Privacy Policy

Playing and saving puzzles

Sudoplay offers Sudoku and Killer Sudoku without an account or signup form. The inspected game code saves your puzzle, entered numbers, pencil notes, elapsed time, settings, undo/redo history and completion state in your browser. It also keeps puzzle fingerprints to avoid repeat delivery and stores newly generated puzzles locally. The game code does not upload this saved puzzle data to an account or puzzle server.

Local storage stays until you clear it or your browser removes it; it has no application-set expiry. Puzzle-history cookies last up to 400 days from their last write and are sent with matching requests to this site, even though the game reads them locally. Therefore history cookies are not described as exclusively device-only processing. Saves are separate for each browser, device and origin (for example, www and non-www addresses).

These are functional game features, not advertising identifiers. Remembering games and avoiding repeats are conveniences, not automatically strictly necessary merely because they are useful. The operator must validate the applicable storage exemption or consent basis, particularly for long-lived history cookies; the Google advertising CMP does not automatically authorize custom game storage. See the Cookie Policy for the exact keys and deletion controls.

Purposes and legal bases

Delivering requested pages and protecting the service may rely on legitimate operational interests in availability, security and fault diagnosis, subject to necessity, proportionality and your rights. The operator must document that assessment and confirm hosting retention. This is not a blanket legitimate-interest basis for advertising or all analytics.

Optional advertising storage, personalization and related sharing require the permissions applicable in your region. In the EEA, UK and Switzerland, the owner must configure Google’s certified European regulations consent message. Where consent is required, it must be obtained before the relevant optional processing. Refusing advertising consent must not prevent playing. Contextual or non-personalized ads are not assumed to be exempt from all permission requirements.

Local saving is intended to provide the game features you request. The operator must confirm any personal-data legal basis separately from the cookie/local-storage rules. Nonessential hosting analytics also needs a jurisdiction-specific assessment; a first-party endpoint or absence of cookies alone does not settle that question.

Hosting, diagnostics and visitor measurements

Pages and files are served through Lovable’s publishing infrastructure. Network delivery makes connection information such as IP address, requested URL, time and browser headers available to the hosting/CDN services. Application source does not explicitly extract IP addresses. Actual access-log fields, provider roles and retention must be confirmed by the operator.

Server error code logs error messages, stacks and causes. A short in-memory error buffer expires after five seconds; that is not the retention period of hosting logs. Browser error reporting can pass error details, pathname and boundary context to Lovable runtime hooks when those hooks are present.

A public-site check on 23 October 2026 found hosting-injected visitor/event scripts at /~flock.js and /__l5e/events…js, and a request to /__l5e/trackevents. The analytics script is configured with the first-party /~api/analytics proxy. Its delivered code supports visit identifiers and page/browser measurements; the event script supports event/session/page-view identifiers and error reporting. Session replay capability exists in the delivered event code, but replay recording/upload was not verified. The observed automated visit did not establish what every ordinary visit sends.

Hosting cookies named __dpl and __cf_bm were observed; their precise purposes, lifetimes and legal classification require operator/provider confirmation. Hosting-injected processing is not fully controlled by this repository. No separate marketing analytics has been added by this update, and the presence of hosting measurements means we do not claim the site has no analytics.

Google Fonts and advertising

The site loads the Manrope font from fonts.googleapis.com and fonts.gstatic.com. These requests disclose connection information, including your IP address and request headers, to Google. They are presentation resources, not a reason to claim all external requests are essential. See Google Fonts’ privacy information; provider retention must be confirmed.

The app includes Google AdSense’s global script for publisher ca-pub-1693980621495883, plus ownership verification. Google advertising technology can process IP addresses, cookies or other identifiers, browser/device information, ad interactions and consent choices, and share information with the ad-technology providers selected in the publisher’s account. Exact vendors and retention depend on that configuration; the operator must review and disclose them. No ad-slot IDs or new ad units were added here.

Read How Google uses information from sites or apps that use its services and Google’s Privacy Policy. The Google script remains in initial HTML for verification and CMP loading, so a connection to Google can occur before a choice. This app cannot certify account-side pre-consent behavior, restrict all requests from that script, or confirm a published CMP from source alone.

Recipients, retention and international processing

Relevant categories are hosting/CDN and diagnostics providers, Google’s font and advertising services, and advertising vendors chosen in AdSense. The game has no account-sync service in the inspected source. We have not verified hosting subprocessors, vendor-specific retention schedules or contractual roles; the operator must complete these disclosures before relying on this policy.

Google describes international processing and transfer protections in its Privacy Policy. We have not verified the specific processing locations or transfer arrangements for this site’s hosting and selected advertising vendors. The operator must confirm any applicable international transfers and safeguards rather than treating this page as confirmation of them.

Your choices and rights

Use Privacy and cookie settings to request Google’s consent withdrawal/reselection message. Choices take effect through Google’s message, not by clicking the site’s link alone. You may withdraw consent where applicable; withdrawal does not affect processing already lawfully carried out. Availability depends on Google’s published message, region and browser access.

Clear saved puzzle data independently to erase progress, notes, settings, generated puzzles and used-puzzle history. Google consent records are kept separate. You can also manage this origin’s storage through your browser; clearing everything in the browser may affect other choices too.

Depending on applicable law and the processing involved, you may request access, rectification, erasure, restriction, portability, or object to processing, including processing based on legitimate interests. These rights are not unconditional and may not apply to anonymous or solely device-held information. The owner must supply the verified privacy contact shown above to handle requests and explain any identity checks proportionately.

You may complain to a competent data protection authority, for example in your place of habitual residence, work or an alleged infringement. See the EEA authority directory or the UK ICO. Switzerland’s authority is the FDPIC.