Terms of Service

The Service

The Site (sudoku.sixturkies.com) is a free web application for playing sudoku, operated by its sole owner-operator ("we", "us"). You can browse our public marketing pages — the landing page and the About page — without an account. To play puzzles you need to create a free account first. As of today the Service is provided at no cost.

Once signed in, the app lets you:

• Generate new puzzle boards on demand. Puzzles are created server-side across three difficulty levels (easy, medium, hard), based on how many starting clues each board carries.
• Play your puzzles with progress saved move-by-move under your account, so you can pick up where you left off between visits. Each play also remembers any per-play settings overrides you make.
• Set default gameplay preferences on the settings page, which apply to future plays unless you override them for an individual game.
• Delete individual puzzles or plays whenever you want. A puzzle board is fixed once it has been generated — it cannot be edited or modified afterwards — so if you would like a different board, delete the old one and generate another.

The settings page also hosts our contact form, which is how you reach us about bugs, questions, or anything else regarding the Site. How we collect and use information when you visit the Site or use your account is described separately in our "What we collect and track about you" section of these Terms; this section does not repeat that disclosure.

Accounts

To create an account you provide an email address and choose a password. We then send a verification link to that address, and your account becomes usable once you confirm it through the link — sign-in requires a verified email address so accounts cannot be created with mistyped addresses. You may have one account only (see the conduct rules below).

When you sign in, we keep you logged in across visits using a secure browser cookie until you sign out, which you can do at any time from within the app. If you forget your password, you can request a reset by entering your email address on the sign-in page; if the address matches an existing account, we will send you instructions for choosing a new password.

You can delete your own account at any time from the settings page. Deleting your account deletes the application data stored under it — your saved puzzles, play records and move logs, gameplay preferences, and contact messages sent through our form. What happens to other categories of information when an account ends is covered in the sections of these Terms dealing with your data rights and with suspension or termination of accounts.

Finally, this Service is not directed to children: you must be at least 13 years old to create an account or use the app features that require one. If you are unsure whether you may lawfully enter into these Terms (for example because of your age), do not sign up until a parent or guardian has reviewed them with you.

Conduct and Acceptable Use

In addition to everything else in these Terms, you agree to follow the rules below whenever you use the Site — including its public pages and, once signed in, your account area.

Your responsibilities for your account

You are responsible for keeping your email address current and for safeguarding your password and anything else needed to access your account. Never share your account, credentials, or an active sign-in session with anyone else, and keep in mind that we can only identify activity by which account it came from: you are therefore responsible for all activity under your account, whether or not you authorized it personally. If you believe someone has accessed your account without permission, contact us promptly through the contact form on the settings page so we can help secure it. Remember also that one person may hold at most one account; registering additional accounts is a breach of these rules (see below).

Prohibited uses

You must not do any of the following while using the Site:

• Create more than one account for yourself, or attempt to register an account with an email address that does not belong to you.
• Share your account, password, verification details, or sign-in session with other people.
• Attempt to access another user's puzzles, plays, preferences, sessions, or any part of the Site — including its private admin area — without authorization, and do not probe, exploit, or test vulnerabilities in the Service unless we have given you express permission to do so.
• Scrape, bulk-download, or use automated tools (bots, crawlers, scrapers) to extract puzzle boards or other content from the Service at scale.
• Send spam, abusive, threatening, misleading, or otherwise inappropriate messages through our contact form, or otherwise use it to harass us or anyone else.
• Reverse engineer, decompile, resell, sublicense, or commercially exploit any part of the Service — including generated puzzles as a product or data feed — without our prior written permission.
• Use the Service for anything that violates applicable law, or in a way that interferes with its normal operation or overloads it.

If your access is suspended or terminated

We may take action against breaches of these rules, up to and including suspending or terminating an account; how suspension and termination work, notice, and their effect on your saved data are set out in the section of these Terms dealing with suspension and termination of accounts, which you should read alongside this one. Whatever those mechanics say, your own duties when they apply are simple: if we suspend or terminate your access, stop using the affected part of the Site immediately, do not try to work around the restriction by any other means (including registering a new account after a termination), and accept that ending an account ends your ability to reach its saved puzzles, plays, and preferences as described there.

Rights reserved

We reserve all rights not expressly granted in these Terms. If we fail or delay in enforcing any provision here — including anything above — that is not a waiver of our right to enforce it later. And nothing in this conduct section limits or waives any right you have under applicable law, including statutory consumer protections and data protection rights such as those under GDPR or CCPA; where a rule here would conflict with a legal right that cannot be waived by contract, the law wins.

What we collect and track about you

This section tells you what information this site collects when you visit its public pages or use an account, why each item exists, how long we keep it, and what rights you have over it. The Site (sudoku.sixturkies.com) is operated by its sole owner-operator ("we", "us") — in data-protection terms the controller behind everything here is simply the site owner/operator of sudoku.sixturkies.com: one person running a personal project, not a company. You can reach us at contact@sudoku.sixturkies.com with any question about this section or to exercise the data rights described below; that single address serves both general inquiries and requests about your personal data.

Wherever these Terms say we store an IP address, we mean in truncated form only: we store your IP address only in truncated form, masking IPv4 addresses to their first three octets (/24) and IPv6 addresses to their first 48 bits before anything is written down on our side of things. We do this because full IP addresses identify you more precisely than analytics needs, while the shortened prefix still lets us see where traffic comes from at a network level and spot unusual sign-in activity. This covers everything we write into our own databases: usage-analytics rows and per-login security records alike.

Your account information

When you create an account we collect your email address (unique per account), your password stored only as a one-way cryptographic digest so that even a database leak would not expose it, and the dates your account was created and verified. We keep these because they are what authenticate you and prove an account belongs to you; email verification exists so accounts cannot be created with mistyped or disposable addresses. This is core functionality of the service we provide under our agreement with you. We keep this data until you delete your account through the settings page.

Sign-in and session data

To keep you logged in across visits without re-authenticating on every page load, we set a signed session_id cookie in your browser (kept private from web scripts and sent only over HTTPS). For each sign-in event we also record your IP address — stored only in truncated form as described above — together with your full browser user-agent string alongside that login. A short-lived browser-session cookie holds one more thing: which page to return you to after signing in; it contains nothing else and disappears when you close your browser. We keep this category because the session cookie is what keeps you signed in at all, and recording an IP prefix and device fingerprint per login lets us detect unusual or unauthorized sign-in activity on our own accounts as a security measure. This data is strictly necessary for authentication itself, so no separate consent is required under EU/UK privacy rules — but we disclose it here anyway because IP addresses are personal data. Session records live while your session is active and are deleted when you sign out or delete your account, whichever comes first.

Usage analytics (visit records)

This site runs its own first-party, server-side usage analytics using the open-source Ahoy library. No JavaScript tracking code is sent to your browser and nothing about your visits goes to any third party: every record below lives in this site's own database and is viewable only by the site operator through a private admin panel. We run these analytics on the basis of consent rather than as a default: before any analytics cookie is set we show an opt-in banner asking whether you want us to collect anonymous usage statistics, and the answer defaults to no. If you do not opt in, no analytics cookies are placed in your browser and no visit or event records described here or next are created for your browsing; the Site remains fully usable either way, so agreeing costs you nothing.

For each visit from someone who has opted in, we store:

• A random per-visit identifier token and a longer-lived random visitor identifier token — because they are how one "visit" or repeat visitor is counted across page loads without knowing who you are; they are opaque random values, not account identifiers (unless signed in — see below).
• Your IP address from the first request of the visit, stored only in truncated form as above — because it lets us see where traffic comes from at network level without being able to identify you precisely.
• Your full browser user-agent string, plus the browser name, operating system, and device type parsed from it — because we use these to see which browsers, devices, and operating systems visitors run so pages can be tested against what people actually use.
• The referring URL and its domain, your landing page path including any query string, and UTM campaign parameters when present in a link you arrived through — because we use them to tell how visitors find the Site (search engines, links, or direct entry) and where they land first.
• The visit start time — because that is what orders visits for analysis over time.
• A link to your account only while you are signed in — because it lets us see which pages an authenticated user uses; for anonymous visitors this field is empty.

We delete usage-analytics records after 90 days from the start of the visit (events fall away with their visit), at which point they are purged permanently rather than archived. These records are enabled by two first-party cookies set on your browser — ahoy_visit, which identifies one visit across its page loads, and ahoy_visitor, which counts unique visitors over time — whose durations appear in the cookie list below. Both are set only after you opt in through the banner described above.

Per-request page view events

For every request to any page made while analytics tracking applies to you (marketing pages included), we record one "Page view" event noting which controller/action handled it, the path, HTTP method, response status code, how long the request took, and — if an error occurred — the class name of that exception. Events are linked to the visit record above and, while you are signed in, directly to your account row. We keep these because they give us end-to-end tracing of a session: what order pages were loaded in, where requests slow down or fail, and overall error rates. They feed the operator's own dashboard; they are not shared with anyone else. Like the visit records, they exist only for visitors who opted in through the banner, and we delete them after 90 days along with their visits.

Your gameplay data (account holders only)

If you have an account, we store every puzzle board you generate (the grid plus its difficulty), each play of a puzzle including a full move-by-move log and any per-play settings overrides, and your default gameplay preferences from the settings page. We keep this because it is the core product: puzzles are generated server-side and saved so that plays can be continued across visits and your preferred setup persists between sessions — what you signed up to do here exists solely inside your account area. We keep these records until you delete individual items through the app or delete your account.

Contact messages (account holders only)

Messages sent through the contact form on the settings page record the name, email address, and message body you provide; each one is also delivered directly to us by email, which is how support requests actually reach a person. We keep them because this is your channel for reaching us about the site, bugs, or anything else — without storing the message there would be no way to respond to follow-ups. The database copy of each message is kept 180 days after it was created, or earlier if you delete your account; since every message has already been emailed onward at send time, what we retain is a correspondence record rather than the system of record.

Server access logs (all visitors)

Independently of everything above, standard server request logging records each HTTP request's client IP address and user-agent string in host-level log files on the machine running the Site. This happens at the web-server/hosting layer rather than in application code, which makes it the one place on the Site where a full, untruncated address appears — briefly, and never copied into our own databases — but it is still us processing your data. We keep these because they are how a deployment gets debugged when something breaks, how abusive traffic or attacks are detected, and how uptime problems are investigated — an operational necessity for keeping the service available. Host log rotation keeps them no longer than 30 days.

Cookies used by this site

• session_id (signed): until you sign out. Keeps you logged in. Strictly necessary for authentication, so we set it without asking for consent.
• Rails session cookie (return_to_after_authenticating): browser-session only, gone when you close the browser. Remembers where to send you after signing in. Strictly necessary auth plumbing, so we set it without asking for consent.
• ahoy_visit (random visit token): 4 hours. Identifies one analytics "visit" across its page loads. Not strictly necessary — we ask for your opt-in consent through the banner before setting it and never set it unless you agree.
• ahoy_visitor (random visitor token): 2 years, the longest-lived identifier on this site, named here explicitly. Counts unique visitors over time. Same as above: opt-in consent required first.
• ahoy_track=false: until you delete it. Set only when you use our built-in opt-out; while present, all tracking described in the two analytics sections is skipped entirely.

What we do not track or do

The following statements are true about this Site today and will be kept accurate if features change:

• We do not sell or share your personal information with anyone. Analytics data never leaves our control — it lives in our own database behind an owner-only admin panel.
• There are no third-party trackers, ad pixels, cross-site scripts, or client-side JavaScript tracking code on any page; all analytics runs server-side inside the app's own stack. Known bot traffic is excluded from analytics records altogether.
• We perform no profiling and no automated decision-making based on your data.
• We store no precise geolocation; location fields exist in the schema but are disabled by configuration.
• The form-security tokens used to protect sign-up, sign-in, password, and settings forms against forgery contain nothing about you personally — they prevent other sites from submitting forms as you.

Your rights over your data

You have rights over the personal data we hold about you under applicable law: GDPR where you are in the EU/EEA (and UK equivalents for UK residents), and CCPA/CPRA for California residents. Below is what those rights mean concretely here and how to use them.

Access, correction, and erasure/deletion of personal data

You have the right to access the personal data we hold about you, to correct it when it is wrong or incomplete, and to erase or delete it; depending on your jurisdiction this also includes the right to restrict our processing of it, to receive a portable copy of it, and to object to our processing of it. To exercise any of these rights, email us at contact@sudoku.sixturkies.com — the same address used for general inquiries — describing what you would like done, and we will respond within one month. You do not need to justify your request beyond identifying yourself well enough that we can find your records.

You can also act without contacting us: deleting your account from the settings page removes all application data stored under it — your saved puzzles, play records and move logs, gameplay preferences, sign-in session history, and contact messages sent through our form — as well as usage-analytics records linked to you while signed in. Browsing before you created an account is anonymous to us and falls away automatically within our 90-day analytics retention window described above. For California residents specifically, CCPA/CPRA gives you rights to know, delete, correct, and opt out of sale or sharing; because we do not sell or share personal information with anyone (see "What we do not track or do"), that last right has nothing to act on here but is stated for completeness.

If you are in the EU/EEA or UK and believe we have handled your data incorrectly, you also have the right to lodge a complaint with your local supervisory authority — the data-protection regulator for your region. That route is independent of contacting us first: you can use it directly without speaking to us at all.

Consent for analytics, opting out, and objecting

Our usage-analytics tracking works only with your consent, as described above: an opt-in banner asks before any ahoy_visit or ahoy_visitor cookie is set, the default is no, and the Site stays fully usable either way. You may withdraw that consent at any time, just as easily as you gave it, by using our always-visible "Opt out of analytics" control (available from the settings page and in the site footer). Using it sets a first-party ahoy_track=false cookie in your browser; while that cookie is present, all visit and event recording described in this section stops immediately — the effect is technical and takes place on every subsequent request, not merely a promise on paper. If you later change your mind, opting back in through the banner simply resumes tracking as before.

If you object to processing for another reason — for example, you believe we are keeping or using data beyond what these Terms describe — tell us at contact@sudoku.sixturkies.com and we will stop the affected processing; an objection must have immediate practical effect for us as well, so where our built-in opt-out covers it (analytics), use either route and the result is the same. You can also always delete any of these cookies directly from your browser's own cookie settings at any time; none of them is required for the Site to work.

Intellectual Property

We own everything that makes up this Site itself: the application code, the puzzle-generation logic behind your boards, the design and interface, the marketing copy on our public pages, the database structure, and the private admin area through which we operate it. All right, title, and interest in those things stays with us; nothing in these Terms transfers ownership of any part of the Site or its content to you.

What we do grant is a limited license: while you comply with these Terms, you may access and use the Service for personal, non-commercial purposes. That license is non-exclusive and non-transferable, and it ends when your access does — whether because you delete your account, we suspend or terminate it as described below, or you simply stop using the Site. No other rights are transferred by implication, estoppel, or otherwise; if anything here could be read as granting more than that license, this section controls.

Your own records stay yours. The gameplay data stored under your account — the puzzle boards generated there, each play of them including its move-by-move log and any per-play settings overrides, and your default preferences from the settings page — belongs to you, along with contact messages you send through our form. Using the app gives us only what we need to provide the Service: permission to store those records and show them back to you inside your own account area. We do not use your puzzles, plays, or messages for anything beyond providing the Service.

Usage analytics are a separate estate entirely. The visit and event records described in "What we collect and track about you" belong to and are controlled solely by us; they exist so we can understand how the Site is used, they live behind an admin panel that only we can reach, and no rights in them pass to anyone else — not even account holders whose sign-ins link some of those records back to their own accounts.

If you send us suggestions or feedback through the contact form on the settings page, you may do so freely. If we act on a suggestion, we owe nothing further: no obligation to credit it, pay for it, or keep it confidential unless we have agreed otherwise in writing beforehand.

Disclaimers and Limitation of Liability

The Service Is Provided As-Is

The Site and everything delivered through it are provided as-is and as-available. We make no warranty, express or implied, that the app will be uninterrupted, timely, secure, or error-free; that puzzle generation always produces a perfect board (the generator is built around each puzzle having exactly one solution, but no generator is infallible and we do not guarantee flawlessness); that results you get from using the Service will meet your needs or expectations; or that information on our public pages is complete or current beyond what those pages themselves say. To the maximum extent permitted by applicable law, we also exclude all implied warranties, including merchantability, fitness for a particular purpose, and non-infringement. You are responsible for any consequences that follow from how you use the Service to the extent the law allows us to place them with you.

Limits on Our Liability

To the maximum extent permitted by applicable law: neither we nor anyone else involved in building or operating this Site is liable for indirect, incidental, special, or consequential damages — lost profits, lost data, or similar harm — arising out of your access to or use of the Site. That includes loss of saved puzzles, plays, move logs, or preferences resulting from deleting an account or from our discontinuing all or part of the Service; those records exist only under your account and while the Service runs, so their disappearance when either ends is a known consequence rather than a breach. In total, our aggregate liability for anything connected with these Terms or the Service is limited to the amounts you have paid us in the twelve months before the event giving rise to the claim — which today means nothing at all, because using this Service costs nothing. These limits apply no matter what legal theory a claim is brought under, contract or otherwise.

What These Terms Do Not Limit

Nothing in these Terms takes away rights that cannot be taken away by contract. Statutory consumer protections keep full force wherever they apply; data-protection rights like those described in "Your rights over your data" are regulatory duties owed directly to you rather than terms of our agreement with you, and nothing here waives, conditions, or delays them. Where local law bars excluding liability for certain conduct — gross negligence, willful misconduct, intentional harm — we remain liable as required by law. And where the law grants remedies regardless of what any contract says between us, this section does not reach them either: a limitation clause only limits what it is actually allowed to limit.

Suspension and Termination of Accounts

Ending your own access

You can end things on your side at any time by deleting your account from the settings page; no reason is needed and there is no waiting period. What that deletes — all application data stored under the account plus usage-analytics records linked to you while signed in, with anonymous pre-signup browsing falling away within our 90-day analytics window — is set out in "Accounts" and "Your rights over your data", so we do not repeat it here beyond saying plainly: once an account ends, its saved puzzles, plays, move logs, preferences, and contact messages are gone for good.

Suspending or terminating an account

We may suspend or terminate accounts that breach these Terms — including the conduct rules above — or otherwise misuse the Service. Where practicable we will give notice before acting so there is a chance to respond or fix what went wrong; this is a free personal project, so proportionate responses come first. Immediate suspension or termination without prior notice is reserved for security threats, abuse that endangers the Site, other users, or their data, or other imminent harm where waiting would be worse than acting. If your access ends for cause, it does not transfer: registering a replacement account after such a termination is itself a breach (see "Conduct and Acceptable Use"), and we may refuse new registrations from anyone whose previous account was terminated for breach. A suspension pauses access only — nothing under the suspended account is deleted while it lasts; if it leads to termination, deletion follows as described in this section.

What survives

When an account ends, most of these Terms simply stop having anything left to act on between us. The sections dealing with intellectual property, disclaimers and limitation of liability, and governing law and dispute resolution continue to apply afterwards, along with our ongoing legal duties regarding any personal data about you that we still hold at that point — those duties come from applicable law rather than from this agreement, so they do not end when your access does.

Governing Law and Dispute Resolution

These Terms are governed by the laws of [State or country where the operator is based], without regard to conflict-of-law principles that would point anywhere else. Any claim arising out of or relating to these Terms or your use of the Site belongs exclusively in the courts located there, and both sides submit to their jurisdiction for such claims; if a claim qualifies for small-claims court within that venue, it may be brought there instead. Nothing in this section deprives you of protections available under laws that cannot be waived by contract where you live — including consumer-protection rules that override choice-of-law clauses like this one: where such a law applies to you, it prevails as far as it reaches.

Before anyone brings a formal claim we ask both sides to try good faith first: reach us at contact@sudoku.sixturkies.com (or through the contact form on the settings page) describing what went wrong, and give us a genuine chance to make it right. If negotiation does not resolve things, either side may take the matter to the courts named above; there is no mandatory arbitration step for claims against or involving this Site.

General provisions

If any provision of these Terms — including this governing-law clause itself — is held invalid or unenforceable by a court of competent jurisdiction, the rest continues in effect, and the offending piece should be read as narrowly reformed only so far as needed to reflect its original intent rather than struck out wholesale. These Terms, together with the sections they reference throughout, form the entire agreement between you and us regarding your use of the Site and supersede earlier statements or understandings on those subjects — except that nothing here displaces rights under applicable law that cannot be waived by contract.