Privacy Policy
Data Controller
Puzzly is operated by Erisa Dajcaj (hello@giadalabs.com). For privacy questions or data deletion requests, email the address above.
What We Collect
Puzzly stores the data you create: puzzle questions, hashed answers (SHA-256, so we never see the plain text), celebration content (photos, songs, voice recordings) and a final message. If the person who receives a puzzle records a video reaction, the video is stored with that puzzle and its creator gets a link to watch it. Everyone who opens Puzzly gets an anonymous Firebase ID, which lets you report a puzzle, block its sender or send a reaction to its creator without an account. If you sign in, we also store your name and email address. If you sign in with Google or Apple, they give us your name and email. With Apple you can hide your email: we then receive a private relay address that forwards to you. In the app, your puzzle history (titles and links) is also kept on your device. If you turn on notifications in the app, we store your phone's notification token (from Firebase Cloud Messaging) with your Puzzly account ID and the app's language, so we can tell you when someone solves your puzzle or sends you a reaction. Signing out or deleting your account removes it. When something in the app goes wrong, it sends us the error message and whether you're on iOS, Android or the web. These reports don't include your name, email address or Puzzly account ID, and we use them only to fix problems.
Firebase (Google Cloud)
Puzzle data, user profiles, and entitlements are stored in Google Firebase Firestore (Google Cloud, EU region). Google has signed Standard Contractual Clauses (SCCs) covering this processing. Data retained until you delete your account.
Purchases
Puzzly Pro is sold inside the iOS and Android apps, through the App Store (Apple) and Google Play (Google). Apple and Google take the payment, handle taxes and refunds under their own terms, and keep your payment details. Puzzly never sees your card: we only receive the status of your subscription, so the app knows whether Pro is active. Nothing can be bought on the website. To keep track of subscriptions we use RevenueCat (RevenueCat, Inc., USA). It receives your Puzzly account ID and the purchase records from Apple or Google, never your card details.
Sign-in links and notifications, for example when someone reacts to your puzzle, go out through Resend (Resend, Inc., USA). Resend receives the recipient's email address and the message.
Children
Puzzly is not meant for anyone under 16, and we don't knowingly collect children's data. If you think a child has used Puzzly, email us and we will delete their data.
Cookies and Analytics
Puzzly doesn't use advertising or analytics cookies, so there is no cookie banner. We only store what the service needs to work: your Firebase session (anonymous, or signed in), your language choice and, in the app, your puzzle history. Details are in the Cookie Policy.
Shared Puzzle Links
When you share a puzzle link, anyone with that link can access the puzzle. Links contain a random 12-character ID — not guessable, but not encrypted. Do not include sensitive personal information in your puzzles.
Account Deletion and Right to Erasure
You can delete your account at any time in the app, from Account menu → Delete my account. If you no longer have the app, email hello@giadalabs.com from the address linked to your account and we will delete it for you. Deletion is permanent and removes your user profile, all the puzzles you own and your Firebase sign-in. If you signed in with Apple, we also revoke Puzzly's access to your Apple ID. If you subscribed in the app, cancel the subscription in your App Store or Google Play settings: deleting the account doesn't cancel it there.
Contact
Data controller: Erisa Dajcaj · hello@giadalabs.com. For Subject Access Requests, correction, or other GDPR rights, email the address above.
Last updated: November 2026