Privacy

Who we are

PuzzleM8 (designm8.uk/puzzlem8) is run by BusinessM8 Limited. We are the data controller: we decide how the information described here is used, and we are responsible for it. To ask anything about it, contact: puzzler@designm8.uk.

What we keep

• Your account: username, name, email address and password (stored scrambled, so nobody can read it).
• The family check: your birth month and year, the date you gave consent, which version of the wording you agreed to and a scrambled code made from your internet address at the time. We keep this to show that an adult set up the children's profiles. We confirm it by sending a link to your email address.
• Children's profiles: a first name or nickname you choose, a picture, an age band (for example 7 to 11), a skill level and a made-up leaderboard name like "Swift Puffin 27". We never ask for a child's full name, date of birth, school, email or photo.
• How I like it: each profile's access settings. These are the text size, the reading tint, dark mode, quiet mode and dyslexia-friendly spacing. They are kept with the profile so they follow the child to any device. They are included when you download or delete your data.
• Game information: progress and stars, scores, which games were played, roughly how long for and which school topics they practised. This is what the progress reports and weekly email are built from.
• Favourites and notes: the games a profile stars, and notes typed in My stuff. They belong to that profile: they aren't in the progress reports or emails, and nobody outside your family can see them. Please remind children not to put personal details such as addresses in notes. They're included when you download or delete your data.
• Your parent PIN: stored scrambled, with a count of recent PIN attempts so that guessing it is blocked for a while.

If you play without signing in, nothing about you is sent to us: games save in your browser only. We do not collect location, contacts, photos or voice. There is no chat, no messaging and no advertising, and we do not use tracking or advertising cookies.

Why we keep it: our lawful basis

UK data protection law (the UK GDPR) says we must have a lawful basis for each kind of information we use. These are ours:

• Your account, children's profiles, game information, favourites and notes: contract. We need them to provide the service you signed up for: running the games, saving progress across devices and sending the progress reports and weekly email (which you can switch off).
• The family check: legitimate interests. Protecting children by making sure an adult sets up and manages their profiles.
• Keeping the site working and safe (for example the PIN lock, and stopping people flooding the leaderboards): legitimate interests.
• Showing a child on leaderboards, and letting a child share a score picture: consent. Both are off until you switch them on for that child, and you can switch them off again at any time.
• Cookies and browser storage: we only use the ones the site needs to work (see below), so we don't ask for cookie consent.

Children's profiles are private by default

• Hidden from leaderboards unless you switch it on. If you do, only the made-up name shows.
• Your own scores (the account holder's) appear on leaderboards under a made-up name too, such as "Brave Otter 42". Your username is never shown.
• No public profile and nothing a child can post. There is no share button unless you turn on “Allow sharing” for that child; a shared picture shows only the game and score, never a name.
• A child can't change their age band or skill level. They can change how PuzzleM8 looks and sounds for themselves, under How I like it. Switching away from a child profile needs your parent PIN (or your account password if you haven't set a PIN yet).

How we follow the Children's Code

The ICO's Age Appropriate Design Code (the Children's Code) sets standards for online services children are likely to use. This is how PuzzleM8 meets them:

• High privacy by default: leaderboards and sharing are off for every child until you switch them on.
• Keeping as little as we can: only a nickname, a picture, an age band and a skill level for each child. No full names, dates of birth, schools, emails or photos.
• No location: we don't collect where a child is.
• No sharing and no profiling for marketing: we don't sell children's information or share it with advertisers. The age band and skill level are only used to pick suitable levels.
• Telling children about parent controls: the children's version of this page tells them, in simple words, that you can see which games they played and how they got on.
• Clear information: this page comes in a version for parents and a version written for children, and both say the same things.
• Tools to use your rights: you can download or delete your family's information yourself on the family page.

Who can see it and where it is kept

You, and the people who run PuzzleM8. We don't sell it, share it with advertisers or use it to profile children for marketing.

The site is hosted by Krystal Hosting Ltd, a UK web hosting company (registered in England and Wales, number 07571790). Your information is stored on Krystal's servers. Krystal stores it for us and may not use it for anything else. Like any web host, its servers see your device's internet address when pages load.

How long we keep it

Detailed activity (what was played, when and for how long) is deleted automatically after 400 days (about 13 months). Game progress, favourites, notes, scores and profiles stay while your account is open. When you delete a profile or your family's data, it's removed straight away. If your whole site account is deleted, your family's PuzzleM8 data is deleted with it. Things saved in your browser stay there until you clear your browser's data. Some browsers, including Safari on iPhone, iPad and Mac, also clear them by themselves if you don't visit for a while, unless PuzzleM8 is on your Home Screen. Signing in keeps progress safe, because it's saved to your account too.

Your rights

You have the right to see the information we hold about you and your children, get a copy of it and have it corrected or deleted. You can also ask us to limit or stop using it. Children have these rights too, and can ask us themselves.

• On the family page you can download everything we hold. You can also change or delete a child's profile, or delete all your family's data.
• For anything else, use the contact above. We'll reply within one month.
• You can switch leaderboards, sharing and the weekly email off at any time.

Cookies and browser storage

We use a session cookie to keep you signed in, and an optional cookie (kept for 180 days) if you tick "Keep this device on this profile". Games save progress and settings in your browser's storage. Some browsers clear this storage after a while without a visit (Safari does, unless PuzzleM8 is on the Home Screen). When you're signed in, that progress is also saved to your account so it follows you to other devices. None of this is used for advertising or tracking.

If you install PuzzleM8 as an app, or visit often, your browser keeps a copy of the games you've played so they work without the internet. That copy holds the games only, never your account or notes.

YouTube videos and read aloud

Video lessons in BSL Sign Starter come from YouTube, which is run by Google. They use YouTube's privacy-enhanced mode (youtube-nocookie.com), and nothing loads from YouTube until you tap Play video. Once a video plays, YouTube may set its own cookies or store information in your browser, and Google's privacy policy applies to it. The "Open on YouTube instead" button takes you to YouTube's own website.

Read aloud uses the voices built into your device or browser. Some browsers use an online voice from the browser's maker to do this.

How to complain

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint.