Privacy

Last updated October 7, 2026.

In short

No trackers, no analytics, no ads. Without an account, what you do here stays in your browser. With an account, we keep what is listed on this page, only to run the site, and never sell or share it.

In your browser

Your games, settings and stats are saved in your browser’s storage (localStorage), on your device only. Clearing your browser data removes them. Here is everything kept there:

sudokus:game: The puzzle you are playing (grid, notes, time, mistakes and hints), so you can pick it up where you left off.; How long Replaced when you start another puzzle. Cleared with your browser data.
sudokus:daily: Your daily puzzle results (time, failed checks, and which boxes had a mistake), to count your streak and make the share text; today’s puzzle while you play it, with when each digit went in (signed in, the server replays it to check your time for the leaderboards); the past dailies you play (results, and up to 10 unfinished ones); which daily was left unfinished on its day, to point you to it until you open it.; How long Results stay until you clear your browser data. Today’s puzzle, if unfinished at midnight, becomes a past daily; only the 10 most recent unfinished past dailies are kept.
sudokus:quick: Your best Rush score, and the rush or small grid you are playing, so a reload picks it up.; How long The best score stays until you clear your browser data. A rush is dropped when it ends; a small grid when it is solved or replaced.
sudokus:practice: Your practice progress: for each technique, how many puzzles you did, how many at the first try, and which one comes next.; How long Until you clear your browser data.
sudokus:stats: Your stats: for each level and each small grid, how many puzzles you solved, your best and total time, and how many had no mistakes and no hints; how many rushes you played.; How long Until you clear your browser data.
sudokus:settings: Your settings: colors, the clock, highlights, digit-first entry and tidy notes.; How long Until you change them. Cleared with your browser data.
sudokus:account: Only once you sign in: your username, picture and account number, so the page shows them before it hears back from the server, which account the progress on this device belongs to, and whether you are still signed in.; How long Until you sign out. Cleared with your browser data.
sudokus:outbox: Only once you sign in: games and results not yet sent to your account (when you play offline, say).; How long Until they reach your account, usually within a second.
sudokus:theme: Light or dark theme, only if you pick one instead of following your device.; How long Until you change it. Cleared with your browser data.

Cookie

Without an account, this site sets no cookie at all. Once you sign in, it sets one, needed to keep you signed in, so it doesn’t ask for your consent:

sid: A random secret that keeps you signed in. Only sent to our own server, unreadable by scripts on the page.; How long Until you sign out, or 180 days after you last came by.

With an account

An account is optional and free. Here is everything our server keeps about it, and what other players can see:

Your username.: It names you on your profile and, later, on the leaderboards.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Shown on your public profile
Your email address, and when you confirmed it.: To sign in, to send a link when you forget your password, and to check the address is yours before you appear on the leaderboards. Never shown to anyone, never used for newsletters or ads.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Never shown
Your password, scrambled with argon2id: no one can read it back, not even us.: To check your password when you sign in.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Never shown
The language you use on the site.: So our emails reach you in English or in French.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Never shown
Your flag, your bio and your profile picture, if you add them (all optional).: Shown on your profile.; How long Until you change or remove them, or delete your account.; Shown on your public profile
The picture itself, as your browser cropped and resized it (which also removes the hidden details a photo carries, like where it was taken).: Shown on your profile.; How long Until you change or remove it, or delete your account.; Shown on your public profile
A number for your account, when you created it, when you last changed your username, when you last came by (to the day), and whether we warned you about deleting an unused account.: Your profile shows the month you joined. A username can be changed once every 30 days. Accounts unused for three years are deleted.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Never shown
Your progress: puzzles solved and times for each level and small grid, daily puzzle results, rush scores, practice progress. Also the last few hundred updates received, so none is counted twice.: Your stats on all your devices; a summary is shown on your profile.; How long Until you delete your account, or after three years without signing in (you are warned by email a month before).; Shown on your public profile
One line per device where you are signed in: a scrambled copy of the secret in its cookie, and dates.: To keep you signed in.; How long Until you sign out, change your password, or don’t use that device here for 180 days.; Never shown
The links we email you (to confirm an address or reset your password), scrambled, with the address they are for.: To check a link when you open it.; How long Until used, or 48 hours (one hour for a password link).; Never shown
Reports you make about a profile: who, why and when.: So we can remove an offensive name, bio or picture. Each report is also emailed to us. The reported player is never told who reported them.; How long Until handled, and at most a year (the emailed copy is deleted once the report is handled).; Never shown
Each daily puzzle you play signed in, on its day: when you started and finished, your time, failed checks and score, and whether the result passed our checks (and if not, why).: To rank you on the leaderboards with a time measured by our server, not by your device, so no one can claim a time they didn’t do. Results that look impossible wait for a person to look at them.; How long A puzzle started and never finished, three days. The others, until you delete your account.; Shown on the leaderboards, once your email is confirmed

Who handles it

The site, its server and its emails are hosted by OVHcloud, a French company, which processes this data only on our behalf. Account emails (confirmation, password reset) are sent from an OVH mailbox. No other company receives your data.

Like any web server, ours writes a log of requests (IP address, page, date, browser) to keep the site secure and running; these logs are deleted after 14 days. To slow down password guessing and spam, the server also counts recent requests by IP address, and sign-in tries by username or email, in its memory only: these counts are gone within two hours. Our own error logs never hold your email address or your IP address. If a page breaks in your browser, it sends us the error, the page’s address and your browser’s name and version, kept with those logs.

A new profile picture is checked for nudity by a program on our own server before it’s kept; the picture goes nowhere else. A refused picture isn’t kept: our logs only note that one was refused, and for which account.

Every night, the account database is copied to a backup, so a broken disk can’t lose everyone’s progress. Backups are kept 14 days: a deleted account is gone from them 14 days later.

Why we may keep this data: to provide the account you ask for (GDPR article 6.1.b); for logs and reports about profiles, our legitimate interest in keeping the site safe (article 6.1.f).

Servers in France (OVHcloud, Gravelines).

Your rights

Under the GDPR, you can at any time:

see and download everything your account holds (Settings, Download my data);
correct it (your profile and Settings);
delete your account and everything in it (Settings, Delete my account);
object to its use, or ask us anything about it, by email.

The site is run by Baptiste Barre EI, who is responsible for this data (the data controller; see the legal notice). Write to contact@sudokus.me. If you think your data is mishandled, you can also complain to the CNIL, France’s data protection authority (cnil.fr).