Privacy Policy

The short version

Be Pieceful is a daily jigsaw puzzle game. We have tried to collect as little as possible.

• You can play without an account. Playing as a guest is not anonymous, though — when you finish a puzzle we record your solve time, the difficulty you chose, and a rough device and browser type, linked to a random ID stored in your browser. We never see your name or email unless you create an account.
• Your streak, your in-progress board, and your settings live in your own browser's local storage.
• If you create an account, we store your email address so we can sync your streak across devices.
• We do not sell or share your personal information. We do not run advertising. We do not use tracking cookies, and so we do not show a cookie banner.
• We use one privacy-friendly analytics tool to count page views. It sets no cookies, stores nothing on your device, and cannot follow you to other sites.
• Puzzle photographs are served directly from Unsplash's servers, which means Unsplash receives your IP address whenever a puzzle image loads.

The rest of this policy is the detail behind those points.

1. Who we are

Be Pieceful is operated by [LEGAL ENTITY NAME], [company number / sole trader], of [REGISTERED ADDRESS].

For the purposes of UK and EU data protection law, we are the data controller for the personal data described in this policy.

You can reach us about anything in this policy at [privacy@bepieceful.com].

2. Playing as a guest

You do not need an account to play Be Pieceful, and we have deliberately kept the guest path free of sign-in requirements. But guest play is pseudonymous, not anonymous, and we want to be precise about the difference.

Stored in your browser only. When you play, your browser stores:

We cannot read these remotely. If you clear your browser data, use a private window, or switch browser or device, they are gone and we cannot restore them.

Sent to our server. When you complete a puzzle, we record:

• the puzzle date, your solve time in seconds, and the grid size you chose
• whether you were solving a past puzzle rather than that day's
• a coarse device type (mobile / tablet / desktop) and browser family (Safari / Chrome / Firefox / Edge / Samsung / other)
• the bp_sid random ID from your browser, and the time we received it

We do not record your IP address in this data, and we do not store your full browser user-agent string — it is classified into the coarse buckets above and then discarded.

If you later create an account, we link the bp_sid on that device to your new account so your existing streak carries over. This means solve records created while you were a guest become associated with your identity retrospectively. That is the point of the feature, but it is worth stating plainly.

3. What we collect, and why

3.1 If you create an account

Accounts are handled by Clerk, our authentication provider. When you sign up, Clerk collects and holds your email address, your password or the profile details from whichever social sign-in you used [CONFIRM WHICH SOCIAL PROVIDERS ARE ENABLED IN CLERK], your session and device records, and security information including your IP address.

In our own database we store only:

• your Clerk user ID
• your email address
• the date your account was created
• which devices you have linked to the account

Legal basis: performance of a contract — we cannot provide an account and cross-device sync without this.

3.2 Gameplay data

The solve records described in section 2, for both guests and account holders. We use them to show you your own history and streak, and in aggregate to understand how difficult each day's puzzle turned out to be and whether the game is working properly.

Legal basis: legitimate interests — specifically, showing you your own streak and history, and understanding whether a given puzzle is too hard or the game is broken. We consider this low-impact because the data is limited to game outcomes and coarse device information, and reveals nothing about you beyond how you played a puzzle.

3.3 Bot protection

We use Vercel BotID on the endpoint that records completed puzzles, to stop automated submissions from corrupting solve statistics. It collects browser and interaction signals from your device in order to distinguish a person from a script.

Legal basis: legitimate interests — keeping solve times and any future leaderboards honest.

3.4 Server logs

Our hosting provider, Vercel, keeps standard technical logs of requests to the site, which include IP addresses and user-agent strings. These are generated by the hosting platform rather than by Be Pieceful, and we use them only for security and diagnosing faults.

Legal basis: legitimate interests — security and keeping the service running.

3.5 Website analytics

We use Vercel Web Analytics to see how many people visit the site and which pages they use. It records the page visited, the referring site, and coarse device, browser, and country information.

It is cookieless. It stores nothing on your device and sets no identifier that persists. Visits are counted using a value derived from the incoming request that is regenerated daily, so the same visitor cannot be recognised from one day to the next, and cannot be followed onto any other site. We see totals and trends, never individuals, and this data is not linked to your account.

Legal basis: legitimate interests — understanding whether the game is being found and used.

3.6 What we do not collect

We do not collect your name (unless you give it to Clerk at sign-up), your location, your contacts, your precise device identifiers, or anything about your activity on other sites. We do not run advertising or advertising trackers. Apart from the cookieless page-view analytics described in section 3.5, we have no third-party analytics product installed — no Google Analytics, no Meta pixel, no session recording, and no cross-site tracking of any kind.

4. Sharing your result

When you share a completed puzzle, your device builds a short piece of text — the date, your time, your streak, and a link to the game — and passes it to your operating system's share sheet or your clipboard. Nothing is sent to us when you share, and no image is generated or uploaded. Where it goes next is entirely determined by which app you choose.

5. Cookies and local storage

Be Pieceful sets no tracking cookies and no advertising cookies.

The browser storage listed in section 2 is what UK and EU rules call strictly necessary: the game cannot remember your in-progress board, your streak, or your chosen theme without it, and that is the service you asked for. Our page-view analytics (section 3.5) is cookieless and writes nothing to your device, so there is no non-essential storage for you to consent to. Because of this, and because we run no advertising technology, we do not show a cookie consent banner.

If you sign in, Clerk sets session cookies to keep you logged in. These are also strictly necessary for the account service.

If we ever add anything that stores an identifier on your device, follows you across other sites, or otherwise goes beyond the cookieless measurement described above, we will ask for your consent first and update this policy before doing so.

6. Who we share data with

We do not sell your personal information, and we do not share it for advertising. We use the following service providers, each of whom processes data on our behalf:

About Unsplash. Puzzle photographs are served to your browser directly from Unsplash's image servers rather than copied onto ours. This is required by the terms under which we are allowed to use their photography. The practical consequence is that your browser makes a direct request to Unsplash each time a puzzle loads, and Unsplash therefore receives your IP address and browser details. This happens whether or not you have an account. Unsplash's own privacy policy governs what they do with it: https://unsplash.com/privacy

We will also disclose data where we are legally required to, or where it is necessary to protect our rights or someone's safety.

7. International transfers

All of the providers above process data in the United States. Where we transfer personal data out of the UK or EEA, we rely on [the EU–US Data Privacy Framework and its UK extension where the provider is certified, and otherwise on Standard Contractual Clauses and the UK International Data Transfer Addendum — CONFIRM PER VENDOR]. You can ask us for details of the safeguards in place at [privacy@bepieceful.com].

8. How long we keep things

An honest note about deleting your account. Deleting your account removes your email address, your account record, and the links between your account and your devices. Your individual solve records are keyed to the random device ID rather than to your account, so they are not deleted — they remain as unlinked, pseudonymous rows showing that some device solved a puzzle in a given time. Once the account link is gone we have no way to connect them back to you.

We would rather tell you this than promise an erasure we do not currently perform. If you want those records removed as well, contact us at [privacy@bepieceful.com] and we will do it manually.

9. Your rights

If you are in the UK or the EEA, you have the right to:

• access the personal data we hold about you, and get a copy
• correct it if it is wrong
• erase it, in the circumstances the law provides for
• restrict or object to our processing, including objecting to any processing we do on the basis of legitimate interests
• port your data to another service
• withdraw consent, where we have relied on consent

To exercise any of these, email [privacy@bepieceful.com]. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if so.

If you are signed in when you contact us from your account email, that is normally enough for us to verify who you are, and we will not ask for identity documents unless we genuinely cannot otherwise be confident.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/). In the EEA it is the authority in your country of residence.

If you are in the United States: we do not sell or share your personal information, and we have not done so in the preceding twelve months. Depending on your state, you may have rights to know, delete, and correct your data — use the same address above and we will honour them regardless of which state you are in.

10. Children

Be Pieceful is a general-audience game and is not directed at children. You must be at least 13 to use it if you are in the United States or the United Kingdom, and at least 16 elsewhere. [CONFIRM — see decision list.]

We do not knowingly collect personal data from children below those ages. If we learn that we have, we will delete the account and the associated data. If you believe a child has given us their information, contact [privacy@bepieceful.com].

11. Security

We keep your data on managed, access-controlled infrastructure, all traffic is encrypted in transit, and administrative access to the game's back office is limited to a named allowlist. No service can promise perfect security, but we have tried not to hold anything we do not need — which is the most effective protection available to a game like this one.

12. Changes to this policy

If we change this policy we will update the date at the top. If the change is significant — a new category of data, a new provider, or a new purpose — we will tell you in the app before it takes effect.

13. Contact

[privacy@bepieceful.com] [LEGAL ENTITY NAME], [REGISTERED ADDRESS]