Account privacy notice

Who is responsible

Jon Bassett, trading as The Printed Secret, is the controller responsible for personal data used by this service. Contact support@theprintedsecret.com for privacy, account or support requests. This notice covers the website, free Apprentice play, optional accounts and account support.

What we receive

• Accounts: your email, account identifier, creation/sign-in information and confirmation of age 16+ and the current account terms. We do not ask for your date of birth. A password is stored as a hash, not a readable password.
• Google sign-in: a verified email and Google account identifier. We request OpenID identity and email, without access to Gmail, Drive or contacts.
• Games: your saved place, completion, puzzle interactions, hints, replies, timing and any team/player names you enter. You can use nicknames. App timings do not prove continuous playing time.
• Security and support: sessions, verification/reset requests, network/request information used to secure the service, and messages you send to support.

Website and game statistics

Optional website statistics are off until you choose Allow statistics. We record public page visits and selected link clicks, recognised referral sites, device category and approximate country. We derive a daily visitor estimate using a keyed hash of network address and browser information; raw addresses, full browser strings and full referral URLs are not stored in these statistics. They are not linked to your account, game answers or access codes. You can change your choice through the website footer.

Separately, successful game actions produce operational records of game starts, completion and recent activity. Signed-in records can be associated with your account for the private owner desk; guest records use an opaque run reference, not a public identity. Five-minute activity does not prove continuous playing time. Owner and tester activity are labelled separately. Statistics are kept for up to 90 days and purged hourly while the service is running, and before further collection/reporting. Backup copies follow the existing backup rotation and may retain earlier records; saved games have their own retention explained below.

Private workshop preparation

If you choose My workshop, we store business profile details, approximate town-centre coordinates, delivery areas, draft printing prices and any submitted logo against your signed-in account. These are private preparation records visible to you and the site administrator, not an application approval or public listing. Use business details, not a home address. They are included in account backups under the same backup rotation; removing the private workshop does not delete your player account. Contact support@theprintedsecret.com for account-data requests. Public listing, commercial rights and payment acceptance require separate approval and are not enabled by saving a draft.

Why we use it

Our lawful basis for account details, sign-in and saved games is performance of the optional account-service contract you request. Required account details are needed to provide and secure that account; without them you can still play as a guest.

Our legitimate interests are protecting the service, preventing abuse, investigating faults and answering support requests. We limit those uses to what those purposes need. Registration does not subscribe you to marketing.

Cookies and your device

Essential cookies keep you signed in and protect the Google sign-in flow. Guest saves and preferences stay in browser storage on your device. Clearing it can remove a guest save. Signing out does not automatically erase a guest save on a shared device. Account saves are held on the server so you can return on another device.

Services and international processing

The main application and backups are self-hosted in the United Kingdom. Website requests pass through Cloudflare for connection and security. Resend receives your recipient address and message contents to send verification/password-reset emails. Google handles optional sign-in under its privacy policy. Support messages are forwarded to Gmail, so Google also handles those messages.

These providers and their subprocessors may process data outside the UK, including in the United States. Cloudflare and Resend publish data processing terms incorporating standard contractual clauses and the UK Addendum for relevant international transfers. Google describes adequacy arrangements, including the UK Extension to the EU–US Data Privacy Framework, and contractual safeguards. Ask support@theprintedsecret.com for information or a copy of the applicable safeguards.

Provider information: Cloudflare data processing terms; Resend data processing terms and subprocessors; Google privacy policy and transfer safeguards.

How long records stay

Account details, saves and completion records stay while you keep your account, to return you to your place and recognise completed games. Ask support to close the account and delete associated data. Support/security records are kept according to whether they remain needed to resolve a request, protect the service or meet a legal obligation.

Tokens and sessions stop working at expiry; expired records are purged on subsequent relevant operations. Backup copies may retain removed records until backup rotation replaces them. Deletion is a support process, not an instant button. We will explain any records we must retain and why; we do not promise permanent saves or an immediate purge of every backup.

Your rights and account removal

Ask support@theprintedsecret.com for access, correction, deletion, restriction or a portable copy of your data, where the relevant right applies. You can also ask to close your account. We may need to verify ownership.

You have the right to object to processing based on our legitimate interests. Tell us which processing you object to and we will consider your request.

Contact us with concerns. You can also complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.

Age and changes

Accounts are for people aged 16 or over under our launch eligibility policy. Contact support if an under-16 account is brought to your attention, so we can review and remove it as appropriate. Material notice changes will be explained on the website. The date above identifies this version.