Privacy Policy
Operator (data controller): Datanius s.r.o., Dandova 2619/13, 193 00 Prague 9 – Horní Počernice, Czech Republic, Company No.: 30066786, registered in the Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), section C, file 456770 · privacy contact: hello@datanius.com · effective from 29 September 2026 (version 4.0). This document fulfils the information obligation under Articles 13 and 14 GDPR.
1. What data we process
Account: e-mail address, name, password hash (we never store passwords in readable form), role. Sign-in and security: technical session records including IP address and browser type. Content: your dictionaries, saved puzzles, game results (solve times, Hádaj results) and the guest name if you voluntarily enter one on a leaderboard. Word suggestions: the words you type into the generator's dictionary and a language code. We send them to a language-model provider so it can return more words on the same topic — details in section 4. Sending a puzzle by e-mail: the recipient's e-mail address and whether you consented to the newsletter. Push notifications: the technical subscription identifier (endpoint and cryptographic keys generated by your browser) and the A/B variant of the prompt shown to you. Extended analytics (only with your consent): a random visitor identifier and session recordings — an anonymised record of on-screen activity (clicks, scrolling, navigation); passwords and sensitive fields are masked and never recorded. Data stored only on your device (localStorage, not sent to the server unless you sign in): language, games in progress, local puzzles and dictionaries of anonymous users.
2. Purposes and legal bases
Running your account and providing the service's features — performance of a contract (Art. 6(1)(b) GDPR). One-off sending of a puzzle by e-mail — performance of a contract at your request (Art. 6(1)(b)). Word suggestions on your topic — performance of a contract at your request (Art. 6(1)(b)); it is a generator feature triggered by your typing in the dictionary. Newsletter and offers — your consent (Art. 6(1)(a)); consent is voluntary, separate (unchecked by default) and withdrawable at any time without affecting other features. Push notifications — your consent granted to the browser; withdrawable in browser settings. Service security, abuse prevention and session records including IP addresses — legitimate interest (Art. 6(1)(f)) in protecting the service. Anonymous traffic measurement and A/B testing — legitimate interest; measurements use no cookies and do not profile individuals. Extended analytics — visitor identifier and session recording — your consent (Art. 6(1)(a)), given via separate toggles in the cookie dialog and withdrawable at any time in the footer; recording stops immediately upon withdrawal.
3. How long we keep data
Account data and your content — for as long as the account exists; after cancellation we erase or anonymise them within 30 days. Session records (including IP addresses) — expire with the session, at the latest 30 days after it ends. Words sent for suggestions — we do not keep them on our side; the request is not logged. A recipient e-mail used only for a one-off puzzle delivery (without newsletter consent) — deleted within 30 days of sending. E-mail on the newsletter list — until you withdraw consent. Push subscriptions — until you cancel them in your browser or until we detect they are no longer valid. Guest names on public leaderboards — for as long as the puzzle exists; you can request erasure at any time.
4. Recipients and processors
We do not sell data and do not share it with third parties for advertising. We use the following processors to operate the service: Cloudflare, Inc. (USA) — hosting of the application and the database (Workers, D1). Everything you do in the service passes through it. Postmark (USA) — technical delivery of e-mail. It receives the recipient's address and the content of the message: for a puzzle sent by e-mail that is the puzzle title, its grid and its word list; for the newsletter, the subscriber's address and the newsletter text. Google (Gemini API) — word suggestions on your topic. Once your dictionary holds at least two words, the words you have typed and a language code are sent to Google so it can suggest more words on the same topic; the request goes out automatically while you are still building the list. We do not send the secret message, your name, your e-mail address or your account identifier, so Google does not learn who typed the words. Even so, treat the words you enter as data that leaves the service. The push service provider of your browser (e.g. Google, Mozilla or Apple) — technical delivery of push notifications; which one is determined by your browser. Analytics (umami) runs on the operator's own infrastructure — no third party involved. We disclose data to public authorities only where required by law.
5. Transfers outside the EU/EEA
Cloudflare, Postmark, Google and browser push providers are based in the USA and may process data on servers outside the European Economic Area. Where the recipient is certified under the EU–US Data Privacy Framework — Cloudflare and Google are — the transfer relies on the European Commission's adequacy decision. Otherwise it relies on the EU Standard Contractual Clauses under Art. 46(2)(c) GDPR.
7. Your rights
Under the GDPR you have the right to: access your data and obtain a copy (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent at any time without affecting the lawfulness of prior processing. To exercise your rights, write to the contact e-mail above; we will respond within one month at the latest. On request we will also delete your entire account with all data. If you believe we process your data unlawfully, you have the right to lodge a complaint with a supervisory authority. The lead authority for an operator seated in the Czech Republic is the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz; you may also complain to the authority in your own country — in Slovakia the Úrad na ochranu osobných údajov SR, Hraničná 12, 820 07 Bratislava, www.dataprotection.gov.sk.
8. Security
Data in transit is encrypted (HTTPS), passwords are stored exclusively as cryptographic hashes and only the operator has access to the production database. Push notification payloads are encrypted per the Web Push standard (RFC 8291).
9. Children
The service is suitable for children and most features require no personal data at all. Persons under 16 may register an account or consent to the newsletter only with the consent of a legal guardian. We will delete known children's accounts lacking such consent at the guardian's request.
10. Changes to this policy
The current version with its effective date is always published on this page. In case of material changes (new processing purposes, new processors) we will notify registered users by e-mail or by a notice in the service. Version 4.0 (29 September 2026) changed the operator: the service is no longer run by Ivan Sivák as a sole trader but by Datanius s.r.o. The purposes of processing, the data collected and your rights are unchanged; what changes is the entity answerable for them. Version 3.1 (29 September 2026) corrected the list of processors: e-mail is delivered by Postmark, not by MailChannels as previously stated here, and we added Google (Gemini API), which receives the words entered into the generator when suggestions are fetched.