechallenge.day |
| Supervisory authority | Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — cpdp.bg |
Requests concerning your personal data can be sent to the contact address above and will be answered within one month, as Regulation (EU) 2016/679 (the GDPR) requires.
2.What this notice covers
This notice describes the personal data processed by The Challenge, the puzzle website named above, also reached through games-portal.stefantopalov.workers.dev (the "Site"), including every game reached from it and the History page. It does not cover Google's own processing when you use Google Sign-In, which is governed by Google's Privacy Policy.
3.Playing without an account
No account is needed to play. When you use the Site without signing in, the Site itself stores no personal data about you. The pages are delivered by Cloudflare, whose network keeps short-lived technical request logs (including IP addresses) for the operation and security of its service; those logs are held by Cloudflare under its own terms and are not read by the Site.
The Site measures its own traffic with Cloudflare Web Analytics: a small script on each page reports to Cloudflare which page was viewed, the page that linked to it, the browser and device type, the country the request came from, and how long the page took to load. It sets no cookie and stores nothing in your browser, it does not identify you or follow you across sites, and the Site sees only aggregate counts. Cloudflare processes these reports under the same Data Processing Addendum as the hosting (section 7). There is no advertising and no other third-party tracking of any kind.
4.Data processed when you sign in
You can sign in with Google, or create an account with your email address and a password. The following data is then held on the Site's own database.
| Category | Data | Source |
|---|---|---|
| Identity | Your name and email address, and — with Google — the address of your profile picture. | Google, at sign-in; or you, at sign-up |
| Account link | With Google: an opaque identifier linking your Site account to your Google account. The access, refresh and identity tokens issued by Google are used for the duration of sign-in and are not retained. | Google, at sign-in |
| Password | With email sign-up: your password, stored only as a salted hash (scrypt), which cannot be turned back into the password. A one-time link to confirm your address, and one to reset the password when you ask for it, are kept until used or expired (24 hours and 1 hour). | You |
| Session | A random session identifier and its expiry. No IP address or browser details are stored with it. | The Site |
| Preferences | The version of the Terms of Use you accepted and when; the games you have marked as favourites; a display name, if you set one on the Account page in place of the name from Google or sign-up. | You |
| Game records | For each daily puzzle you finish while signed in: the game, the puzzle date, the time, move count (where the game counts moves), whether Hint or Solve was used and the finished arrangement — both of your first finish of the puzzle, which is the one that counts, and of your best; the number of attempts; whether the first finish was made on the puzzle's own day, as reported by your browser's clock and time zone; and the time of day each result was recorded. | Your play |
Your finishing times are also counted, without your name or any other identifier, into the day's totals that every player sees as "faster than 62%" or "4th of 9 today". Nothing else is read from your Google account. Email is sent to you only to confirm your address when you sign up and to reset your password when you ask; nothing else, ever. No profiling takes place and no decision with legal or similarly significant effect is made about you by automated means.
5.Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing your account and keeping you signed in | Identity, account link, session | Performance of a contract — Art. 6(1)(b) GDPR |
| Recording and showing your game history, your streaks, and where your time stands among the day's players | Game records (yours, and — as anonymous counts and times only — other players') | Performance of a contract — Art. 6(1)(b) GDPR |
| Remembering your preferences | Preferences | Performance of a contract — Art. 6(1)(b) GDPR |
| Evidencing acceptance of the Terms of Use | Terms version and date | Legitimate interest in being able to demonstrate agreement — Art. 6(1)(f) GDPR |
| Security and abuse prevention | Session; server-side validation of submitted results | Legitimate interest in the integrity of the Site — Art. 6(1)(f) GDPR |
No data is processed for marketing, and no data is sold or shared for any third party's own purposes.
7.Recipients and processors
| Recipient | Role | Safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosts the Site and its database (Cloudflare Workers and D1) and measures its traffic (Cloudflare Web Analytics, section 3). | Cloudflare's Data Processing Addendum, incorporating the EU Standard Contractual Clauses |
| Google LLC | Identity provider for Google Sign-In. | Independent controller; Google Privacy Policy |
| Resend, Inc. | Delivers the confirmation and password-reset emails (your email address and the link in the message). | Resend's Data Processing Agreement, incorporating the EU Standard Contractual Clauses |
No other recipient receives personal data from the Site. Data may be disclosed where the law requires it.
8.Where data is stored
The Site's database is located in Cloudflare's Western Europe region, within the European Union. Cloudflare's global network may process requests in transit outside the EU; such transfers are covered by the Standard Contractual Clauses referenced above.
9.Retention
| Data | Kept for |
|---|---|
| Identity, account link, password hash, preferences | As long as your account exists |
| Confirmation and reset links | Until used; unused ones expire after 24 hours (confirmation) or 1 hour (reset) and are deleted by a daily clean-up |
| Game records | As long as your account exists — they are your history |
| Sessions | 30 days from last use; expired sessions are purged daily |
| One-time sign-in tokens | Minutes; purged daily once expired |
| Daily totals | Indefinitely — they identify no one (see below) |
Deleting your account removes every row above that relates to you immediately and permanently. What remains are the Site's daily totals: for each day, how many puzzles of each game were finished, by how many players, how many accounts were created, active and deleted. They are worked out once a day, hold numbers only — no name, email, identifier or time of yours — and cannot be traced back to you, so they are not personal data and are kept so that the Site's usage history stays accurate after accounts are deleted.
10.Your rights
Under the GDPR you have the following rights, all of which are free of charge. The first three can be exercised directly on the Site without contacting anyone.
- Access and portability — the History page shows your play and the Account page everything else held about you; the "Download my data" button there provides the complete set as a machine-readable JSON file (Art. 15 and 20).
- Erasure — the "Delete my account" button on the Account page removes your account and all associated data immediately (Art. 17).
- Rectification — with Google, your name and picture come from your Google account: update them there and sign in again; with email sign-up, write to the contact address to change the name or address on your account (Art. 16).
- Restriction and objection — you may ask for processing to be restricted, or object to processing based on legitimate interest, by writing to the contact address (Art. 18 and 21).
- Complaint — you may lodge a complaint with the Commission for Personal Data Protection or with the supervisory authority of your own EU member state (Art. 77).
11.Children
The Site is not directed at children and does not knowingly hold an account for anyone under 14, the age from which Bulgarian law permits a minor to agree to online services on their own behalf. If you believe such an account exists, contact the address above and it will be deleted.
12.Security
All traffic is encrypted in transit (HTTPS). Sessions are opaque identifiers that can be revoked server-side. Passwords are never stored in the clear, only as salted hashes; a password reset signs every other session out. Submitted results are validated on the server, and only the minimum data described in section 4 is retained. Should a personal data breach occur that is likely to result in a risk to you, you will be informed as the GDPR requires.
13.Changes to this notice
This notice is updated whenever the data processed by the Site changes. The effective date at the top identifies the current version. Material changes will be indicated on the Site.