Sudoku / Legal

Privacy Policy

Last updated 11 October 2026.

Royal Sudoku at royalsudoku.com is a free service operated by Othmane Miri, based in Morocco. Othmane Miri is responsible for the personal information described here. For privacy questions or requests, email [email protected].

1. Information we use

Account information includes your email address, username, password hash, verification status, account role, and creation date. We store gameplay information such as puzzle identifiers, entries and notes in saved games, start and completion dates, times, and achievement records. We do not store plaintext passwords. Necessary session and verification/reset token hashes support secure access. Requests may be processed with technical data such as IP addresses for security and abuse prevention. Contact messages contain whatever you choose to send.

2. Guest play and browser storage

Guest play does not require an email or account. Your browser stores your current game, pencil notes, undo history, and timer information locally. A necessary guest cookie ties the puzzle to your browser. Clearing browser data removes that progress. Guests do not have an account history. After logging in or verifying a new account in the same browser, your current unfinished puzzle may be attached to your account. A completed guest puzzle may also be saved using its temporary completion receipt, which expires with the puzzle ticket after seven days. Replacing the current puzzle or clearing browser storage can remove this opportunity.

3. Purposes and legal bases

We use account and gameplay information to provide the service you request, authenticate access, verify email ownership, reset passwords, save progress, and maintain records. Where applicable, performance of our agreement supports this processing. Our legitimate interests support proportionate security, abuse prevention, service reliability, and administration, subject to your rights. We process information to comply with legal obligations when required. Optional uses requiring consent will be offered separately; withdrawing consent does not affect processing already performed lawfully.

4. Cookies and analytics

Necessary cookies support login sessions and guest puzzle ownership. Login sessions expire after 30 days; the guest cookie expires after 180 days unless cleared earlier. Browser storage keeps one current puzzle until replaced or cleared. We do not use visitor analytics services. Google AdSense code is included on the website, although advertisements are not currently enabled. Loading this code can send technical information, including your IP address and browser details, to Google. Google advertising services may use cookies or similar technologies when active. See how Google uses information from sites using its services and Google advertising choices. Before enabling advertising or adding optional analytics, we will update this policy and provide consent choices where required. You can control cookies and local storage through your browser; disabling them may prevent login or progress restoration.

5. Sharing and public information

We do not sell your account or gameplay information. Our website and PostgreSQL database run on the same OVHcloud VPS in Canada. OVHcloud also holds our hosting backups. Resend delivers verification and password-reset emails and processes email addresses, message content, and delivery information in the United States. See Resend’s privacy policy. Messages sent to our Gmail contact address are also processed by Google as our email provider. Google receives technical information when its AdSense code loads, as described above. We may disclose information when legally required or to protect lawful rights and service security. Usernames and statistics displayed in public profiles or leaderboards are public; email addresses, passwords, session tokens, and private in-progress notes are not displayed publicly. Result sharing occurs only when you choose to share.

6. Retention and deletion

Account and gameplay data remain while your account is active unless you delete them or request removal. Deleting an account removes its active private game data, authentication sessions/tokens, and achievement records. Public editorial content may remain with personal attribution removed. Verification tokens expire after 24 hours and reset tokens after 30 minutes; expired entries and unused sessions are removed when service maintenance runs. Server and security records may be retained for troubleshooting and abuse prevention. Retention follows the server configuration; this policy does not currently specify a fixed retention period for these records. Backups are held by OVHcloud; their retention depends on the configured hosting backup service, and we do not currently specify a fixed rotation period. Deleting an account removes its active data but does not immediately erase copies in existing backups. Contact us about a specific deletion request and any remaining backup copies.

7. Your choices and rights

Settings let you export your account and game data as JSON and delete your account after confirming your password. Contact the privacy address for corrections or requests you cannot complete yourself. Depending on applicable law, you may have rights to know/access, correct, delete, restrict or object to processing, obtain portability, withdraw consent, and complain to a supervisory authority. California residents may have applicable rights to know, correct, delete, opt out of sale/sharing, and receive non-discriminatory treatment. We do not use account or gameplay information for advertising targeting. Google’s data practices are described in the links above. Authorized agents may submit requests where permitted; we may verify identity and authority proportionately. We respond within applicable legal deadlines and explain lawful exceptions.

8. Security, transfers, and children

We use password hashing, hashed tokens, secure production cookies, access controls, and validated submissions. No system can guarantee absolute security. Providers may process information outside your country, including Canada for hosting and the database and the United States for Resend email delivery. Google may process information in other countries under its policies. Provider security and contractual terms apply to their processing. Resend describes its contractual transfer safeguards in its Data Processing Addendum. You may contact Morocco’s CNDP or another competent data protection authority about your rights. The service is not directed to children below the applicable consent age. Contact us if you believe a child provided account information without required authorization so we can investigate and remove it where appropriate.

9. Updates and contact

We will update this policy when practices change and notify users of material changes as appropriate. For questions, corrections, or privacy requests, contact Othmane Miri at [email protected].