Privacy Policy

Effective 12 August 2026 · Last updated 12 August 2026

This policy covers the Sudoku mobile app (com.kiliworld.sudoku), its desktop build, and this website. It describes every category of data the app handles, and is written against the app as it is actually built — not a generic template.

The service is operated by Kiliworld ("we", "us"), the developer of the app. For any question about this policy, or to exercise any right described in it, write to [email protected].

The short version.

You can play solo without an account, and without giving us anything.
An account stores your email, a hashed password, a display name and an avatar color. That is the whole of it.
The current version of the app contains no advertising, analytics or tracking SDK. If that ever changes, this policy is updated before the change ships — see section 10.
We do not sell your personal data.
You can have your account and all data attached to it permanently deleted — see Delete account.

1. Data we collect

1.1 Account data — only if you create an account

Creating an account is optional; solo play does not require one. It is required to create or join a multiplayer room, because other players need something to identify you by. When you register we store one record containing:

Data	Why we hold it
Email address	It is your login identifier, and the only way we can reach you about your account. We do not send marketing email.
Password — stored only as a hash	To verify it is you at sign-in. Your password is never stored, logged, or transmitted to us in a recoverable form; see section 6 for the exact algorithm.
Display name (up to 40 characters)	Shown to you in the app and to the other players in a multiplayer room. You choose it, and can change it at any time in Settings. It does not have to be your real name.
Avatar color	One value from a fixed palette of eight colors. It is your entire avatar — the app has no photo or image upload, so there is nothing else to it.
An internal account identifier	A random identifier we generate. It links your account to your sign-in sessions internally, and is what other players' devices see instead of your email.
Sign-in method and account creation date	Housekeeping: which method created the account (currently email + password) and when.

1.2 Sign-in session data

Staying signed in between launches requires a long-lived credential on your device. For each device you are signed in on, we store one record containing: a hash of the sign-in token (never the token itself), the account it belongs to, its creation, last-use and expiry times, whether it has been revoked, and — when your device supplies them — a device identifier, a device name, and a platform name (for example "android"). This metadata exists so that a signed-in device can be listed and revoked individually rather than only "sign out everywhere".

The short-lived token that authorises each request is not stored on our servers at all; it is verified by its own cryptographic signature and expires after 15 minutes.

1.3 Data handled during multiplayer play

While you are in a room, the server relays between the players in that room: your display name, your avatar color, your internal account identifier, the digits you place, and which cell you currently have selected (so others can see where you are working). Your email is never sent to other players.

A room lives only in the server's working memory. It holds the puzzle, the current board and each player's connection, and it is destroyed the moment its last player disconnects. Rooms and their contents are never written to our database, so there is no game history, no match record and no leaderboard.

Pencilled-in candidate notes are private to you: they are held on your device only and are never sent to the server or to other players.

1.4 Technical data our servers process automatically

IP address. Your device's IP address reaches our server as an unavoidable part of any internet connection. We use it for two things: as the counting key for abuse rate-limiting (so one source cannot flood puzzle generation or room creation), and in server request logs. The rate-limiting counters live only in the server's working memory, are not stored in the database, and are lost whenever the server restarts. Once you are signed in, rate-limiting on account-protected endpoints counts against your account identifier rather than your IP address.
Server request logs. Each request our backend serves is logged with its timestamp, HTTP method, path, response status, how long it took, and the calling IP address. These are ordinary operational logs used for debugging and abuse investigation. They are held by our hosting provider and rotate out automatically; we do not build profiles from them and do not combine them with your account data.

1.5 Data that never leaves your device

The following are stored locally by the app and are never transmitted to us: your theme, brightness, highlight color and font choices; your best solve time; the puzzle you have in progress; and your pencilled-in notes. On Android, the credential that keeps you signed in is stored in the operating system's encrypted preference storage. Uninstalling the app removes all of it.

1.6 What we do not collect

This section describes the current version of the app. It is a statement of how the app is built today, not a permanent guarantee; if a future version collects something new, this policy is updated before that version is released (section 10).

The app requests exactly one Android permission — INTERNET — and that is the whole of its access to your device. It does not collect or access: your location, contacts, calendar, camera, microphone, photos, files, installed-app list, phone number, advertising identifier, or any other device identifier beyond the app-generated one described in section 1.2. This version of the app contains no SDK from any advertising, analytics, attribution, crash-reporting or social network.

2. How we use data

We use the data above only to:

create your account and sign you in, and keep you signed in;
show your name and color to the other players in a room you joined;
generate and serve puzzles;
protect the service against abuse, scripted traffic and credential theft;
diagnose faults and keep the service running;
reply to you when you contact us.

We do not use your data for profiling or automated decision-making, and we do not build a behavioural profile of you. We do not send you marketing email.

3. Legal bases (GDPR)

Where the GDPR applies, we rely on: performance of a contract for account data and multiplayer data (we cannot provide an account or a room without them); and our legitimate interests in keeping the service secure and functioning for IP-based rate limiting, server logs and session-security measures. We do not rely on consent for anything, because we process nothing optional.

We do not sell your personal data. In this version of the app, data is disclosed only to the service providers we need in order to run the service, each acting on our instructions:

Provider	Role
Render	Hosts the backend server that serves the app.
MongoDB Atlas	Hosts the database holding accounts and session records.
Cloudflare	Hosts and serves this website. It does not host app or account data.
Google Play	Distributes the Android app. Anything Google collects as the app store is governed by Google's own privacy policy, not this one.

Other players in a room you join necessarily see your display name and avatar color, as described in section 1.3.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim or to address fraud or a security incident.

5. International transfers

Our providers operate data centres in several countries, so your data may be stored and processed outside the country you live in, including in the United States. Where data originating in the European Economic Area or the United Kingdom is transferred, the transfer relies on the safeguards our providers have in place, such as the European Commission's Standard Contractual Clauses.

6. How we protect data

All traffic is encrypted in transit. The app talks to the backend over HTTPS, and multiplayer rooms over an encrypted WebSocket connection.
Passwords are never stored. We store only a PBKDF2-HMAC-SHA256 hash computed over 100,000 iterations with a random per-account salt. Hashes are compared in constant time. A password cannot be recovered from what we hold — not by us, and not by anyone who obtained a copy of the database.
Sign-in tokens are stored hashed too, as a SHA-256 digest, so the database never contains a usable credential.
Sign-in tokens rotate on every use. Each use invalidates the previous token and issues a fresh one. If a token that has already been used is presented again — the signature of a stolen credential — every session on that account is revoked immediately and the account must sign in again.
Sessions expire. Request-authorising tokens last 15 minutes; the credential that keeps you signed in expires after 60 days and is then deleted automatically by the database.
On-device storage is encrypted on Android, using the platform's encrypted preference storage.

No system is perfectly secure, and we cannot guarantee absolute security. If a breach affects your personal data, we will notify you and any competent supervisory authority as required by applicable law.

7. How long we keep data

Data	Retention
Account record	Until you ask us to delete your account, then removed permanently.
Sign-in session records	Deleted automatically by the database once expired (60 days), or immediately when you sign out or delete your account.
Multiplayer room contents	Never stored. Discarded when the last player leaves.
Server request logs	Kept short-term for operations by our hosting provider and rotated out automatically.
Rate-limiting counters	In memory only; cleared on server restart.
Support email	Kept as long as needed to resolve your request and to keep a record that we handled it.

8. Your rights

Depending on where you live, you have the right to access the personal data we hold about you, to correct it, to have it deleted, to restrict or object to its processing, and to receive a copy of it in a portable format. You also have the right to lodge a complaint with your local data protection authority.

In practice:

Correction — change your display name and avatar color yourself at any time, in the app's Settings screen.
Ending sessions — sign out on a device, or use "log out everywhere" to revoke every signed-in device at once.
Access, portability or deletion — email [email protected] from the address on the account. Deletion is documented step by step on the Delete account page.

We answer within 30 days, and we do not charge for these requests. We may ask you to confirm control of the account's email address before acting on a request, to make sure we are not disclosing or destroying someone else's data.

9. Children

The app is not directed to children, and we do not knowingly collect personal data from anyone under 13 (or the minimum age of digital consent in your country, where that is higher). If you believe a child has created an account, contact us and we will delete it.

10. Changes to this policy

If we change what we collect or what we do with it, we will update this page and change the "last updated" date above. Material changes will also be announced in the app or by email to the address on your account before they take effect.

11. Contact

Kiliworld — [email protected]

We are the data controller for the personal data described in this policy.