Puzzzlo
Log in

Privacy policy

Last updated 11 November 2026.

Who is responsible

Puzzzlo (puzzzlo.com) is run by Zaqi Fathis, Germany. Contact for any privacy question: [email protected].

What we store, and why

  • Your account: your email address, and either a password hash (never the password itself) or your Google account id if you sign in with Google. We need these to log you in and to know which tools you bought (Art. 6(1)(b) GDPR).
  • Your purchases: when you buy on Gumroad, Gumroad tells us the purchase email, order id, product and refund status. We use them to unlock your tools (Art. 6(1)(b) GDPR).
  • Login session: one cookie (pz_session) keeps you logged in for 30 days. It is needed for the service, so no consent banner is required. Logging out deletes it.
  • Emails we send: account confirmation, password reset, and purchase confirmation. The links in them expire (1 to 24 hours).
  • Abuse protection: to limit login attempts and emails we store a one-way hash of your IP address, for up to two days (Art. 6(1)(f) GDPR, our interest in keeping accounts safe).
  • In your browser only: the last email you typed on the login page (local storage). Your book settings and puzzles are made in your browser and are not sent to us.

We use no analytics, no advertising and no tracking cookies.

Service providers

  • Cloudflare (hosting, database in the EU region, email forwarding for [email protected]).
  • Resend (sends our emails).
  • Gumroad (checkout and payment, as merchant of record under its own privacy policy). On the tool page, Gumroad's checkout script loads from gumroad.com when you are logged in.
  • Google (only if you choose "Continue with Google"; we receive your email address and Google account id).

Some providers are based in the USA. Transfers rely on the EU-US Data Privacy Framework or the EU standard contractual clauses.

How long we keep it

Your account and purchase records stay while you have an account. Ask us to delete your account at any time; we then delete your account data, except records we must keep by law.

Your rights

You can ask for access, correction, deletion, restriction, a copy of your data (portability), and you can object to processing based on our interests. Write to [email protected]. You can also complain to a data protection authority (Art. 77 GDPR), for example the one in your country or in Saxony, Germany.