Privacy notice

Effective 2 June 2026 · Covers getpuzzled.app only. The Puzzled mobile app has its own privacy notice, which will be published here when the app launches.

Who we are

Puzzled is built by Obsidium Labs Ltd, a small studio based in London. For anything relating to this notice or your data, write to contact@obsidiumlabs.uk. For everything else about Puzzled itself, hello@getpuzzled.app is the friendlier door.

What this notice covers

Everything that happens when you visit getpuzzled.app in a browser. It does not cover the Puzzled mobile app, which has its own data flows (accounts, catalogue, sessions, reviews) and will get its own notice here at launch. It does cover the email address you hand us if you use a sign-up form — see “When you sign up to a list” below.

What we collect on the website

The site has no accounts, no sign-in, and no comments. Just from visiting, the only data we collect is aggregate web analytics, configured in one of three modes depending on your choice. The one thing you can actively give us is your email address, and only if you submit a sign-up form — see “When you sign up to a list”.

Basic (the default)

Runs by default under the ICO's statistical-purposes interpretation of PECR — analytics used purely to understand how the site is being used, in aggregate. In this mode:

• We capture a small, fixed list of events: page views, button clicks (including which install CTAs people try), FAQ items opened, links followed, sections scrolled into view, theme toggles, use of the timer demo on the page, and whether a sign-up form was submitted (the outcome and which form — never the email you typed).
• No persistent identifier. The distinct id PostHog uses to attribute events lives in memory only — it resets on every page load. A short-lived window id sits in sessionStorage so events from a single tab are grouped together; it's cleared when the tab closes and never persists across tabs or browsing sessions.
• No profile of you is created in our analytics tool.
• No session replay, no recording of mouse movements, no scraping of inputs.
• No autocapture of arbitrary clicks — only the events listed above.
• No IP or geographic location appears in our analytics data; we strip these on the client before each event is sent (see "About IP and location" below for the honest scope of this).
• No advertising use. This data is never sold, shared with ad networks, or used to target you.

Optional (only if you opt in)

If you click Accept optional analytics on the banner, we additionally:

• Set a persistent identifier in your browser's localStorage and a matching cookie, so a returning visit counts as the same person rather than a new one. This lets us see how often the same visitor comes back.
• Capture general click and form events (PostHog's "autocapture") in addition to the hand-picked list above. This includes the sign-up forms — but never the email you type: PostHog masks input values, and our own sign-up event records only whether it succeeded (and which form), not your address.
• Count events against the random identifier. We do not build a profile of you in our analytics tool — we never call any "identify" function, so PostHog has nothing to bind these events to beyond the random id. No name, no email, no other personal data.

Objected

If you visit analytics settings and choose Object, no further analytics events are sent from your device. We still don't know who you are; we just stop counting.

You can switch between any of the three modes at any time at /analytics.

When you sign up

The site has two optional sign-up forms — the “notify me when it's ready” box and the mailing-list box. Both add you to the same list: our occasional newsletter. These are the only places the website asks for personal data, and only if you choose to submit one.

• What we collect: the email address you type, plus which of the two forms you used. Nothing else — no name, no marketing profile.
• Why: to send you the newsletter — occasional notes, including word when the app is ready. We don't use it for anything else.
• Where it's stored: with Resend, the email provider we use to hold sign-ups and send the emails. Resend acts as a data processor on our behalf, under its data processing agreement. Your address isn't sold, rented, or shared further.
• Lawful basis: your consent (UK GDPR Article 6(1)(a)), given when you submit the form. You can withdraw it at any time.
• How to leave: every email has a one-click unsubscribe link, or you can write to contact@obsidiumlabs.uk. We keep your address until you unsubscribe or ask us to delete it.

About IP and geographic location

We do not use, store, or query IP or geographic data in our web analytics, in any mode. The client strips these fields before each event is sent, and we tell our analytics provider not to perform server-side geo enrichment on the events we send from the website.

For full honesty: when your browser makes any request to our analytics provider, the request itself necessarily contains your IP address in flight (that's how the Internet works). Our analytics provider acts as a processor on our behalf and is contractually bound not to use that IP for any other purpose. We do not capture or display it.

Cookies and storage

A complete inventory of every piece of client-side storage this site uses — what it's for, when it's set, and how long it lives — lives on the cookies page.

Lawful bases

• Basic analytics: the statistical-purposes interpretation of regulation 6 of the Privacy and Electronic Communications Regulations (PECR), supported by our legitimate interest in understanding aggregate site usage. You can object at any time at /analytics.
• Optional analytics: your explicit consent under PECR and Article 6(1)(a) of the UK GDPR. You can withdraw consent at any time at /analytics.
• Mailing-list sign-up: your explicit consent under Article 6(1)(a) of the UK GDPR, given when you submit either sign-up form. Withdraw it any time via the unsubscribe link in any email.
• Strictly necessary storage (your theme preference, your analytics choice, the timer demo's state): regulation 6(4)(b) of PECR — strictly necessary to provide the service you asked for.

Who else sees the requests

For analytics we use one provider, PostHog, hosted in the European Union (Frankfurt). PostHog acts as a data processor under their data processing agreement.

The site also loads an icon font from unpkg.com, a public CDN run by Cloudflare. unpkg sees your IP address and the request for the icon file as part of normal CDN operation — that's not analytics, but it is a third-party connection made on every visit. unpkg sets no cookies on our behalf, and we don't send any identifying information to it. The cookies page has the same disclosure.

If you use a sign-up form, your email address is processed by Resend, our email provider, acting as a data processor on our behalf. It's used only to send the list you signed up for.

Other than the processors named above, we do not share your data with anyone else, and we do not sell, rent, or trade it.

Retention

Web analytics events are retained by our analytics provider for as long as our PostHog project's data-retention setting allows. We do not query or export individual events; we only look at aggregate dashboards. If you object via /analytics, no further events are sent.

Your rights

Under the UK GDPR you have the right to:

• Access any personal data we hold about you.
• Ask us to correct inaccurate data.
• Ask us to delete your data.
• Restrict or object to processing.
• Receive a copy of your data in a portable format.
• Withdraw any consent you previously gave.
• Complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've handled your data badly.

If you've signed up, the personal data we hold is your email address (and which form you used) — write to contact@obsidiumlabs.uk to access or delete it, or use the unsubscribe link in any email. Otherwise, because the site has no sign-in and we don't capture identifiers we can tie to a person, there's rarely anything else we hold. Use analytics settings to stop further analytics collection from your device.

Children

The website isn't directed at children, and we don't knowingly collect data from children under 13. The Puzzled mobile app will have its own age-appropriateness statement in its own notice at launch.

Changes to this notice

When we change anything material here — adding the mobile-app coverage, adding a new analytics tool, anything that changes what's collected — we'll update the "Effective" date at the top and post a note on the site. Substantive changes that affect existing visitors will be flagged on the banner.

Contact

For privacy questions: contact@obsidiumlabs.uk.
For everything else: hello@getpuzzled.app.
Obsidium Labs Ltd, London, United Kingdom.