Privacy Policy

Last Updated: June 13, 2026

We take your privacy seriously. This privacy policy explains what information we collect, how we use it, and your rights regarding your data.

Data Controller: Jigsaw Puzzle Online (operated by the service provider identified in our Terms of Service). Contact: privacy@jigsawpuzzle.online

Contents

1. Information We Collect

Account Information

When you create an account, we collect:

  • Email address
  • Password (securely hashed before storage)
  • Username
  • Avatar image (optional)

This information is used to:

  • Create and manage your account
  • Enable login and authentication
  • Display your profile to other players
  • Send password recovery emails

Puzzle and Game Data

When you create or solve puzzles, we collect:

  • Puzzle images you upload (PNG/JPEG, max 5MB each)
  • Puzzle settings: dimensions, piece count, difficulty, protection options
  • Puzzle state: which pieces are placed, rotations, completion progress
  • Puzzle creation and modification timestamps

This information is used to:

  • Generate and display your puzzles
  • Save your progress so you can resume later
  • Support multiplayer puzzle solving
  • Display puzzle metadata in room listings

Multiplayer Session Data

During active multiplayer sessions, we process (but do not permanently store):

  • Your cursor position and movements
  • Piece movements and rotations
  • Chat messages
  • Session duration and your connection status

This data is used to:

  • Synchronize gameplay between players in real-time
  • Enable collaboration on puzzles
  • Display your actions to other players

Important: Piece positions and rotations are saved to complete your puzzle progress. However, cursor positions and chat messages are real-time only and not permanently stored.

Cookies and Session Tokens

We use strictly necessary first-party cookies and session tokens for authentication, security, and essential functionality (such as remembering your theme preference). We do not use any tracking, advertising, or analytics cookies. See Section 5 for more details.

Logs and Operational Metrics

We collect server logs and basic operational metrics, including:

  • Application error logs (to fix bugs and improve reliability)
  • Basic performance and usage metrics (to keep the service running smoothly and detect abuse)

These are used solely for operating, securing, and improving the platform. We do not use third-party analytics services or tracking pixels.

2. How We Use Your Information

We use your information to:

  • Create and manage your account
  • Enable puzzle creation, saving, and solving
  • Support real-time multiplayer gameplay
  • Keep you logged in and secure your account
  • Detect and prevent abuse or fraud
  • Fix bugs and improve the platform
  • Comply with legal obligations

We only use your data for these purposes and do not sell or share it for marketing.

4. How We Share Your Information

Data Shared with Other Players

During multiplayer sessions, other players in your room will see:

  • Your username
  • Your avatar
  • Your cursor position and movements
  • Your piece manipulations
  • Your chat messages

Data Shared with Service Providers

The core platform services (authentication, database, file storage, and real-time multiplayer) run on self-hosted infrastructure under our direct control. We also use standard cloud / VPS hosting providers for servers and data storage.

  • Self-hosted Supabase — authentication, database, and file storage
  • Self-hosted Colyseus — real-time multiplayer synchronization
  • Cloud / VPS hosting providers for the underlying servers

Infrastructure providers are contractually obligated to protect your data and only process it to provide services to us, acting as our data processors.

International data transfers

Our primary services and data storage are operated on infrastructure located within the European Economic Area (EEA). We do not routinely transfer personal data outside the EEA. Where any transfer becomes necessary (for example, with certain hosting or security services), we ensure appropriate safeguards are in place in accordance with GDPR Chapter V.

When Required by Law

We may disclose your information if required by law (subpoena, court order, etc.).

We will never sell your personal data to advertisers or third parties.

5. Cookies and Similar Technologies

We use only strictly necessary first-party cookies and similar technologies. These are required to deliver the service you have requested — in particular to keep you (or your anonymous guest session) logged in for multiplayer rooms, maintain security, and remember basic interface preferences such as theme.

We set no third-party tracking cookies, no advertising cookies, and no analytics or marketing cookies of any kind.

Categories of cookies we use

  • Authentication and session cookies
    These allow you to stay logged in (or participate as an anonymous guest in public rooms), protect your session against unauthorized access, and enable core features such as saving puzzle progress and real-time collaboration. They are essential for the service to function.
  • Preference cookies
    We use a first-party cookie to remember your chosen theme (light/dark or system preference) so the interface remains consistent across visits and page loads.
  • Notice acknowledgment cookie
    A first-party cookie that records that you have seen our cookie information notice. This prevents the notice from being shown repeatedly.

Similar technologies (browser storage)

In addition to cookies, we use your browser's localStorage to remember certain client-side settings on your device only. These include your puzzle interface and performance preferences. This data stays on your device, contains no personal information, and is not used for tracking.

No tracking or third-party technologies

We do not use Google Analytics, Meta Pixel, advertising networks, social media trackers, or any other third-party scripts, pixels, or services that set cookies or collect data for profiling, advertising, or cross-site tracking.

Our authentication, database, storage, and real-time multiplayer systems run on self-hosted infrastructure that we operate. Authentication uses secure session tokens; real-time communication uses authenticated WebSockets.

How to manage cookies and local storage

You can control or delete cookies and local storage at any time through your browser's privacy or settings menu (look for "Cookies", "Site data", or "Storage" options).

Please note that blocking or deleting authentication-related cookies will log you out and prevent you from using accounts or joining multiplayer rooms until you sign in again. Clearing local storage will reset your puzzle engine preferences to defaults.

Because all technologies we currently use are strictly necessary for the service, we do not provide per-category opt-outs. If we ever introduce optional (non-essential) features that use additional cookies or storage, we will obtain your consent first and provide appropriate controls.

6. Data Retention

Account Data

Kept as long as your account is active. Deleted within 30 days if you delete your account.

Puzzle Data

Kept as long as your account is active. Deleted when you delete the puzzle or your account.

Multiplayer Session Data

Not stored persistently. Deleted when the session ends.

Logs

Retained for up to 90 days for debugging and security purposes.

7. Your Rights

Depending on your location, you may have the right to:

Access — Request a copy of your personal data

Correction — Update or correct inaccurate information

Deletion — Request deletion of your data (right to be forgotten)

Portability — Request your data in a portable format

To exercise any of these rights, contact us at privacy@jigsawpuzzle.online with a description of your request. We'll respond within 30 days.

8. International Users

GDPR (European Union)

If you're in the EU, you have additional rights under GDPR, including the rights listed above. If you believe your data is processed unlawfully, you can lodge a complaint with your local data protection authority.

CCPA (California)

If you're a California resident, you have the right to know, delete, and opt out of the sale of personal information (note: we don't sell your data anyway).

UK GDPR

UK residents have similar rights as EU residents under UK data protection law.

9. Children's Privacy

This service is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has created an account, we will delete that account and associated data.

10. Security

We use industry-standard measures to protect your data from unauthorized access, alteration, and deletion. However, no method of internet transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time. When we make material changes, we will update the "Last Updated" date and post a prominent notice on the platform (for example on the homepage or in the Policy page itself). Your continued use of the service after the changes constitutes your acceptance of the updated policy.

12. Contact Information

If you have questions about this privacy policy or want to exercise your rights, please contact us:

Email: privacy@jigsawpuzzle.online

Data Controller: Jigsaw Puzzle Online

We aim to respond to all inquiries within 30 days.

Last updated: June 13, 2026

↑ Back to top