Privacy at tuesday.ca

Scope and accountability

This policy applies to tuesday.ca and its related APIs. The site is operated from Alberta, Canada by the tuesday.ca operator, a slepp project. The operator is accountable for personal information handled by the site and aims to follow Canadian and Alberta privacy principles, including Alberta's Personal Information Protection Act (PIPA) and, where applicable, the Personal Information Protection and Electronic Documents Act (PIPEDA).

For privacy requests, contact the operator through slepp.ca. Please include enough detail to identify the account, device, or puzzle activity involved.

Information we collect

Puzzle play and stats

• Puzzle ID, date, type, difficulty, attempts, hints used, solve status, start time, solve time, submission time, and sync source.
• A device identifier generated and stored by the site so anonymous solves and later account sync can work across connection failures.
• A hashed IP address and anti-abuse verification status for live solve submissions.
• Ratings or reviews you submit for puzzles, including optional comments.

Account and authentication

• If you create an account, we store a user ID, display name, account creation time, last login time, and optional email address.
• If you use passkeys, we store public credential information such as credential ID, public key, counter, transports, and last-used time. We do not receive or store your private passkey.
• If you link devices or merge accounts, we store short-lived link request metadata and a minimal merge record so the operation can be completed safely and audited.
• If you opt in to email digests, we store that preference. Email is opt-in only.

Device, browser, and local storage

• The site stores progress, streaks, receipts, draft work for some puzzles, and sync status in your browser localStorage.
• The site uses an HTTP-only session cookie for signed-in accounts. Session records are stored with a 30-day rolling expiry.
• Normal server and security logs may include request metadata such as IP address, user agent, time, URL, and error details.

How we use information

• To run the game: save progress, verify solves, calculate streaks, recover local solves, and sync solves to an account if you sign in.
• To show aggregate puzzle stats and improve puzzle quality without exposing individual players publicly.
• To operate accounts, passkey sign-in, device linking, sessions, optional email settings, and support/admin tools.
• To prevent abuse, debug failures, protect the service, and keep public stats coherent.
• To respond to privacy, support, or security requests.

tuesday.ca does not sell personal information, does not run advertising profiles, and does not use third-party behavioural analytics.

Lawful bases for international visitors

Where laws such as the GDPR apply, tuesday.ca relies on these lawful bases:

• Performance of a contract or requested service for accounts, passkey sign-in, puzzle progress, streaks, exports, and account deletion.
• Legitimate interests for security, anti-abuse checks, service reliability, aggregate puzzle statistics, and debugging.
• Consent for optional email reminders or digests. You can withdraw that consent in account settings.
• Legal obligation where information must be handled to comply with applicable law or valid legal process.

Disclosure and service providers

Public pages may show aggregated puzzle statistics, but not individual solve histories. Reviews and comments are visible to authorized editor/admin tools and may be used to improve the puzzle bank.

The site relies on service providers to host and secure the service. Cloudflare provides hosting, Workers, D1 database, KV/session storage, Images, caching, and Turnstile anti-abuse checks. If you opt in to email, the email delivery provider processes your email address to send those messages. Site fonts are self-hosted by tuesday.ca and are not loaded from Google Fonts at runtime. Providers may process technical data outside your province or outside Canada under their own legal obligations and transfer safeguards.

Information may also be disclosed if required by law, to protect the site or users, or as part of a transfer of the service, provided the recipient continues to protect the information appropriately. tuesday.ca does not sell personal information and does not share it for cross-context behavioural advertising as those terms are used in California privacy law.

Consent and choices

• By using the site, you consent to the collection and use needed to provide the daily puzzle service.
• You can play without an account. Anonymous play still uses localStorage and a device identifier for progress and stats.
• You can export account-linked data or delete your account from the account settings page.
• You can clear browser localStorage to remove local progress from that device, but this does not delete server-side records already submitted.
• You can sign out to clear the session cookie, and you can opt out of optional email digests in account settings.
• You can ask to access, correct, export, or delete account-linked personal information by contacting the operator.

Retention

Local progress remains in your browser until you clear it or the browser removes it. Session records use a rolling 30-day expiry. Temporary passkey challenges, account-link codes, account-link requests, and rate-limit records are short-lived. IP hashes on solve submissions are scrubbed after 90 days. Anonymous local-sync identifiers are anonymized after 730 days.

Puzzle progress, account records, passkey public credentials, device links, and reviews are retained while needed to provide accounts, stats, sync, abuse prevention, and puzzle-quality history. If you delete your account, account credentials, email settings, device links, and session access are removed; account-linked puzzle activity and ratings are anonymized where needed to preserve aggregate puzzle statistics; review comments are removed.

Security

tuesday.ca uses HTTPS, HTTP-only session cookies, signed puzzle tokens, passkey public-key authentication, hashed IP storage for solve submissions, rate limits, and anti-abuse checks. No online service can guarantee absolute security, but the site is designed to collect only what it needs and to avoid exposing individual play data publicly.

Your Canadian privacy rights

Subject to reasonable identity verification and legal limits, you can ask to access your personal information, correct inaccurate information, withdraw optional consent, export or delete account-linked information, object to certain processing, or ask how your information has been used or disclosed. The account page provides self-serve export and deletion tools for signed-in users.

If you are not satisfied with the response, you may contact the Office of the Information and Privacy Commissioner of Alberta, the Office of the Privacy Commissioner of Canada, or another applicable privacy authority.

Children

tuesday.ca is a general-audience puzzle site and is not directed at children. If you believe a child has provided personal information without appropriate consent, contact the operator so it can be reviewed and deleted where appropriate.

Changes to this policy

This policy may be updated as the site changes. The updated date above will change when material updates are made. Continued use of the site after an update means the updated policy applies.