Privacy Notice
1.Who is responsible
| Controller | Stefan Topalov, Bulgaria, operating the site as a private individual |
| Contact | stefan_topalov@yahoo.com |
| Supervisory authority | Commission for Personal Data Protection (CPDP), Sofia, Bulgaria — cpdp.bg |
Requests concerning your personal data can be sent to the contact address above and will be answered within one month, as Regulation (EU) 2016/679 (the GDPR) requires.
2.What this notice covers
This notice describes the personal data processed by The Challenge, the puzzle website named above, also reached through games-portal.stefantopalov.workers.dev (the "Site"), including every game reached from it and the History page. It does not cover Google's own processing when you use Google Sign-In, which is governed by Google's Privacy Policy.
3.Playing without an account
No account is needed to play. When you use the Site without signing in, the Site itself stores no personal data about you. The pages are delivered by Cloudflare, whose network keeps short-lived technical request logs (including IP addresses) for the operation and security of its service; those logs are held by Cloudflare under its own terms and are not read by the Site. The Site uses no analytics, no advertising and no third-party tracking of any kind.
4.Data processed when you sign in
Signing in is by Google Sign-In only. The following data is then held on the Site's own database.
| Category | Data | Source |
|---|---|---|
| Identity | Your name, email address and the address of your profile picture. | Google, at sign-in |
| Account link | An opaque identifier linking your Site account to your Google account. The access, refresh and identity tokens issued by Google are used for the duration of sign-in and are not retained. | Google, at sign-in |
| Session | A random session identifier and its expiry. No IP address or browser details are stored with it. | The Site |
| Preferences | The version of the Terms of Use you accepted and when; the games you have marked as favourites. | You |
| Game records | For each daily puzzle you finish while signed in: the game, the puzzle date, your best time, the number of attempts, the number of moves where the game counts them, whether Hint or Solve was used, and the finished arrangement. | Your play |
Your finishing times are also counted, without your name or any other identifier, into the day's totals that every player sees as "faster than 62%" or "4th of 9 today". Nothing else is read from your Google account. No profiling takes place and no decision with legal or similarly significant effect is made about you by automated means.
5.Purposes and legal bases
| Purpose | Data used | Legal basis |
|---|---|---|
| Providing your account and keeping you signed in | Identity, account link, session | Performance of a contract — Art. 6(1)(b) GDPR |
| Recording and showing your game history, your streaks, and where your time stands among the day's players | Game records (yours, and — as anonymous counts and times only — other players') | Performance of a contract — Art. 6(1)(b) GDPR |
| Remembering your preferences | Preferences | Performance of a contract — Art. 6(1)(b) GDPR |
| Evidencing acceptance of the Terms of Use | Terms version and date | Legitimate interest in being able to demonstrate agreement — Art. 6(1)(f) GDPR |
| Security and abuse prevention | Session; server-side validation of submitted results | Legitimate interest in the integrity of the Site — Art. 6(1)(f) GDPR |
No data is processed for marketing, and no data is sold or shared for any third party's own purposes.
7.Recipients and processors
| Recipient | Role | Safeguard |
|---|---|---|
| Cloudflare, Inc. | Hosts the Site and its database (Cloudflare Workers and D1). | Cloudflare's Data Processing Addendum, incorporating the EU Standard Contractual Clauses |
| Google LLC | Identity provider for Google Sign-In. | Independent controller; Google Privacy Policy |
No other recipient receives personal data from the Site. Data may be disclosed where the law requires it.
8.Where data is stored
The Site's database is located in Cloudflare's Western Europe region, within the European Union. Cloudflare's global network may process requests in transit outside the EU; such transfers are covered by the Standard Contractual Clauses referenced above.
9.Retention
| Data | Kept for |
|---|---|
| Identity, account link, preferences | As long as your account exists |
| Game records | As long as your account exists — they are your history |
| Sessions | 30 days from last use; expired sessions are purged daily |
| One-time sign-in tokens | Minutes; purged daily once expired |
Deleting your account removes every row above immediately and permanently.
10.Your rights
Under the GDPR you have the following rights, all of which are free of charge. The first three can be exercised directly on the Site without contacting anyone.
- Access and portability — the History page shows everything held about you; the "Download my data" button in its account section provides the complete set as a machine-readable JSON file (Art. 15 and 20).
- Erasure — the "Delete my account" button on the same page removes your account and all associated data immediately (Art. 17).
- Rectification — your name and picture are supplied by Google; update them in your Google account and sign in again (Art. 16).
- Restriction and objection — you may ask for processing to be restricted, or object to processing based on legitimate interest, by writing to the contact address (Art. 18 and 21).
- Complaint — you may lodge a complaint with the Commission for Personal Data Protection or with the supervisory authority of your own EU member state (Art. 77).
11.Children
The Site is not directed at children and does not knowingly hold an account for anyone under 14, the age from which Bulgarian law permits a minor to agree to online services on their own behalf. If you believe such an account exists, contact the address above and it will be deleted.
12.Security
All traffic is encrypted in transit (HTTPS). Sessions are opaque identifiers that can be revoked server-side; no passwords are stored, because sign-in is delegated to Google. Submitted results are validated on the server, and only the minimum data described in section 4 is retained. Should a personal data breach occur that is likely to result in a risk to you, you will be informed as the GDPR requires.
13.Changes to this notice
This notice is updated whenever the data processed by the Site changes. The effective date at the top identifies the current version. Material changes will be indicated on the Site.