Privacy Policy
Last updated: 10/02/2026
This policy explains what personal data Tracks: Daily Train Puzzle (“Tracks”, “we”, “us”) collects when you play at play.trackspuzzle.com or in our mobile app, why we collect it, how long we keep it, and the rights you have over it. We collect as little as the game needs to work.
1. Who is responsible for your data
The data controller is Josserand Gallot, 77240 Vert-Saint-Denis.
SIRET: 501 670 343 00067.
Contact for any privacy question or request: contact@trackspuzzle.com.
2. What we collect
When you start playing (guest account)
You can play without giving us your name or email. On your first visit we create an anonymous guest account, identified only by a random identifier, so your solves can be saved.
Age check
The game may ask for your birth month, birth year and country to check that you are old enough to use it. We never store your date of birth. When we ask, we keep only the result (allowed or not), the time of the check, and your country.
Game data
- The puzzles you solve, when you solved them, and whether you used hints or checks.
- Your daily progress (such as the days you played) and your weekly league points and results.
- Hint and check requests, kept briefly so the same request is not counted twice (see section 5).
- The day you were last active, used to remove guest accounts that are no longer used.
If you link an account
- Email: your email address, to send you a one-time sign-in code and to let you recover your progress on another device.
- Google: the identifier and email address Google shares with us when you choose “Continue with Google”. We do not receive your Google password or access to your other Google data.
- League display name: the name you choose to appear in the weekly league standings.
Settings
Your notification preference (whether you want a reminder when new puzzles are released).
Technical data
- Your IP address and basic request information (time, browser or app version), which our hosting and database providers process to deliver the service and keep it secure.
- A small number of diagnostic events (for example, when a solve could not be recorded), used to find and fix problems. Where the law requires your consent for such measurement, we ask for it first and record your choice.
Data stored on your device
The game stores your sign-in session, your settings, unfinished grids, cached puzzles and solves waiting to be sent in your browser’s local storage (IndexedDB and local storage) or on your phone. This is strictly necessary for the game to work, including offline, and is not used to track you. We do not use advertising cookies or third-party trackers.
3. Why we use it, and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the game: accounts, saving solves, hints, the archive, weekly leagues | Performance of our contract with you (Art. 6(1)(b)) |
| Checking your age | Legal obligation and our legitimate interest in protecting children (Art. 6(1)(c) and (f)) |
| Sending sign-in codes by email | Performance of our contract with you (Art. 6(1)(b)) |
| Security, preventing abuse, fixing bugs | Our legitimate interest in a working, secure service (Art. 6(1)(f)) |
| Usage measurement, where consent is required | Your consent (Art. 6(1)(a)), which you can withdraw at any time |
| Daily puzzle reminders | Your consent, given through your device’s notification permission and the in-game setting |
We do not sell your data, use it for advertising, or make decisions about you by automated means that have legal effects.
4. Who else sees your data
Other players
If you take part in the weekly leagues, your display name and your points for the week are shown to the other players in your league group. Nothing else about you is shown to them.
Our service providers
We use these providers, who process data only on our instructions:
- Supabase (database, accounts and servers), hosted in Ireland.
- OVHcloud (hosting of this website and the web version of the game), in France.
- Resend (sending sign-in code emails).
- Google (only if you choose “Continue with Google”).
Transfers outside the EU
Some of these providers are based in, or may access data from, the United States. Where this happens, the transfer is protected by the EU–US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.
We may also disclose data where the law requires it, for example to a court or public authority.
5. How long we keep it
- Your account and game data: as long as you have an account.
- Guest accounts: deleted automatically after 12 months without any activity.
- After you ask to delete your account: removed 7 days after your request (you can cancel during that time by signing in). Copies in our providers’ backups disappear when those backups expire, within 7 days.
- Hint and check request records: 7 days.
- Diagnostic events: kept after your account is deleted only without any link to you.
- Server logs (IP addresses): kept by our providers for a short period.
6. Your rights
Under the GDPR you have the right to:
- access the data we hold about you, and receive a copy of it;
- have inaccurate data corrected (you can change your display name in Settings at any time);
- have your data deleted;
- restrict or object to some uses of your data;
- receive your data in a portable format;
- withdraw your consent at any time, without affecting what was done before;
- give instructions about what happens to your data after your death (French law).
Deleting your account: in the game, open Settings → Delete account. You can also ask us by email at contact@trackspuzzle.com, or use our account deletion page.
For any other request, write to contact@trackspuzzle.com. We will answer within one month. We may ask you to prove the account is yours, for example by signing in.
If you think we have not respected your rights, you can complain to the French data protection authority, the CNIL, or to the authority of the EU country where you live.
7. Children
Tracks is a general-audience puzzle game. You must be at least 13, or the minimum age in your country (15 in France without parental consent) to play. Our age check does not store your date of birth. If you are a parent and believe your child has given us personal data, contact us and we will delete it.
8. Security
Data travels over encrypted connections (HTTPS). Each player can read only their own data, access to our systems is restricted, and secrets are never shipped in the game. No system is perfectly secure, but we take reasonable measures to protect your data and will tell you and the authorities about a breach when the law requires it.
9. Changes to this policy
We may update this policy as the game changes. We will change the date at the top, and tell you in the game before any significant change takes effect.
10. Contact
Josserand Gallot, 77240 Vert-Saint-Denis
contact@trackspuzzle.com