Privacy Policy

Effective: April 25, 2026 — Last updated: October 11, 2026

This Privacy Policy explains what data VariantDoku ("the App", "we", "us", "our") collects, how it is used, and the choices you have. By using VariantDoku you agree to the practices described here.

1. Data we do not collect

This section describes the App. For this website, see Section 5.

• We do not ask you to create a VariantDoku account or provide a name, email address, or phone number.
• We do not use third-party analytics or advertising SDKs in the App.
• The App does not track you across other apps or websites.
• We do not access your contacts, photos, microphone, camera, or location.

2. Data we do collect

2.1 Anonymous puzzle activity

The App loads puzzle catalog data from our backend. When you browse, search, filter, open, save, resume, or complete puzzles, the App may send anonymous puzzle activity to our backend, such as puzzle identifiers, search text, filter selections, completed puzzle IDs, in-progress puzzle IDs, and saved puzzle IDs. We use this data to return puzzle lists, personalize ranking, and increment aggregate solved counters. Ranking inputs are processed to generate the response and are not stored as a user profile. We do not include an account, name, email address, Apple ID, advertising identifier, or app-specific device identifier in these requests.

2.2 Device and app integrity

The App uses Apple App Attest on iOS and Google Play Integrity on Android to help verify that protected API requests come from a genuine, unmodified copy of the App. This involves exchanging cryptographic or integrity information between your device, Apple or Google, and our backend. Our backend receives an integrity result and related request/app metadata; it does not receive your Apple ID, Google password, payment information, or advertising identifier through these checks. Apple and Google process integrity data under their own privacy policies.

2.3 Subscription state

Your subscription and purchase status is managed by the store where you obtained the App: Apple's In-App Purchase system on iOS or Google Play Billing on Android. The App reads store-provided purchase and entitlement information to determine whether Variant+ or Lifetime features should be available. We do not receive your full payment-card details. Apple and Google process account, payment, purchase-token, and billing information under their own privacy policies.

On Android, the App additionally sends the Google Play purchase token and the product identifier to our backend so that we can confirm the purchase directly with Google and acknowledge it. Acknowledgement is required by Google Play; a purchase that is not acknowledged is automatically refunded. The token is used only for that check, is not stored on our servers, and is not combined with your puzzle activity. On iOS this verification is handled entirely by Apple and no purchase information is sent to our backend.

2.4 App data, cloud progress, and backups

The App stores the following information on your device:

• Saved puzzle progress (cells, pencil marks, undo history, elapsed time)
• App settings (highlight peers, double-tap behavior, theme preferences)
• Daily-limit counters (for free-tier users)
• Streak data (current streak, longest streak, last solved date)
• Privately imported puzzles (the puzzle link you paste and the decoded puzzle). Imported puzzles are saved only on your device and are never added to our puzzle catalog, search, feed, or recommendations.

On Android, when Google Play Games authentication is available, the App uses Play Games Saved Games to synchronize progress for catalog puzzles, streak and usage counters, and onboarding state across your devices. In-progress board state may be included. The App also submits eligible daily-puzzle completion times to Play Games leaderboards. Google associates this information with your Play Games account under Google's Privacy Policy.

Daily leaderboard achievements. If you are signed in to Game Center or Play Games and a clean daily result appears on its public leaderboard, the App sends the puzzle ID, the time shown on that leaderboard, the platform, and a SHA-256 digest of your platform player ID to our backend. The same digest is used to retrieve your past wins across your devices. The App uses a fixed, public app-specific prefix when making the digest. Our backend does not receive your raw Game Center or Play Games player ID, display name, or avatar. The digest is a persistent pseudonymous identifier, not anonymous data, and is used only to provide these achievements. Signed-out players do not send leaderboard achievement requests. The fastest times of each daily puzzle may be shown on this website and in our daily puzzle posts as times only, without any name or identifier.

We retain individual daily times for up to 120 days. After each day ends, we retain the winning day, board size, platform, and player digest for as long as the leaderboard achievement service operates so that past wins can be restored on a new device. These records are not used for advertising or combined with activity from other apps or websites. For users subject to GDPR, our legal basis is our legitimate interest in providing and preserving this competitive achievement feature. To object to this processing or request deletion of existing records, email support@variantdoku.com with your platform and, if available, the dates, board sizes, and solve times of a few daily leaderboard results. We may ask for more detail to identify the matching record. Once identified, we delete its times and wins and retain only the digest needed to prevent future reporting after your objection.

Privately imported puzzles are excluded from Play Games sync and from Android automatic backup and device transfer. Selected app preferences may be included in Android's platform backup. Purchase entitlement caches are excluded and are re-established with the store.

Deleting the App clears on-device data, but synchronized Play Games data or platform backups may remain until you remove them using the controls provided by Google or your device platform.

2.5 Importing puzzle links

The App lets you privately import a puzzle into your own Library by pasting a link (for example, a SudokuPad, f-puzzles, or classic Sudoku link).

• Clipboard. When you tap "Paste Link", the App reads the current contents of your device clipboard so it can use the link you copied. The App only reads the clipboard in direct response to that action; it does not monitor your clipboard in the background.
• Resolving short links. Most links contain the puzzle data inside the link itself, and the App decodes them entirely on your device without contacting our servers. Some links (such as SudokuPad short links) do not contain the puzzle and must be looked up. In that case the App sends the link to our backend, which fetches the corresponding puzzle data from the relevant third-party puzzle host (for example, sudokupad.app). The link is therefore shared with our backend and with that third-party host, and the third party's handling of the request is subject to its own privacy practices.
• Retention. We do not store imported links or imported puzzles on our servers; the backend only relays the request to retrieve the puzzle. Standard, short-lived request metadata may be logged as described in Section 4. The decoded puzzle is stored only on your device, as described in Section 2.4.

2.6 Crash and performance diagnostics

To find and fix defects, the App reports technical diagnostics to our backend when it crashes, stops responding, is terminated abnormally by the operating system, or starts unusually slowly.

• How it is collected. We use the diagnostic facilities built into the operating system — MetricKit on iOS, and ApplicationExitInfo together with an in-app error handler on Android. No third-party analytics or crash-reporting SDK is involved, and the reports are sent to our own backend rather than to a third-party service.
• What a report contains. The App version and build, operating-system version, device model, the type of failure and why the process ended, a technical stack trace of the code that was running, the name of the thread involved, and memory usage at the time. Reports do not contain an account, name, email address, Apple ID, Google account, advertising identifier, or app-specific device identifier, and are not linked to your puzzle activity or to each other.
• When it is sent. A report is written to your device at the time of the failure and uploaded the next time the App runs successfully. If the upload fails it is retried later, and reports are discarded if they cannot be delivered.
• Retention. Diagnostic reports are kept for up to 90 days and then deleted automatically. They are used only to diagnose and fix defects, never for advertising or profiling.
• Platform-provided reports. Separately, Apple and Google provide developers with crash and performance reports gathered by the platform itself, for users who have chosen to share such data with them. We access these through Apple's and Google's developer tools, and their collection is governed by Apple's Privacy Policy and Google's Privacy Policy rather than this one.

2.7 Ad attribution for app installs

If you install VariantDoku on iOS after seeing one of our ads, Apple's SKAdNetwork may send the advertising network an aggregated, anonymous report that an install took place, together with a coarse value indicating how far you progressed in the App.

• Who sends it. Apple operates this attribution. The App sends nothing to the advertising network itself, and contains no advertising SDK, as stated in Section 1.
• What it contains. The report carries no account, name, email address, Apple ID, Google account, advertising identifier, or app-specific device identifier. It cannot be linked back to you, to your puzzle activity, or to other reports.
• Why there is no tracking prompt. Because this attribution is aggregated and operated by the platform rather than by us, the App does not ask for permission to track you, and does not track you across other apps or websites.

3. Platform providers

VariantDoku is distributed through the Apple App Store and Google Play. Apple and Google may collect information related to your store account, device, downloads, integrity checks, purchases, subscriptions, and platform gaming services in accordance with Apple's Privacy Policy and Google's Privacy Policy. Their processing is separate from the anonymous activity and server logs described in this policy.

4. Infrastructure and server logs

Our website and API are served through infrastructure providers, including Cloudflare. These providers may process standard network and security metadata such as IP address, timestamps, request paths, HTTP status codes, user agent, and related connection information to deliver the service, protect it from abuse, and keep it available.

Our backend server also logs standard request metadata (timestamp, request path, query string, HTTP status, user agent, and IP address) for operational and security purposes. Puzzle IDs, search/filter terms, and the pseudonymous daily leaderboard identifier may appear in request paths or query strings. Logs are retained for up to 30 days and are not used for advertising or profiling. Crash and performance diagnostics are stored separately and kept for up to 90 days, as described in Section 2.6.

The backend database stores the puzzle catalog, aggregate puzzle solve counts, and the daily leaderboard records described in Section 2.4. Database backups may be stored with infrastructure providers for disaster recovery. The App does not create VariantDoku accounts.

5. This website

This website (variantdoku.com) does not use advertising or analytics cookies and loads no third-party advertising or analytics scripts.

The App itself contains no third-party analytics or advertising SDKs either, as stated in Section 1, and nothing on this website is linked to your activity in the App.

5.1 Playing the daily puzzles on this website

You can play today's daily puzzles at variantdoku.com/daily without the App. Your browser keeps your progress and a random player identifier in its local storage on your device; no cookies are set for this.

When you start a puzzle, the page opens a session with our backend so that your time can be verified and placed on the daily leaderboard. For that session we receive and store: a SHA-256 digest of the random identifier (never the identifier itself), which puzzle you are playing, when the session started and finished, the digits you submit when you finish, the solve time your browser counted (it pauses while the page isn't the one you're using or a popup such as the rules is open), and the list of your digit placements with their timings. If you use Check, the session is marked as checked and the puzzle's solution is sent to your browser so that Check can run on the page. We use this only to check and rank the solve. Sessions are deleted after three days. A ranked time is kept on the daily leaderboard as a number of seconds linked only to that digest, for up to 120 days; the website shows the fastest times without any name or identifier.

To keep automated scripts off the leaderboard, the page uses Cloudflare Turnstile. Turnstile runs in your browser and processes technical information such as your IP address and browser characteristics; our backend sends the resulting token and your IP address to Cloudflare to verify it. Cloudflare processes this data under the Cloudflare Privacy Policy. Our backend also uses your IP address, in memory only, to limit how often sessions can be started.

The identifier is random and is not linked to any account, App installation, or advertising identifier. Clearing this website's data in your browser deletes it, after which we cannot connect the stored records to you.

6. Children

VariantDoku is suitable for users of all ages and does not knowingly collect personal data from anyone, including children under the age of 13. If you believe a child has provided personal data through the App, please contact us so we can address it.

7. Your rights

The App does not create VariantDoku accounts. Daily leaderboard achievements use the pseudonymous identifier described in Section 2.4; other puzzle activity is generally not linked to it. Some operational logs may contain IP addresses or similar request metadata for a limited time. If you reside in the European Economic Area (GDPR) or California (CCPA/CPRA) and believe that we hold data about you, you may contact us at support@variantdoku.com and we will work in good faith to respond.

8. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent changes. Continued use of the App after a change indicates acceptance of the updated policy.

9. Contact

Questions about privacy: support@variantdoku.com