Privacy policy

1. Controller

Vulpes Sagax UG (haftungsbeschränkt), represented by its managing director Korbinian Hermann, Alburger Hauptstraße 57, 94315 Straubing, Germany.
Email: korbi@vulpessagax.com

2. Hosting & sign-in

The service is available at sudokusagax.com. The server it runs on is located in a data centre of IONOS SE (Elgendorfer Straße 57, 56410 Montabaur, Germany) in Berlin. The domains and the mailbox for emails to us are operated by netcup GmbH (Emmy-Noether-Straße 10, 76131 Karlsruhe, Germany). We handle sign-in ourselves. You can choose between two ways: your Google account or Sign in with Apple. In both cases we check the credential that the respective service issues for this and create an account for you with us. The service you choose learns that you are signing in here: for Google that is Google LLC (USA), for Apple Apple Distribution International Ltd. (Ireland). From Google we receive an identifier and your email address, but not your name. Your display name is generated at random when your account is created (for example “Fuchs-3fa2c1”), and you can change it at any time. From Apple we receive an identifier and, if you agree, your email address. Apple sends your name only with your very first sign-in; after that, no longer. We do not use this name. Apple also offers to hide your address ("Hide My Email"). If you choose this, instead of your real address we receive a forwarding address at privaterelay.appleid.com; Apple forwards mail sent to this address to you, and we do not learn your real address. With neither of the two ways do we store the address itself, only a fingerprint of it (see section 3). If you later sign in through the other service, this usually leads to the same account and not to a second one. This requires both services to give us the same address: if you hide it with Apple or we receive none from there at all, we cannot recognise the connection, and a second account is created. You actively choose the way, and it is necessary so that your account can be created (Art. 6(1)(b) GDPR); what Google or Apple process themselves in doing so is set out in their privacy policies. After sign-in we set our own session cookie (__Host-sagax_sitzung) so that you stay signed in; it contains a random identifier and nothing else. Accounts that were previously created via the IEX-Labs Auth-Hub continue to exist with us; the hub is no longer used for sign-in. No advertising and no tracking services are used; fonts are served locally (no connection to Google Fonts or similar).

2b. The app from the stores

You get the app from Apple's App Store or from Google Play. Apple and Google themselves are responsible for the download, installation and ratings in the stores; their privacy policies apply to this. Within the app itself, this policy applies. If the app asks you for a rating, it opens the system rating dialog of Apple or Google for this. Whether it appears is decided by the system, and we do not learn whether or how you rate.

3. What data we process

• Identity/account: We store an account identifier, the identifier of your sign-in method with Google or Apple (both, if you use both ways for the same account), a locally changeable display name and, if you upload one, your profile picture. In addition, a session for each signed-in device (random identifier, time, expiry). No passwords and no email addresses in plain text. For accounts from the time of the IEX-Labs Auth-Hub, its user ID is still stored as the identifier.
• Fingerprint of your email address: Our own sign-in is in operation (so your account no longer depends on a third-party service). So that your progress was not lost during the switch and so that we can assign you to the same account when you sign in again, we store with your account a fingerprint (hash value) of your email address. We do not store the address itself. The fingerprint is created with a deliberately slow method (scrypt) and a random value that exists only in our database; it practically cannot be reversed and does not match any fingerprint from another database. Its sole purpose is to recognise you during a later switch: if you then sign in with the same address, you get your progress without having to do anything. We cannot contact you with it. The legal basis is our legitimate interest in ensuring that nobody loses their game progress (Art. 6(1)(f) GDPR). Once the switch is complete, we delete the fingerprint, at the latest on 31 December 2027.
• Game data: progress, best times, points, stars, results of the daily challenge and of a season, games in progress.
• Playing per platform: When you solve a puzzle with an account, we note for that day your account identifier, the date and whether you played in the browser, in the iOS app or in the Android app. We only evaluate this as a total, for example how many people played in the app on a given day; we do not hand out individual entries or show them to anyone. The legal basis is our legitimate interest in knowing on which platforms the game is used, so that we can allocate work and costs sensibly (Art. 6(1)(f) GDPR). The entries are deleted after 90 days, and immediately together with your game data or your account.
• Visible to others: Your display name, your profile picture, your fox rank and your points appear in the leaderboards, in duels and in the leaderboard of a season, where they are visible to all other players. Leaderboards are part of the game (Art. 6(1)(b) GDPR). Apart from us, nobody sees your account identifier, your sign-in method or the fingerprint of your address.
• Feedback (Report a bug or idea): If you send us a message, we store its type (bug or idea), your text, the app version, the time and your account identifier, so that we can handle your request and find the bug. We also forward the text to ourselves by email, together with your display name, but without your account identifier and without your email address. For this sending we use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as a processor under Art. 28 GDPR; Brevo is based in the EU and, according to its own information, processes the data on servers in the EU. Please only write in the message what we need to know for your request. The legal basis is our legitimate interest in fixing bugs and answering requests (Art. 6(1)(f) GDPR). The feedback is deleted together with your account.
• Reports and blocks: If you report a profile, for example because of an offensive name or picture, we store who reported whom, the reason given and the time, so that we can review the case. If you block someone, we store whom you have blocked; this only affects your own view. The reported or blocked person does not learn by whom. The legal basis is our legitimate interest in safe and respectful interaction in the game (Art. 6(1)(f) GDPR). If either of the two accounts is deleted, the reports and blocks between them disappear as well.
• Invitations: generated invitation codes and their use.
• Streak reminder (push, optional): If you activate the daily reminder for your daily streak, we store the push endpoint provided by the browser together with the associated encryption keys, your account identifier, your language and your time zone offset, in order to send you a notification at the right time (Art. 6(1)(a) GDPR, consent). In addition, we note when a reminder was last sent and when you set it up. Technically, the notification is delivered via the push service of your browser vendor, depending on the device Google LLC, Mozilla, Apple or Microsoft; all four are based in the USA. We do not choose this service, it is determined by your browser, and we have no contract of our own with it. The transfer is therefore based on your explicit consent (Art. 49(1)(a) GDPR); we have no safeguards under Art. 46 GDPR for this route. If you do not want this, simply do not switch on the reminder. You can switch the reminder off again in the game at any time; the endpoint is then deleted.
• Registration: If you sign up in order to play, we process your account identifier and your display name in order to give you access to the game and to store your progress permanently (Art. 6(1)(b) GDPR, provision of the service you requested). Your email address is processed only briefly to create the fingerprint (see above); only the fingerprint is stored. We have deleted the entries from the former email waiting list, which has been switched off; they may still be contained in backup copies until those expire, at the latest until 31 December 2026.

3b. Event counting (no personal data)

To see whether the game is well received, we count events: how often the start page was opened, a puzzle started, one solved, "Register" tapped, an account created, a referral link copied, a puzzle type requested or the notice seen that you cannot continue without an account. In Foxhold we additionally count how a run ends: started, abandoned, lost or won, plus the level or the wave and, in the case of a win, whether the den stayed intact. Of this, only one counter per day, event and variant is stored, for example "on 19 Aug a puzzle was started 40 times".

We count events, not people. No row per person is created, no identifier, no profile, nothing that could recognise anyone again; no cookies are set for this and no IP addresses are stored. From the figures it is impossible to infer who did something, or whether two events belong to the same person. The legal basis is our legitimate interest in a working service (Art. 6(1)(f) GDPR); this involves no personal data.

As the "variant", depending on the event, the difficulty, the place of the click or, for a visit via an advertising link, the campaign name from ?src= is counted as well. This is a word we assign ourselves, such as meta-feed, and says nothing about you. Without such an addition we only note which website someone came from (only the host name, never the full address), or "direct".

4. Purposes & legal bases

Provision of the game and the user account as well as the leaderboards (Art. 6(1)(b) GDPR, user relationship) and secure, trouble-free operation (Art. 6(1)(f) GDPR, legitimate interest).

5. Local storage in the browser

We set cookies for sign-in, and only for that:

• Our own session cookie (__Host-sagax_sitzung) when you sign in with us. It contains a random string and nothing else: no name, no address. The server holds only a fingerprint of it, not the value itself.
• A short-lived cookie during the sign-in process (__Host-sagax_anmeldung), so that the return from the sign-in service belongs to exactly your browser. It expires after ten minutes and is deleted immediately after sign-in.

Beyond that we set no cookies, and in particular no advertising or tracking cookies.

In your browser's storage we keep the following values. Most of them never leave your device. Four do: puzzles solved offline (they are meant to reach the server), the app's access token (it shows with every request that it is you), the word from an advertising link (it travels along with the counted events, see section 3b) and your guest progress once you create an account (see below):

• Settings: colour scheme (sudoku.theme.v1), language (sudoku.lang), sound, volume and vibration (sudoku.sound.v1, sudoku.volume.v1, sudoku.haptics.v1), the most recently chosen difficulty per puzzle type (sudoku.<art>.diff.v1) and view markers (sudoku.ui.*).
• Playing without an account: your guest progress (sudoku.guest.*) with the solved puzzles, times, mistakes and points. If you create an account later, it is transferred once to the server so that your progress is not lost; after that it is deleted from the device. In addition, whether an introduction has already been shown (sudoku_sagax_onboarded_v2, sudoku.app.start.gesehen.v1, sudoku.fuchsbau.tut.v1 for the introduction to Foxhold, sudoku.season.tut.v1 for the introduction to the season, sudoku.season.teaser.v1 for Nona's hint about the season, sudoku.nono.intro.v1 for the introduction to the Nonogram, sudoku.intro. with the name of the puzzle type for the other introductions).
• With an account: your account identifier for display convenience (sudoku.currentUser.v2). In the app, additionally an access token and the ongoing sign-in process (sudoku.app.token.v1, sudoku.app.login.v1). In the browser these do not exist; the cookie is sufficient there.
• Puzzles in progress: The other puzzle types store their current game state on the device (sudoku.active.*, for example sudoku.active.killer.v1), so that you can continue playing later; for classic Sudoku it is stored on the server so that it is the same on every device. If you are signed in, your account identifier is stored in the game state as well, so that someone else's game state on the same device is not shown. The device also remembers which rank promotion you have already seen (sudoku.rankSeen.v1.<Konto-Kennung>).
• Notices that should only appear once: how many puzzles you have solved on this device (sudoku.siege.v1, just a number), whether you have dismissed the notice about the app (sudoku.apphinweis.weg.v1), when you were last asked for a rating (sudoku.bewertung.zuletzt.v2, a point in time), on how many days you have already solved puzzles (sudoku.spieltage.v1, a number and the date of the last day) and how often you have solved puzzles without an account, so that the playable grid on the start page is a different one on your next visit (sudoku.sofort.zaehler.v1, also just a number), and which version you saw last, so that after an update what is new is shown once (sudoku.notizen.gesehen.v1). These values stay on the device and never go to the server; they are only there so that the same notice does not reach you twice.
• Puzzles solved offline: Results produced without a network connection wait in a queue (sudoku.outbox.v1) and go to the server as soon as there is a connection again. It is emptied when you sign out.
• Origin of a visit: If you arrive via a link with the addition ?src= (for example from an advert), we remember this one word for the duration of the visit (sagax.src, in session storage). In addition, three markers: whether a registration has already been counted (sagax.srcGemeldet.v1, this one is kept permanently, otherwise every new tab would count again), whether you were already signed in in this tab (sagax.warAngemeldet) and when a sign-in was last started (sagax.anmeldeVersuch, a timestamp from which we can tell when a sign-in does not come back). None of these values identifies you as a person.

In addition, the application stores its own files (pages, images, program code) in the browser cache so that it also starts without a network connection. Server responses containing personal data are explicitly excluded from this.

You can delete these values at any time via your browser settings. Your guest progress is lost in the process, account progress is not: that is stored on the server.

6. Server logs

The application keeps no permanent access or server log files. To prevent abuse (rate limiting), your IP address is processed only temporarily in memory and automatically discarded after about ten minutes at the latest; the IP address is not stored in the database. Occasional technical operational and error messages (without profiling) may appear in the standard output of the hosting environment and are kept there only for as long as secure operation requires.

7. Retention period

Game data remains stored until the user deletes it. Backup copies of the database are made in two places: daily on the same server, kept there on a rolling basis for 14 days, and daily as an artifact of an automated run in our private repository at GitHub (GitHub Inc., part of the Microsoft group), kept there for 30 days and then automatically deleted. This second copy exists so that a failure of the server does not also take all backups with it. It contains the same data as the application, including display names, account identifiers, uploaded profile pictures and the fingerprint of the email address mentioned above, and is accessible only to the operators. GitHub processes this data as a processor under Art. 28 GDPR; this involves a transfer to the USA, safeguarded by the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR). You can obtain a copy of the safeguards on request at the address given above. Your sign-in session expires by itself after 90 days at the latest; when you sign out it is deleted immediately. Your account is held by us and remains until you delete it (see section 8).

8. Your rights

You have the rights of access, rectification, erasure, restriction, data portability and objection (Arts. 15 to 21 GDPR). You do not need to fill in a form or give reasons: an email to korbi@vulpessagax.com is enough, one sentence will do. We reply within one month.

Your account is held by us. Two things need to be distinguished here:

• Your game data (progress, times, points) you delete yourself in the game: tap your name at the top right, then Delete game data. Your account remains, and you can keep playing. That is also where you change your display name.
• Your entire account you also delete yourself: in the settings under Delete account for good. This removes your display name, sign-in method, profile picture, progress, trophies, invitations, feedback, reports and blocks, leaderboard and duel entries as well as the fingerprint of your address mentioned above. This cannot be undone. From backup copies the data disappears after the periods stated in section 7; if anything goes wrong, a message to korbi@vulpessagax.com is enough.

You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA, the Bavarian Data Protection Authority), Ansbach.

Right to object. Some processing we carry out because we have a legitimate interest in it: secure operation, counting on which platform (browser, iOS or Android) you play with your account, and counting how often a puzzle is started (Art. 6(1)(f) GDPR). You can object to this at any time. An informal message to korbi@vulpessagax.com is enough, you do not have to give reasons; we will confirm your objection and stop processing the data concerned. In fairness, regarding event counting we should add: nothing is stored there that points to you, so there is also nothing we could attribute to you and remove. We are happy to explain this in detail on request.

9. Note: created with AI

This application was created with the support of artificial intelligence: the software with Claude (Anthropic), the images with Grok (xAI). These providers do not process your personal data during ongoing operation; the AI was used only to create the application.