Privacy Policy

Your choices, first

• You can play without supplying a real name or email. Use a nickname that does not reveal private details.
• Confirming an email is used to protect and restore purchases. It does not currently synchronise your puzzle progress across devices.
• Manage sound, animation and table preferences in Settings. Browser settings control local site storage; clearing it can lose saves and personal pictures.
• Advertising is currently switched off. There are no optional advertising cookies to accept on these information pages. If ads launch, the game’s existing Settings → Privacy & ads control will provide the ad privacy choices and access to change or withdraw consent.
• For server-held data or a privacy request, contact support@fanzy.se. The public site does not currently offer the full cloud-account export/deletion interface.

Data Jiggiz handles

Play and your browser profile

We use a generated installation identifier and credentials to recognise a browser and protect its access to the service. These are pseudonymous identifiers, not a promise of complete anonymity. Server-held game data can include your nickname, selected country, results, puzzle and piece count, timing and hint/run-verification events, level, rewards, missions and owned content.

Public rankings show nicknames, country flags, times and positions. Your purchase email is not displayed in a ranking. The suggested country is based on browser language information, not precise GPS location; you can choose a different country.

Purchases and email verification

If you connect an email for purchases, we process that address, verification attempts and purchase/restoration records. The email is encrypted in the purchase-account database, with a separate keyed lookup value. Verification codes are stored as hashes rather than as readable codes.

We keep order references, products, price/currency/tax information, payment and refund status, access rights, confirmation/consent records and payment-processor references. Stripe collects card details in its hosted checkout; the game does not ask you to type your card details into a Jiggiz form.

Personal pictures and support

Pictures you import are decoded, cropped and stored in your browser. The current personal-picture feature does not automatically upload those files to our server. If you email support, we receive the information and attachments you choose to send. Do not send card details or verification codes.

Technical operation

Hosting and application systems process IP addresses, request times, requested URLs, browser/request information, errors and security events. Rate limiting and game-result checks help prevent abuse. A performance report can also be recorded through the game’s technical-help controls. We have not installed a separate third-party marketing analytics service in the ordinary game.

Cookies and other browser storage

Storage is not limited to cookies. The current game uses the following browser facilities to provide the functions you request:

IndexedDB

pieceful-identity-v1 holds browser identity credentials and a refresh token. pieceful-personal holds personal pictures and related local data.

localStorage

Puzzle saves and completion markers, save ownership, sound/table preferences, first-play guidance and local shop/progression state. Legacy keys may use the pieceful. name.

sessionStorage

Temporary checkout/account hand-off state, such as which product you were returning to. This storage belongs to the browser tab session.

Cache Storage

The service worker caches public game files and assets to speed repeat visits and support available offline use. Private API responses are excluded from that cache.

Access tokens are also held in memory. Older identity endpoints support a pieceful_player cookie; cookies used by a payment provider are governed by its checkout information. The current game does not require a third-party advertising cookie to play.

Browser storage can be removed using your browser’s site-data settings. This does not erase server records. Before clearing anything, make sure purchases are connected to an email you can access, and understand that local progress and imported pictures may not be recoverable.

Purposes and legal basis

We use data to provide the play, saving, purchase and restoration services you request, to keep results fair, to secure the service, to answer support requests and to meet legal obligations.

• Requested game, purchase and restoration services: performance of the service or purchase contract, where the processing is necessary to provide it, including steps you request before a purchase.
• Security, abuse prevention and fair rankings: our legitimate interests in protecting players, preventing fraudulent results and maintaining a reliable game. We use pseudonymous identifiers, limit detailed verification data and do not publish purchase emails. You can contact us to object or ask about a result.
• Support: performance of the relevant service contract for help with that service; our legitimate interest in responding to other enquiries where appropriate.
• Required accounting or legal records: compliance with the legal obligation applying to that record.
• Optional advertising storage and personalisation, if launched: consent where required. Continued play and purchases are not treated as advertising consent.

Browser-storage consent rules are separate from the GDPR legal basis. An exception for storage strictly needed for a requested function does not make unrelated analytics or advertising necessary.

How long data is kept

We apply the following retention standards. Longer retention of particular records may be necessary for an unresolved dispute, a legal hold or another applicable statutory obligation; those exceptions are limited to the records needed for that purpose.

Technical server and error logs

Normally up to 14 days. Some web-server logs rotate earlier.

Detailed game-verification data

Raw event payloads and board-state snapshots from ended game sessions are cleared after 90 days, through daily maintenance. Minimal result, event-identifier/hash and completion-receipt records remain separately where needed for rankings, progress and prevention of duplicate rewards. An active or saved puzzle is not erased by this cleanup.

Email verification

A code is valid for 10 minutes. Expired challenge records older than 1 day are removed at the next daily cleanup. Credential expiry is separate from deletion of associated account or purchase records.

Routine support correspondence

12 months after the case closes, unless a specific dispute or legal obligation requires the relevant material for longer.

Rolling operational backups

30 days. Backups are restricted and used for recovery, rather than ordinary access to old data. Legacy backups are phased out over the first 30-day adoption window. A fresh backup is verified before older copies are removed, and erasure decisions must be reapplied after recovery.

Inactive free profiles

Reviewed after 24 months without activity. Data that is no longer needed is then deleted or anonymised. This is a reviewed process, not an automatic cancellation of an account or its purchases.

Purchases and recovery email

Kept while needed to provide and restore your purchased access. Ordinary inactivity does not expire an item you own.

Accounting information

Normally 7 years after the end of the calendar year in which the financial year ended, with longer retention where another applicable tax or legal obligation requires it. This does not apply the same period to all gameplay data.

Local puzzle saves and personal pictures

Until you or your browser remove them, subject to browser storage limits. We cannot guarantee indefinite storage on a device.

Daily technical cleanup is performed in bounded batches. Inactive-profile and support reviews include checking for outstanding requests and specific retention needs. If you ask for erasure, we remove information that is no longer needed and explain any legal reason particular records must remain. Contact us for a request about server-held data; clearing your browser alone does not erase it.

Providers and international processing

We use Hostinger for hosting/infrastructure, Stripe for hosted payments, and Zoho/ZeptoMail for transactional verification and purchase-confirmation email. The email service used by this deployment is its European service. This does not establish that every provider or subprocessor only processes data in the EU.

Providers receive the data necessary for their role; for example, an email provider receives the destination address and message, and a payment provider receives checkout information. Some providers act under their own privacy obligations for parts of their service. See Hostinger’s privacy information, Stripe’s privacy information and Zoho’s privacy information.

Hostinger’s data-processing addendum and Stripe’s data-processing agreement form part of their standard service arrangements. Stripe acts as a processor for some services and as an independent controller for others. International processing is subject to the applicable provider arrangements and transfer safeguards; we do not promise that all processing is exclusively in the EU.

The account-specific data-processing agreement for the Zoho/ZeptoMail organisation still needs confirmation. The provider’s general privacy statement is not proof that this step has been completed for Fanzy.

Google AdSense and future advertising

The site has been submitted to Google AdSense. The publisher verification meta tag and ads.txt identify the publisher; they do not themselves display ads. Live game advertising is disabled while approval and consent configuration are incomplete.

If Google ads are enabled, Google and participating advertising providers may place or read cookies or similar identifiers and process IP addresses, device/browser information, ad interactions and consent choices to deliver, measure and, with the required permission, personalise ads. Personalisation may use information about visits to this and other sites. Read how Google uses information from partner sites and Google’s ad-personalisation controls.

The game already contains a gated bridge for Google’s certified consent-management platform and a change/revocation control. A published CMP message is still an external setup requirement. It will not be replaced by treating continued play as consent. Optional advertising technology must remain gated until the required choices are available and respected. Refusing optional advertising consent must not prevent ordinary play.

These information pages contain no advertising or analytics scripts. Use the in-game privacy choices, when available, for consent given in the game; Google’s own controls are an additional option, not a substitute for withdrawing site consent.

Your rights and questions

Subject to the conditions in applicable data-protection law, you may request access, correction, erasure, restriction or portability of your personal data, object to processing based on legitimate interests and withdraw a consent without affecting the lawfulness of earlier processing. These rights are not all unconditional. We may need to verify a request safely and explain any legal reason a record must be retained.

Send requests to support@fanzy.se. Include enough information to identify the relevant profile or order, but never send an access secret or verification code. You can also complain to your local supervisory authority; in Sweden this is IMY, the Swedish Authority for Privacy Protection.

Children

Jiggiz is primarily intended for adults and is not specifically directed at children. If you believe a child has provided personal data that needs our attention, contact us. The audience and required safeguards must be reassessed before introducing child-directed features or advertising.

We will update this policy when the service or its data handling changes. The date above identifies this review version. Material changes, including launching ads or cloud progress, require the disclosures and choices to be reviewed again.