Privacy policy

This policy explains which personal data the website sudokumurder.com and the Sudoku Murder app for iPhone, iPad and Android process, why, and what rights you have. We collect as little as we can. There are no accounts, no ads and no tracking cookies.

Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is Nikolay Strikhar. Email: nikolaystrikhar@gmail.com.

Data protection contact: nikolaystrikhar@gmail.com.

The website

Game progress. Your marks on the board, your times and the cases you solved are saved in your browser's local storage. They are not sent to us. You can delete them by clearing this site's data in your browser.

No cookies. The website sets no cookies and runs no advertising. We count visits and taps on the download buttons with GoatCounter, which uses no cookies and stores no personal data, so it loads one small script from gc.zgo.at. Fonts and images come from our own server.

Server logs. Each time your browser loads a page or file, the server records your IP address, the date and time, the address requested, the referring page, your browser and system, and the result. We need this to deliver the site, and to detect attacks and faults. Legal basis: our legitimate interest in running the site safely (Art. 6(1)(f) GDPR). Our host Beget rotates the logs daily and deletes them after a short period. We look at them only to investigate an attack or a fault.

The old waitlist. Before the app was out, this site had a form to sign up for one email on launch day. The form is gone. If you signed up, we hold your email address, the phone you picked and the time only to send that one email, then delete the entry, or earlier if you ask. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by writing to us.

The app

Progress is saved on your device. If iCloud is on, the app also keeps a copy in your own iCloud account (iCloud key-value storage), so it comes back on a new iPhone or after a reinstall. Apple stores this copy under its own privacy policy. We cannot read it. This iCloud copy exists on iPhone and iPad only. On Android, progress stays on your device and is not synced.

New cases. The app downloads new case files from sudokumurder.com. These requests carry no identifier of yours, but they appear in the server logs described above.

Reminders. If you allow notifications, the daily reminders are scheduled on your device. Nothing is sent to us. On Android 13 and later, the app asks for the notification permission first.

Game Center. If you are signed in to Game Center, your time on the daily case is posted to Apple's Game Center leaderboard, where other players can see it next to your Game Center nickname. Apple runs Game Center under its own terms and privacy policy. Game Center exists on iPhone and iPad only; the Android app has no leaderboard and posts no times.

Purchases. Apple handles payment for the Detective Pass. We never see your name or payment details. We use RevenueCat, Inc. (USA) as our processor to check which purchases belong to your app. RevenueCat receives a random user ID it creates for the app, your App Store transaction data (product, price, currency, dates, storefront country), your device model, system and app version, and the IP address of the connection. Legal basis: providing what you bought (Art. 6(1)(b) GDPR). RevenueCat keeps this while you use the app, and we keep records of purchases as long as tax and accounting law requires.

Purchases on Android. Google handles payment through Google Play Billing. We never see your name or payment details. RevenueCat, Inc. (USA) receives the Google Play purchase token and the product data (product, price, currency, dates, country), together with the random user ID, device model, system and app version, and the IP address of the connection described above. Legal basis: providing what you bought (Art. 6(1)(b) GDPR).

Ad attribution. If you found the app through an Apple Search Ads ad, the app passes Apple's attribution token (AdServices) to RevenueCat, which tells us which ad campaign led to the download. Apple provides it without tracking permission, and it does not identify you. Legal basis: our legitimate interest in knowing which ads work (Art. 6(1)(f) GDPR). This applies to iPhone and iPad only; the Android app has no ad attribution.

Usage analytics. The app sends usage events to Amplitude, Inc. (USA), our processor, so we can see where players get stuck and tune the difficulty. Examples: app opened, case started, solved or failed, hint used, paywall shown, purchase started or completed, daily case opened, streak extended, result shared. Each event carries a random ID created by the app, your device model, system version, app version, language, and an approximate location (country and region) that Amplitude may derive from the connection. The app tells Amplitude not to store your IP address. Events contain no name, email address, contacts or advertising ID, and we do not use them to track you across other apps or websites. Legal basis: our legitimate interest in improving the game (Art. 6(1)(f) GDPR). You can object at any time by writing to us. We keep events for at most 24 months.

Crash reports. If you have chosen in your device settings to share analytics with app developers, Apple passes us crash reports and usage statistics that do not identify you. This applies to iPhone and iPad only; on Android the app sends us no crash reports.

The app shows no ads and does not track you, so it never asks for tracking permission.

Who receives data

• Beget LLC (Russia): hosts the website, the case files, the server logs and the waitlist.
• RevenueCat, Inc. (USA): checks purchases.
• Amplitude, Inc. (USA): usage analytics.
• Google (Google Play): billing for purchases on Android, under Google's own privacy policy.
• Apple: App Store, iCloud and Game Center, under Apple's own privacy policy.

We do not sell your data or share it with anyone else, unless the law obliges us to.

Transfers outside the EU

Russia. Beget's servers are in Russia. The European Commission has not decided that Russia protects personal data to the EU standard. Authorities there may be able to access data, and it may be harder for you to enforce your rights. There are no standard contractual clauses in place with Beget. Those who joined the old waitlist agreed to this transfer (Art. 49(1)(a) GDPR). Server logs are created there whenever your browser or the app connects to the site.

USA. Amplitude is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss extensions. For RevenueCat, the transfer is covered by the European Commission's standard contractual clauses in RevenueCat's data processing agreement.

Your rights

You have the right to access your data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on our legitimate interest. Where you gave consent, you can withdraw it at any time. Write to nikolaystrikhar@gmail.com. Because we hold no names or accounts for the app, tell us what you want and we will do our best to find the data that belongs to you.

You also have the right to complain to a data protection supervisory authority, in particular the one in the country where you live or work.

You do not have to give us any data. The app works without a purchase. We make no automated decisions about you.

Children

The app is not directed at children under 13. We do not ask for age and do not knowingly collect personal data from children beyond the app data described above. If a child has joined the waitlist, a parent can ask us to delete the entry.

Changes

If this policy changes, we will update this page and the date above.