Puzzzle Club

Privacy

Here's how we handle your data when you visit this website or request an email.

Data controller

Thomas Chodak
Adamgasse 11
6020 Innsbruck
Austria

Email: thomas@chodak.at

Visiting the website

When you visit this website, we process connection data needed to deliver the page and keep the service secure, such as your IP address, the time of the request, the page requested, and browser information. The legal basis is our legitimate interest in running a secure, functioning service (GDPR Article 6(1)(f)). We use OpenAI's Sites service for hosting. Technical logs are retained for as long as needed for operations and security.

Bonus emails and test delivery

When you request a bonus email, we use your email address and book selection only to send the message you requested. Your email address is required for delivery. The legal basis is fulfilling your request (GDPR Article 6(1)(b)). During testing, Brevo can send a message without a puzzle file only to an approved test address. Delivery to other addresses is not currently enabled in this test flow. Brevo processes the data needed for delivery; requesting a bonus does not itself subscribe you to Puzzle Post. Data is deleted when it is no longer needed for delivery or required records.

Puzzle Post

In the book bonus area, you can opt in to occasional emails with free puzzles, little surprises, new book puzzles, and book offers. We process your email address and the consent you expressly give by checking the box. We use Brevo (Sendinblue SAS) to manage subscriptions and send emails. After you submit the form with the consent box checked, we send a confirmation email. Your address is added to the Puzzle Post list only after you expressly confirm through your personal link (double opt-in). Your book application is separate. The legal basis is your consent (GDPR Article 6(1)(a)). You may withdraw it at any time for future emails using the unsubscribe link in any Puzzle Post email or by emailing us. You can use the interactive book puzzles without subscribing.

Brevo processes your email address and subscription status. Your address is retained for Puzzle Post while you remain subscribed; necessary consent and unsubscribe records may be retained longer. Our website records subscription requests with the time, consent wording, wording version, and a cryptographically protected identifier derived from the email address, including the verified subscription status. Short-term request logs are cleared after 30 days when the next request is made. Unconfirmed subscriptions and their email addresses are cleared on a subsequent signup after the seven-day confirmation link expires. For confirmed subscriptions, we separately retain the consent text and version, request and confirmation times, and a cryptographically protected email identifier as evidence; the email address is removed from that separate confirmation record. Previous list membership alone does not establish double opt-in. The protected admin area shows the confirmation status and time for the same email address. For former promotional access, we also counted each confirmed email identifier from that signup area once within the reporting period; it is not linked to an individual puzzle session.

To prevent abuse, we limit requests using short-lived, cryptographically protected identifiers derived from email and IP addresses. Raw IP addresses are not stored in these form rate-limit records. The identifiers expire within one day and are cleared on a subsequent request. The legal basis is our legitimate interest in protecting the forms and recipients (GDPR Article 6(1)(f)).

The separate bonus test flow remains restricted to the approved test address. Any additional Puzzle Post signup in that flow also requires a separate confirmation email. Other addresses can subscribe through the public homepage form.

Email delivery and delivery reports

For requested messages, Brevo processes the recipient address, content, send time, and delivery or error reports. We use this information to deliver requested messages and identify errors or abuse (GDPR Article 6(1)(b) or (f)); marketing emails require your separate consent. We request website emails without individual open or click tracking. For Puzzle Post and automations, Brevo is configured not to track contacts without separately documented tracking consent. Checking a newsletter box does not constitute tracking consent. Previously collected open and click data may still appear in internal delivery logs. An open or email click does not prove that someone read the content or fully saved a download.

Optional reader account

We process your email address through Supabase Auth to sign you in. A one-time email link confirms that you have access to your inbox. Our server delivers sign-in links through Brevo. Our Supabase project is located in Frankfurt. A reader account stores an account ID, email address, free account status, and creation and update times. You can also request occasional free puzzles, little surprises, new book puzzles, and book offers by checking the optional, initially unchecked Puzzle Post box. Even with a verified account, selecting Puzzle Post triggers a separate newsletter confirmation. Your address is added to the Brevo newsletter list only after that step. Signing in without checking the box does not subscribe you. Consent and its verified status are documented as described in the Puzzle Post section. puzzle progress remains on your device.

To provide the sign-in you requested, we set a protected, necessary session cookie. It contains a random identifier and is not used for advertising or visitor measurement. Reader sessions expire within 90 days; administrator sessions within 30 days. Signing out ends the current session. Only a cryptographic hash of the identifier is stored on the server. Expired sessions are cleared during subsequent authentication requests.

To prevent automated abuse, we temporarily store cryptographically protected email and IP identifiers and attempt counts. These limits expire within one hour and are cleared during subsequent authentication requests. The legal basis for the account and requested sign-in is GDPR Article 6(1)(b), and for abuse prevention Article 6(1)(f). Your account remains until it is deleted. You can request deletion using the contact address above.

Browser storage

The former mystery Sudoku advertising page and its case access pages are no longer publicly available. Old links lead to the book bonus area. Existing access cookies may remain on your device until their original expiry; they no longer unlock a separate advertising area. You can delete them in your browser’s website data settings. Interactive book puzzles in the bonus area remain available independently of Puzzle Post.

After you close the Puzzle Post invitation, your browser saves the time so it does not automatically reappear for 30 days. After a successful signup, automatic invitations pause on that device for one year. Signup remains available through the Puzzle Post link in the footer. These local settings contain no email address and are not used for advertising tracking. You can delete them in your browser's website data settings. The legal basis is our legitimate interest in a user-friendly service (GDPR Article 6(1)(f)).

After an account sign-in with Puzzle Post selected, session storage temporarily remembers only the subscription result and time to display feedback in your account; it is removed after display. After a successful bonus request, your browser similarly remembers the delivery status briefly in session storage and removes it after display. No Meta Pixel loads without your separate consent; see “Optional advertising measurement with Meta.”

Aggregate activity totals

We count server requests for book and bonus pages, case overviews, fixed QR and channel links, and redirects to Amazon. We also count successful Puzzle Post signups by signup area and whether the address was already subscribed, as well as new reader-copy requests and successful PDF access. Only daily and hourly totals are stored, with book, fixed source, action and count; time is grouped in Europe/Vienna. These counters contain no personal activity history, analytics cookies, additional browser storage, visitor IDs, fingerprints, IP addresses, browser characteristics or full referring URLs, and are not linked to email addresses or individual puzzle progress. Requests with a valid administrator session or verified owner identity are excluded before counting; the identity is not stored in the counters. The owner can also exclude a browser by choosing “Do not count this device.” This sets a Secure/HttpOnly cookie with the fixed value “1” for up to 180 days, without an individual ID. It prevents counters and the Meta Pixel in that browser, regardless of IP address or VPN; other browsers and private windows are not covered. Known automated requests are filtered using request details already transmitted; those details are not stored for this purpose.

These totals help us understand use of our book bonuses and links. They are aggregated immediately without storing individual event logs. Where the technical request involves personal connection data, we rely on our legitimate interest in privacy-conscious operational statistics (GDPR Article 6(1)(f)). Daily and hourly counters are kept for about 400 days; older counters are cleared during the next counted request. Only the website owner can access the statistics. puzzle actions are aggregated only with the separate permission described below. These statistics are not shared with advertising networks.

Service providers and processing outside the EEA

We use OpenAI Sites for hosting and website data, Supabase for account authentication, and Brevo (Sendinblue SAS) for email. Each provider receives only the data needed for its task. Sites does not guarantee data residency; even a European project location does not rule out access or subprocessors outside the EEA. Information about each provider's processing terms and transfer arrangements is available from OpenAI, Supabase and Brevo. You can contact us for details and a copy of the safeguards that apply to your data. The separate transfer to Meta requires your consent and is described below.

Your rights

You can request access to, correction, deletion, restriction, and portability of your data, and object to processing based on legitimate interests. You can withdraw consent at any time for future processing. Contact us at thomas@chodak.at. You also have the right to complain to the Austrian Data Protection Authority: dsb.gv.at.

Last updated: October 15, 2026