How Nice Puzzles handles your data

Who is responsible

If you have any questions about privacy, personal data, or exercising your privacy rights, please get in touch via nicepuzzles@fifthwork.com.

What data we use and why

What data we use depends on the features you choose.

• During a visit, Vercel and Nice Puzzles process technical request data, such as IP address, timestamp, requested route, and browser or device information, to deliver and secure the site, troubleshoot errors, and prevent abuse.
• For an account, we process your chosen name, email address, internal user ID, login method, session and security data. Name and email address are required to create an account; without an account, you can continue puzzling on the same device.
• When you choose to sign in with Google, Nice Puzzles and Neon Auth receive the data that Google shares for that login, such as a Google ID, name, email address, and possibly a profile picture. The source of this data is Google.
• Optional profile data may consist of a player name, country, favourite category, language, avatar preset or custom avatar, and your choice to participate in a leaderboard later. This data is not public by default.
• For a custom avatar, we process the uploaded image and technical upload information, such as the upload timestamp and number of uploads for abuse mitigation. The image is resized and stored privately in Vercel Blob.
• When you use synchronisation, we store, among other things, open puzzles, piece positions, completed puzzles, points, favourites, metadata about the locally linked account, and settings of your puzzle room.
• For verification and recovery emails, Neon Auth and Resend process your email address, the required code or link, the email content, and technical delivery information.
• If you send us a question, complaint, or privacy request, we process your contact details, message, and the information necessary to verify your identity and handle your request properly.

Our legal bases for processing

• We process the core data for creating and securing an account, logging in, recovery emails, and account synchronisation to the extent necessary to provide the account service you request. The legal basis for this is the performance of our contract with you.
• Optional profile settings, such as a player name, country, favourite category, language, or avatar, are only processed when you use the respective feature yourself and to the extent necessary to provide that requested feature. Here too, the legal basis is the performance of our contract with you, but not the mere existence of an account. For participation in a public leaderboard or similar disclosure, we request separate prior consent.
• Technical request data, short operational logs, security, troubleshooting, and abuse prevention are processed based on our legitimate interest in keeping Nice Puzzles reliable and secure. In doing so, we limit the data, access, and retention period and weigh the interests of young users particularly heavily.
• We process data necessary to handle privacy requests or to assess, record, and report a personal data breach if necessary, to comply with legal obligations.
• Complaints and data necessary for the establishment, exercise, or defence of legal claims are processed based on our legitimate interest in protecting our rights and those of others.
• If we introduce a truly optional feature later that requires consent, we will request it separately in advance. We do not use the privacy notice as blanket consent.

Nice Puzzles does not sell personal data, does not use it for advertising profiling, and does not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Which service providers are involved

• Vercel hosts and delivers the website, processes technical request and runtime data, and stores uploaded avatars privately in Vercel Blob.
• Neon manages the database, accounts, and authentication, including email and Google login as well as linked puzzle data.
• Resend sends verification and recovery emails, processing the email address, email content, and delivery information for this purpose.
• Google is only involved if you choose to sign in with Google and processes that login under its own terms as well.

To the extent that a service provider processes personal data on our behalf, the agreement must comply with the requirements for processors under the GDPR. This includes arrangements regarding security, sub-processors, support for privacy rights, deletion, and data breaches. You can request information about each provider's current role and relevant arrangements via nicepuzzles@fifthwork.com.

Depending on the chosen regions and sub-processors, a service provider may process data outside the European Economic Area. Such a transfer is only permitted if a valid transfer mechanism applies, such as an adequacy decision or standard contractual clauses from the European Commission, and supplementary measures have been taken where necessary. You can check via nicepuzzles@fifthwork.com whether data is processed outside the European Economic Area and which mechanism is used.

How long data is retained

• Data in your browser remains until you clear it, replace it, or restart a puzzle. The cookie page specifies the criterion for each storage item.
• Account, profile, and linked puzzle data are retained as long as the account exists and the data is needed for the chosen features. We periodically review whether data from inactive accounts is still necessary. Following a valid deletion request, we delete or anonymise it, except where a legal obligation or the establishment, exercise, or defence of legal claims requires longer retention.
• An active avatar is retained as long as it belongs to your profile. Following replacement or a valid deletion request, the purpose for the old avatar has ceased to apply; the profile link and the file must then be deleted. If technical deletion does not succeed immediately, it must be retried and verified.
• Sessions persist until you log out or the session expires automatically. Temporary verification codes, OAuth security data, and recovery links expire after use or after their short technical validity period.
• Operational hosting and security logs are retained only as long as necessary to deliver the site, investigate disruptions, and handle abuse or security incidents. We choose the shortest appropriate setting wherever possible; longer retention requires a concrete, documented purpose.
• Email content, metadata, and delivery information at Resend are retained as long as necessary to deliver a message, investigate delivery issues or abuse, and comply with applicable obligations. The retention period configured with the provider is periodically reviewed and shortened where possible.
• Following active deletion, limited copies may temporarily remain in secure technical recovery facilities until the configured recovery cycle automatically overwrites them. They are not used for other purposes; after restoration, the deletion request must be implemented again.
• Privacy requests and necessary handling data are retained as long as necessary to process the request, demonstrate compliance, and handle any legal claims. Afterwards, we delete or anonymise them, unless a legal obligation requires longer retention.

These are retention periods or retention review criteria. We record current technical settings and periodically review whether data is still needed. If that is no longer the case, we delete or anonymise it, unless longer retention is required by law.

Your rights

You can request access, rectification, erasure, or restriction of processing of your personal data and, where applicable, data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. If processing is based on consent, you can withdraw that consent at any time. This does not affect the lawfulness of processing prior to withdrawal. These rights apply within the conditions and exceptions of the GDPR.

Email your request to nicepuzzles@fifthwork.com. We only ask for additional information if it is reasonably necessary to confirm your identity. We will provide information on action taken without undue delay and in any event within one month of receipt of the request. Depending on the complexity or the number of requests, this period may be extended by another two months if necessary. We will inform you of the extension and the reasons for it within the first month. If we do not act on your request, we will explain why within that same first month and inform you of your options for lodging a complaint and seeking a judicial remedy.

The download feature in your account provides a direct copy of part of your account and puzzle data. For a complete copy of your personal data in response to an access request, your avatar file, or deletion of your account, you can use nicepuzzles@fifthwork.com. Data stored solely in your browser can be cleared by yourself on that device.

If you disagree with our handling, you can lodge a complaint with a competent supervisory authority. Within the European Economic Area, this can be done in particular in the country of your habitual residence, your place of work, or the place of the alleged infringement. In the Netherlands, this is the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) via autoriteitpersoonsgegevens.nl.

For young puzzlers and legal representatives

Anyone can solve puzzles without an account. Being 16 is not a general requirement for using Nice Puzzles or an account. We do advise young puzzlers to have a legal representative help create and manage an account, avoid using a full real name, and not upload a recognisable photo of yourself. We do not base ordinary account features on a general consent checkbox. If processing is based on consent and you are under sixteen, consent from your legal representative is required, to the extent the law does not provide a specific exception.

A child can always ask for an explanation or help via nicepuzzles@fifthwork.com. As of 1 September 2026, the following applies in the Netherlands regarding GDPR privacy rights: if the child is under twelve, the legal representative exercises those rights; if the child is twelve to fifteen inclusive, the child can exercise those rights themselves and the legal representative can do so as well; from sixteen onwards, the young person exercises those rights themselves. A legal representative can withdraw consent, and from the age of twelve the child can also do so themselves.

How we secure data

We restrict access to personal data, use encrypted connections, secure sessions, check the origin of account changes, and keep custom avatars private. We document every personal data breach. If such a breach is likely to pose a risk to the rights and freedoms of individuals, we notify the competent supervisory authority without undue delay and, where feasible, no later than 72 hours after having become aware of it. If the breach is likely to result in a high risk, we inform the individuals concerned without undue delay, except where a legal exception applies.

If this explanation changes

If Nice Puzzles starts using different data, purposes, or technologies, we will update this page. In the event of a significant change, we will inform account holders appropriately. The date of the last modification is always shown at the top.