Puzzly is operated by Erisa Dajcaj (erisa@giadalabs.com). For privacy questions or data deletion requests, email the address above. No VAT number is required or displayed — see Payments below.
Puzzly stores the data you create: puzzle questions, hashed answers (SHA-256 — we never see plain text), celebration content (photos, songs), and a final message. For signed-in users we store name, email address, and anonymous Firebase UID. Your puzzle history (titles, links) is also stored locally on your device via Capacitor Preferences.
Puzzle data, user profiles, and entitlements are stored in Google Firebase Firestore (Google Cloud, EU region). Google has signed Standard Contractual Clauses (SCCs) covering this processing. Data retained until you delete your account.
Payments are processed by Lemon Squeezy (https://www.lemonsqueezy.com), which acts as the Merchant of Record for all purchases. Lemon Squeezy is responsible for collecting and remitting applicable taxes (including EU VAT) under its own registration. Lemon Squeezy processes your name, email, billing address, and payment details per their DPA at https://www.lemonsqueezy.com/dpa.
Lemon Squeezy uses Stripe as a payment-processing sub-processor for card data. Card details never reach Puzzly servers — they are handled entirely by Lemon Squeezy and Stripe. Stripe's processing is covered by the Lemon Squeezy DPA.
Puzzly uses a cookie consent banner. Essential cookies (Firebase authentication tokens, Lemon Squeezy checkout session) are always active and required for the app to function. Analytics cookies are only set if you explicitly accept them via the consent banner. You can change your cookie preferences at any time using the 'Manage preferences' link in the banner.
When you share a puzzle link, anyone with that link can access the puzzle. Links contain a random 12-character ID — not guessable, but not encrypted. Do not include sensitive personal information in your puzzles.
You can delete your account at any time via Account menu → Delete my account. Deletion is permanent and cascades: your user profile, all owned puzzles, and your Lemon Squeezy subscription are all removed. Firebase Auth identity is deleted. Lemon Squeezy retains billing records per their own policy (typically 7 years for tax purposes as Merchant of Record).
Data controller: Erisa Dajcaj · erisa@giadalabs.com. For Subject Access Requests, correction, or other GDPR rights, email the address above.
Last updated: June 2026