Privacy policy
Updated 3 October 2026
Draft template: publisher details and procedures must be completed before finalisation.
Controller and contact
Data controller
To be completed by the publisher.
Contact address to be completed. No report submission form is active yet.
Account and optional data
PuzRush registration stores a private email address, username and display name, derived password and hashed recovery code. Passwords and recovery codes are not stored as plain text. The address is used to send a confirmation link; verification unlocks the marketplace, trades, social features and purchases. Bio, colour, country, friends, favourites and personal images are linked to the profile when you use these features.
Without an account, you can play and open guest boosters. Their pieces remain recoverable for 24 hours in the same browser; registration or sign-in transfers them to the account once. An account is needed to keep your collection, library, point purchases, friends and world ranking results.
Confirmation links expire after 24 hours and can be used once. Only a token hash is stored; confirming the address does not automatically sign in to the account. Confirmations do not subscribe you to an advertising mailing list.
Games and rankings
The server validates moves, progress, times and results. History, trophies, points and Elo are saved in the account. Rankings publicly show display name, username, appearance, chosen country, scores and records. Uploaded images and passwords are not public.
Location and language
Cloudflare estimates a country from the network connection. This suggests a language and, for an account, an editable or hideable country. The site does not request GPS access. You can choose a language in the header; English is the fallback language.
External sign-in
Google and ChatGPT are optional and currently awaiting activation. Once enabled, a provider identity and profile name will be used to sign in. This integration does not access ChatGPT conversations and does not store provider tokens. Review the provider’s privacy policy before using it.
Purposes and proposed legal bases
This template proposes performance of the requested service for accounts, saves and games; legitimate interests for security, abuse prevention and fairness; and user choice for optional information. The publisher must confirm these bases, required data and applicable safeguards before finalising this policy.
Retention
Accounts, friends, favourites, account uploads and results are retained until the account or relevant items are deleted. Automatic deletion of inactive accounts is not currently configured. Account sessions expire after 30 days; guest uploads after 24 hours; external sign-in transactions after 10 minutes. Invitations expire after 15 minutes. The publisher must complete its retention, log and backup policy.
Providers and transfers
Cloudflare provides hosting, network protection and storage. The account database is configured in the European Union; Cloudflare’s network may process requests in other countries. When email delivery is enabled, Resend receives the recipient address and message contents to send the confirmation. The publisher must document applicable agreements and transfer safeguards. The game does not integrate data sales or targeted advertising.
Your rights
You can edit your profile and hide your country. To request access, a copy, correction, deletion, restriction, objection or portability, use the privacy contact once completed. Never send your password or recovery code. You may also contact your data protection authority, including the CNIL in France.
Administration and game tracking
Only the verified owner can view the statistics, public profiles, results, social-link counts and reward totals needed for administration. Room tracking retains public display names, states and results for 90 days, including guest participants. The owner can manage public profiles, moderate records, revoke account sessions and control the opening of new lobbies or uploads. Access and decision logs, including their reasons, are retained for 90 days. No IP address, browser fingerprint or personal image is shown in this space. Account deletion anonymises its tracking data.