Privacy Policy

How Knotwise Games handles the personal data we collect from players.

Last updated: June 15, 2026

This Privacy Policy describes how Knotwise Games ("Knotwise", "we", "us", "our") collects, uses, discloses, and protects personal data in connection with the Knotwise Games website, the daily puzzles, the archive, account features, and subscriptions (collectively, the "Services"). It applies to anyone who accesses or uses the Services ("you", "User", "data subject").

Summary

The substantive sections below are authoritative; this summary is provided for convenience only.

  • The personal data we collect is largely your email address (for sign-in) and information about which puzzles you played (for progress and aggregated analytics).
  • We show ads from Google AdSense to non-subscribers to help fund the free puzzles. We do not sell personal data and we do not deploy a Facebook Pixel or comparable cross-site profiling tool of our own.
  • Subscribers see no ads, and the ad code is not loaded on their visits.
  • Analytics is collected only after you opt in. Ad personalisation in the EEA, UK, and Switzerland is collected only after you consent through Google's prompt. Access to the current day's puzzle does not depend on either choice.
  • You may close your account and request deletion of associated personal data by contacting us at the address in Section 11.

1. Data controller and contact

Knotwise Games is the data controller for personal data processed in connection with the Services. The same legal entity is referred to throughout this Policy as "Knotwise", "we", or "us".

All privacy enquiries — including requests to exercise the rights described in Section 8 and complaints about how we handle personal data — should be directed to contact@knotwise.games.

2. Scope and children

This Policy applies to personal data we process about Users of the Services. It does not apply to personal data collected by third parties operating their own services, even when those services are linked to or integrated with our Services; the privacy practices of those third parties are governed by their own policies.

Knotwise does not knowingly collect personal data from anyone under 13 years of age, or from anyone below the higher minimum age of digital consent applicable in their jurisdiction (for example, 16 in much of the European Economic Area and the United Kingdom). If you become aware that a child has provided personal data to Knotwise, please contact us at the address in Section 11 and we will delete the relevant data.

3. Personal data we collect

Knotwise collects the following categories of personal data, depending on how you interact with the Services:

  • Account data. Your email address. Knotwise does not store passwords; authentication is performed via one-time email link or via a federated identity provider such as Google, in which case the provider supplies the identifier and the email associated with the login.
  • Payment data. For subscribers, Stripe processes payments on our behalf. We receive a payment token, the last four digits of the payment card, expiry date, and country — never the full card number or full security code.
  • Usage data. Information about your use of the Services, including which puzzles you play, when, and from which type of device. This includes IP address, browser and device type, pages visited, and timestamps. Whether usage data is stored in identifiable form depends on your cookie-consent choice; see the Cookies page.
  • Communications. If you email us or otherwise contact us, we retain the message and any related correspondence.

4. Purposes of processing

We process personal data for the following purposes:

  • to operate accounts and subscriptions, including authentication and access control;
  • to maintain your puzzle progress and allow it to follow you across sessions and devices;
  • to communicate with you about your account, billing, security, or material changes to the Services;
  • to send the newsletter, where you have opted in (you may unsubscribe at any time);
  • to measure and improve how the Services are used, on an aggregated basis;
  • to display advertising to non-subscribers, which helps fund the free puzzles;
  • to detect, prevent, and respond to fraud, abuse, or violations of our Terms of Use;
  • to comply with applicable legal and regulatory obligations.

Knotwise does not sell, rent, or trade personal data.

5. Recipients and service providers

Knotwise engages the following service providers ("processors") to operate the Services. Each processes personal data only under our instructions and on terms consistent with applicable data-protection law.

  • Stripe — payment processing.
  • Cloudflare — hosting, edge runtime, database (D1), and object storage (R2).
  • Resend — delivery of sign-in and account-related email.
  • Google — OAuth identity provider for users who sign in via Google.
  • Google Analytics 4 — analytics, only where you have accepted analytics cookies.
  • Google AdSense — advertising and ad serving for non-subscribers. Google may use cookies and similar identifiers to serve, cap, and (subject to your consent) personalise ads. In the EEA, UK, and Switzerland, Google's certified consent-management platform collects this consent. See Google's advertising policies and Ad Settings.

In addition, Knotwise may disclose personal data:

  • where required by applicable law, regulation, court order, or governmental request;
  • to establish, exercise, or defend legal claims, or to protect the rights, property, or safety of Knotwise, our Users, or others;
  • in connection with a merger, acquisition, reorganisation, or sale of assets, in which case the successor entity will be bound by commitments at least as protective as those in this Policy.

6. Data storage, international transfers, and retention

Account, subscription, and usage data are processed by Cloudflare in the form of D1 (a SQL database) and R2 (object storage). Cloudflare may replicate data across regions; some processing therefore occurs outside your country of residence. Where personal data is transferred from the United Kingdom or the European Economic Area to another jurisdiction, Knotwise relies on appropriate safeguards, including the European Commission's Standard Contractual Clauses and, where applicable, the UK Addendum to those clauses.

Knotwise retains personal data only for as long as necessary for the purposes set out in Section 4, subject to the following indicative periods:

  • account data — retained while the account is active, then deleted within a reasonable window following account closure;
  • subscription and payment records — retained for as long as required by applicable tax and accounting law (typically several years);
  • usage and analytics data — retained on a rolling window of approximately 14 months;
  • support and other email correspondence — retained for as long as necessary to resolve and reference the matter.

When personal data is no longer required for any of the purposes above, it is deleted or anonymised so that it can no longer be associated with an identified individual.

7. Security

Knotwise maintains appropriate technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, or destruction. These measures include encryption of data in transit (TLS) and at rest where supported, role-scoped access for personnel, and password-less authentication. No method of transmission or storage over the public internet is entirely secure, and we cannot guarantee absolute security. In the event of a personal-data breach affecting you, Knotwise will notify you and the competent supervisory authorities as required by applicable law.

8. Your rights

Depending on your jurisdiction, you may have the following rights with respect to your personal data:

  • to access the personal data we hold about you (Article 15 GDPR);
  • to rectify inaccurate or incomplete personal data (Article 16 GDPR);
  • to request erasure of your personal data, subject to legal limitations (Article 17 GDPR);
  • to restrict or object to certain processing activities (Articles 18 and 21 GDPR);
  • to receive your personal data in a portable format, where processing is based on consent or contract (Article 20 GDPR);
  • to withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing prior to withdrawal;
  • to lodge a complaint with your local data-protection supervisory authority.

To exercise any of the above rights, contact us at the address in Section 11. We may need to verify your identity before responding. Knotwise will respond within the time period required by applicable law (and in any event, no later than 30 days unless the request is complex).

You may also exercise the following directly, without contacting us:

  • click the unsubscribe link in any email we send to opt out of the newsletter;
  • reopen the cookie banner from the Cookies page to change your analytics-cookie choice;
  • close your account from your account settings to initiate deletion of associated personal data.

9. Legal bases for processing (UK/EU GDPR)

Where the UK GDPR or EU GDPR applies, Knotwise relies on the following lawful bases under Article 6:

  • Performance of a contract (Article 6(1)(b)) — operating your account, processing payments, and delivering the puzzles and features you have subscribed to.
  • Legitimate interests (Article 6(1)(f)) — securing the Services, detecting fraud and abuse, understanding aggregate usage, improving the product, and showing non-personalised advertising. Knotwise has assessed these interests and considers them not to override your rights and freedoms; you may object to processing based on legitimate interests as described in Section 8.
  • Consent (Article 6(1)(a)) — opt-in analytics cookies, personalised advertising (collected via Google's consent-management platform in the EEA, UK, and Switzerland), and the newsletter. Consent may be withdrawn at any time.
  • Legal obligation (Article 6(1)(c)) — record-keeping for tax, accounting, and other regulatory purposes.

10. Changes to this policy

Knotwise may update this Policy from time to time to reflect changes in our practices, the Services, or applicable law. The "Last updated" date above will reflect the most recent revision. Material changes — for example, the introduction of a new processor that handles personal data — will be communicated through the Services, by email, or by re-prompting cookie consent, as appropriate to the nature of the change.

11. Contact

Privacy enquiries, rights requests, and complaints relating to this Policy should be sent to:

contact@knotwise.games