Privacy Policy

The short version

Be Pieceful is a daily jigsaw puzzle game, on the web at bepieceful.com and in our iOS app. We have tried to collect as little as possible.

• You can play without an account, on either. Playing without an account is not anonymous, though — when you finish a puzzle we record your solve time, the difficulty you chose, and a rough device type, linked to a random ID stored on your device. We never see your name or email unless you create an account.
• Your streak, your in-progress board, your pieces and your settings live on your own device. If you create an account, we also keep enough to sync them across your devices.
• You get a player name — a short handle like quiet-fern — as soon as you start playing. It is created on our server, it is public to anyone you send an invite link to, and it is how friends find you. It is not derived from anything about you.
• If you add friends, they can see your player name, your current streak, and whether you have solved today. Nothing else — not your email, not your times, not what you bought.
• We do not sell or share your personal information. We do not run advertising, we do not use tracking cookies, and so we do not show a cookie banner.
• The iOS app sends you no push notifications. The daily reminder, if you turn it on, is scheduled by your own phone and never touches our servers.
• We use one privacy-friendly analytics tool on the website to count page views. It sets no cookies, stores nothing on your device, and cannot follow you to other sites. The app has no analytics SDK in it at all.
• Puzzle photographs are served directly from Unsplash's servers, which means Unsplash receives your IP address whenever a puzzle image loads.

The rest of this policy is the detail behind those points.

1. Who we are

Be Pieceful is operated by [LEGAL ENTITY NAME], [company number / sole trader], of [REGISTERED ADDRESS].

For the purposes of UK and EU data protection law, we are the data controller for the personal data described in this policy.

You can reach us about anything in this policy at [privacy@bepieceful.com].

This policy covers both the website at bepieceful.com and the Be Pieceful iOS app. Where the two behave differently, we say so.

2. Playing without an account

You do not need an account to play Be Pieceful, and we have deliberately kept the game free of sign-in requirements. But play is pseudonymous, not anonymous, and we want to be precise about the difference.

2.1 Stored on your device only

On the website, your browser stores:

In the iOS app, the same information is kept in two places on your phone:

We cannot read any of this remotely. On the web, clearing your browser data, using a private window, or switching browser or device loses it and we cannot restore it. On iOS, app group storage is removed when you delete the app; Keychain items are not, so reinstalling the app on the same phone recovers your player name and identity, which is the point.

Liked puzzles are recorded on your device only and are not sent to us today.

2.2 Your player name

The first time you play, we create a player record on our server holding:

• a player name — a short handle assembled from a fixed word list, such as quiet-fern, or one you choose yourself from the same alphabet. It is unique across Be Pieceful.
• an invite slug — an unguessable string that makes up your invite link. You can rotate it at any time, which invalidates the old one.
• the dates the record was created and the name was last changed.

This record exists before and without any account, and is not linked to an email address unless you later create one. Your player name is public to anyone who has your invite link or already knows the name, and it is what other players see. Please do not put anything in it you would not want a stranger to read.

If you change or release a name, we keep the old name in a hold list for 30 days so that nobody else can immediately take a handle your friends have already shared. During that window the entry records the name and, where relevant, that your player record has first refusal on it.

2.3 Your device credential

Each device also holds a device token — a secret we issue once, at the moment your player record is created. We store only a hash of it, never the token itself, together with which player it belongs to and when we last saw it used. It is how a device proves it is yours without you signing in. It is deliberately separate from the random bp_sid above, because bp_sid travels in unauthenticated requests and is not a secret.

2.4 Sent to our server when you finish a puzzle

• the puzzle date, your solve time in seconds, and the grid size you chose
• whether you were solving a past puzzle rather than that day's
• a coarse device type (mobile / tablet / desktop) and browser family (Safari / Chrome / Firefox / Edge / Samsung / other). Solves from the iOS app are recorded simply as ios / app.
• the random bp_sid ID from your device, and the time we received it

We do not record your IP address in this data, and we do not store your full browser user-agent string — it is classified into the coarse buckets above and then discarded.

2.5 If you later create an account

We link the device to your new account so your existing streak, pieces and player name carry over. This means records created before you signed in become associated with your identity retrospectively. That is the point of the feature, but it is worth stating plainly.

If the device you sign in on already has a player name and the account already has a different one, we ask you which to keep and permanently retire the other, holding the retired name for 30 days as described above.

3. What we collect, and why

3.1 If you create an account

Accounts are handled by Clerk, our authentication provider. When you sign up, Clerk collects and holds your email address, your password or the profile details from whichever sign-in method you used, your session and device records, and security information including your IP address.

In the iOS app you can sign in with an email address and password, with Apple, or with Google. On the website, the available methods are [CONFIRM WHICH SOCIAL PROVIDERS ARE ENABLED IN CLERK]. If you use Sign in with Apple and choose to hide your email address, Apple gives us a relay address instead of your real one, and we neither receive nor store your real address.

In our own database we store only:

• your Clerk user ID
• your email address
• the date your account was created
• a link from your account to your player record, and to the devices you have signed in on
• your settings, so they follow you between devices — sound, haptics, reminder time, chosen avatar, and board theme

Legal basis: performance of a contract — we cannot provide an account and cross-device sync without this.

3.2 Gameplay data

The solve records described in section 2.4, for players with and without accounts. We use them to show you your own history and streak, and in aggregate to understand how difficult each day's puzzle turned out to be and whether the game is working properly.

Legal basis: legitimate interests — specifically, showing you your own streak and history, and understanding whether a given puzzle is too hard or the game is broken. We consider this low-impact because the data is limited to game outcomes and coarse device information, and reveals nothing about you beyond how you played a puzzle.

3.3 Friends

If you add friends, we store one record per friendship: the two players it joins, who sent the request, whether it is pending or accepted, and when. Friendships are limited to 20 per player.

What a friend can see about you is deliberately narrow: your player name, your current streak, and whether you have solved today. Not your email, not your solve times, not your account status, not what you own. Widening that is a product decision we would have to make deliberately, and we would update this policy first.

If you block someone, we store that you blocked them. A block is one-directional and is never shown to the person blocked — they simply stop appearing to you and you to them.

If you report someone, we store the report: who reported, who was reported, the reported player's name at the time, your reason if you gave one (up to 500 characters), and when. We also send that report to ourselves by email so a person actually reads it — see section 6. Reports are kept as the durable record even if the email fails.

Legal basis: performance of a contract for the friend list itself; legitimate interests for blocks and reports — keeping players safe and being able to act on abuse.

3.4 Pieces, the shop and your habitat

Pieces are earned by solving puzzles. They cannot be bought with money. When you spend them, we record one row per item: the catalogue item's ID, the price in pieces you paid, when, and the random device ID it belongs to. We store purchases as a list of what you own rather than a running balance, which is what lets two devices merge cleanly when you sign in.

Legal basis: performance of a contract — so what you have bought survives reinstalling the app or moving to a new phone.

3.5 bepieceful+ subscriptions

If you subscribe to bepieceful+, the payment itself is handled entirely by Apple. We never see your card details, and Apple does not give us your name or billing address.

We use RevenueCat to tell us whether a subscription is active. The RevenueCat SDK in the app creates its own anonymous identifier for your device — we do not pass it your player name, your email or your Be Pieceful IDs — and it processes your App Store transaction and receipt information, the product you bought, your country storefront, and device and app version information, in order to answer one question: does this device have bepieceful+ or not.

Legal basis: performance of a contract — we cannot give you what you paid for without being able to check that you paid for it.

3.6 Reminders

The daily reminder in the iOS app is a local notification. Your phone schedules it and your phone delivers it. We operate no push notification service, we are not issued an Apple push token, and no reminder passes through our servers. The time you choose is stored on your device, and synced with your other settings if you have an account. If you decline the reminder we do not ask again in the app.

3.7 Abuse prevention and rate limits

Some endpoints have to be protected from automated abuse: creating player records, checking whether a name is available, and looking players up by name or invite link. To do that we count requests against a bucket that includes the caller's IP address, so that one machine cannot mint thousands of names or probe the whole namespace.

This is the one place in our own database where an IP address is stored. It is not attached to your player record, your account, or your solve history, and it is not used for analytics, profiling or advertising. We do not currently delete these counters on a schedule — see section 8, where we say so rather than implying a retention period we do not operate.

Legal basis: legitimate interests — preventing abuse of a free service, and protecting the pool of player names from being taken in bulk.

3.8 Bot protection

We use Vercel BotID on the website endpoint that records completed puzzles, to stop automated submissions from corrupting solve statistics. It collects browser and interaction signals from your device in order to distinguish a person from a script. It runs on the website only; the app's equivalent endpoint is protected by the credentials and validation described above instead.

Legal basis: legitimate interests — keeping solve times and any future leaderboards honest.

3.9 Server logs

Our hosting provider, Vercel, keeps standard technical logs of requests to the site and to the API the app talks to, which include IP addresses and user-agent strings. These are generated by the hosting platform rather than by Be Pieceful, and we use them only for security and diagnosing faults.

Legal basis: legitimate interests — security and keeping the service running.

3.10 Website analytics

We use Vercel Web Analytics on bepieceful.com to see how many people visit the site and which pages they use. It records the page visited, the referring site, and coarse device, browser, and country information.

It is cookieless. It stores nothing on your device and sets no identifier that persists. Visits are counted using a value derived from the incoming request that is regenerated daily, so the same visitor cannot be recognised from one day to the next, and cannot be followed onto any other site. We see totals and trends, never individuals, and this data is not linked to your account.

The iOS app contains no analytics SDK. What we know about app usage comes from the solve records in section 2.4 and nothing else.

Legal basis: legitimate interests — understanding whether the game is being found and used.

3.11 What we do not collect

We do not collect your name (unless you give it to Clerk at sign-up), your location, your contacts, your calendar, your photos, your health data, or anything about your activity on other apps or sites.

Specifically, in the iOS app:

• We never ask for access to your photo library or camera. The "photo" avatar option is a crop of the puzzle picture you last finished — one of our own images, already on your device.
• We do not use the advertising identifier (IDFA) and we show no App Tracking Transparency prompt, because we do not track you across other companies' apps or websites.
• We do not collect precise device identifiers, and we do not fingerprint your device.

We do not run advertising or advertising trackers anywhere. Apart from the cookieless page-view analytics described in section 3.10, we have no third-party analytics product installed — no Google Analytics, no Meta pixel, no session recording, and no cross-site tracking of any kind.

4. Sharing your result

When you share a completed puzzle, your device builds a short piece of text — the date, your time, your streak, and a link to the game — and passes it to your operating system's share sheet or your clipboard. Nothing is sent to us when you share, and no image is uploaded. Where it goes next is entirely determined by which app you choose.

The same is true of your invite link: we generate the slug, but sending it to somebody is something your device does, not something we do.

5. Cookies and local storage

Be Pieceful sets no tracking cookies and no advertising cookies. The iOS app sets no cookies at all.

The device storage listed in section 2.1 is what UK and EU rules call strictly necessary: the game cannot remember your in-progress board, your streak, your pieces or your chosen theme without it, and that is the service you asked for. Our page-view analytics (section 3.10) is cookieless and writes nothing to your device, so there is no non-essential storage for you to consent to. Because of this, and because we run no advertising technology, we do not show a cookie consent banner.

On the website, signing in causes Clerk to set session cookies to keep you logged in, and we set a cookie carrying your device credential. Both are strictly necessary for the service.

If we ever add anything that stores an identifier for advertising, follows you across other apps or sites, or otherwise goes beyond the strictly necessary storage and cookieless measurement described above, we will ask for your consent first and update this policy before doing so.

6. Who we share data with

We do not sell your personal information, and we do not share it for advertising. We use the following service providers, each of whom processes data on our behalf or as a controller in its own right where stated:

About Apple. When you buy bepieceful+, Apple is the seller. Your relationship for that payment is with Apple, under Apple's own privacy policy, and we are told only that an entitlement exists.

About Unsplash. Puzzle photographs are served to your device directly from Unsplash's image servers rather than copied onto ours. This is required by the terms under which we are allowed to use their photography. The practical consequence is that your device makes a direct request to Unsplash each time a puzzle loads, and Unsplash therefore receives your IP address and browser details. This happens whether or not you have an account. Unsplash's own privacy policy governs what they do with it: https://unsplash.com/privacy

We will also disclose data where we are legally required to, or where it is necessary to protect our rights or someone's safety. A report of illegal content or conduct may be passed to the police or another authority.

7. International transfers

All of the providers above process data in the United States. Where we transfer personal data out of the UK or EEA, we rely on [the EU–US Data Privacy Framework and its UK extension where the provider is certified, and otherwise on Standard Contractual Clauses and the UK International Data Transfer Addendum — CONFIRM PER VENDOR]. You can ask us for details of the safeguards in place at [privacy@bepieceful.com].

8. How long we keep things

An honest note about deleting your account. Deleting your account removes your email address, your account record and settings, your player record and name, your friendships, your blocks, the reports you filed, and the links between your account and your devices. Your player name is then held unusable for 30 days before anyone else can take it.

Your individual solve records and pieces purchases are keyed to the random device ID rather than to your account, so they are not deleted — they remain as unlinked, pseudonymous rows showing that some device solved a puzzle in a given time, or bought a catalogue item. Once the account and player links are gone we have no way to connect them back to you.

We would rather tell you this than promise an erasure we do not currently perform. If you want those records removed as well, contact us at [privacy@bepieceful.com] and we will do it manually.

9. Your rights

If you are in the UK or the EEA, you have the right to:

• access the personal data we hold about you, and get a copy
• correct it if it is wrong
• erase it, in the circumstances the law provides for
• restrict or object to our processing, including objecting to any processing we do on the basis of legitimate interests
• port your data to another service
• withdraw consent, where we have relied on consent

To exercise any of these, email [privacy@bepieceful.com]. We will respond within one month. If your request is complex we may extend this by up to two further months, and we will tell you within the first month if so.

If you are signed in when you contact us from your account email, that is normally enough for us to verify who you are. If you have no account, telling us your player name is usually enough for us to find your record. We will not ask for identity documents unless we genuinely cannot otherwise be confident.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (https://ico.org.uk/make-a-complaint/). In the EEA it is the authority in your country of residence.

If you are in the United States: we do not sell or share your personal information, and we have not done so in the preceding twelve months. Depending on your state, you may have rights to know, delete, and correct your data — use the same address above and we will honour them regardless of which state you are in.

10. Children

Be Pieceful is a general-audience game and is not directed at children. You must be at least 13 to use it if you are in the United States or the United Kingdom, and at least 16 elsewhere. [CONFIRM — see decision list.]

Be Pieceful lets players connect with each other by name and invite link, which is why we take the minimum age seriously rather than treating it as a formality. We do not knowingly collect personal data from children below those ages. If we learn that we have, we will delete the account, the player record and the associated data. If you believe a child has given us their information, contact [privacy@bepieceful.com].

11. Security

We keep your data on managed, access-controlled infrastructure, and all traffic is encrypted in transit. Device credentials are stored hashed on our servers — we cannot read a device's token even if we wanted to — and on iOS they are kept in the system Keychain rather than ordinary app storage. Administrative access to the game's back office is limited to a named allowlist.

No service can promise perfect security, but we have tried not to hold anything we do not need — which is the most effective protection available to a game like this one.

12. Changes to this policy

If we change this policy we will update the date at the top. If the change is significant — a new category of data, a new provider, or a new purpose — we will tell you in the app or on the site before it takes effect.

13. Contact

[privacy@bepieceful.com] [LEGAL ENTITY NAME], [REGISTERED ADDRESS]