Privacy Policy
Effective from 1 September 2026.
This notice explains what personal data Cluecade collects, why we collect it, who else sees it, how long we keep it, and what you can ask us to do with it. It is the notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and under Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
In DPDP Act language: you are the Data Principal and we are the Data Fiduciary.
1. Who is responsible for your data
Cluecade is operated by Arshad Aqeel Khan, an individual carrying on business as a sole proprietorship at Nara, Nagpur, Maharashtra 440014, India.
For any question about this policy or about your data, write to scalystic@gmail.com. We are not a Significant Data Fiduciary and are therefore not required to appoint a Data Protection Officer; the address above is the contact for all data-protection matters.
2. What we collect
| Category | What it actually is | When we get it |
|---|---|---|
| Account data | Email address, a bcrypt hash of your password (never the password itself), display name, handle, avatar URL, and — if you use Google Sign-In — your Google account identifier. | When you register or sign in. |
| Guest identity | A randomly generated player identifier held in a cookie, plus a salted one-way hash of your IP address. We do not store raw IP addresses. | On your first visit, before you register. |
| Gameplay data | Your runs, individual guesses, attempts and skips, scores, experience points, coins, level, which puzzles you have already seen, daily-challenge results, and leaderboard entries. | As you play. |
| Multiplayer data | Room membership, round results, and the text of chat messages you send in a room, along with the name shown next to them. | When you join or host a multiplayer room. |
| Technical data | Two-letter country code, timezone, and the time you were last active. Our hosting provider and our own server logs record request metadata, including IP address, for a short period. | Automatically, as you use the service. |
What we do not collect
- No payment data. Cluecade is free and we do not process card or bank details.
- No precise location. We derive an approximate country only; we never ask for or use device GPS.
- No microphone or camera access. The game plays audio; it never records any.
- No advertising or cross-site tracking. There are no ad networks, no analytics SDKs, and no third-party trackers on Cluecade. See the Cookie Policy for the complete list of what is set in your browser.
- No sensitive personal data as defined by the 2011 SPDI Rules — no financial information, health data, biometrics, or sexual-orientation data.
3. Why we use it, and on what basis
We process your data on the basis of your consent under Section 6 of the DPDP Act, given when you choose to play or register, and — for the narrower purposes noted below — on the basis of the legitimate uses permitted by Section 7.
| Purpose | Data used | Basis |
|---|---|---|
| Running the game | Guest identity, gameplay data | Consent — the purpose you gave the data for |
| Keeping you signed in | Account data, session cookie | Consent |
| Leaderboards, levels, and daily-challenge standings | Display name, scores, experience | Consent |
| Not repeating puzzles you have already seen | Puzzle history | Consent |
| Preventing abuse, cheating, and rate-limit evasion | Hashed IP address, gameplay patterns | Section 7 legitimate use — fair-play and security |
| Moderating chat and handling grievances | Chat messages, account data | Compliance with the IT Rules, 2021 |
| Scheduling the daily challenge in your day | Timezone, country code | Consent |
| Fixing faults and keeping the service secure | Server logs | Section 7 legitimate use |
We do not use your data to build advertising profiles, and we do not make automated decisions with legal consequences for you.
4. Google Sign-In
If you sign in with Google, we ask Google for three things — openid, email, and profile. That gives us your Google account identifier, your email address, your name, and your profile picture URL. Nothing else: not your contacts, not your Drive, not your calendar.
We never receive your Google password. We use this data only to create and sign you into your Cluecade account, and we do not transfer it to others except as described in section 5.
You can revoke Cluecade’s access at any time from your Google account’s security settings. Doing so stops you signing in that way but does not by itself delete your Cluecade account — email us if you want that too.
5. Who else sees your data
We do not sell your personal data, and we do not share it with advertisers or data brokers. We use a small number of service providers who process data on our instructions:
| Provider | What they do | What they see |
|---|---|---|
| Hosting and delivery | Serves the site and our APIs | Request metadata including IP address; server logs |
| Managed database | Stores accounts and gameplay records | Everything in section 2 that we store |
| Object storage / CDN | Stores and delivers audio and artwork | Request metadata for signed asset URLs; no account data |
| Optional sign-in | Only what is needed to authenticate you, at the moment you choose to sign in | |
| Realtime server | Carries multiplayer rounds and chat | Room membership, chat messages, display names |
We also query third-party music catalogues to build our puzzle library. That traffic goes out from our servers and carries no player data — those services do not learn who is playing or what anyone guessed.
We will disclose data beyond this where we are legally obliged to:
- in response to a lawful order from a court or a competent authority, including a request under Rule 3(1)(j) of the IT Rules, 2021, which we must answer within 72 hours;
- to establish, exercise, or defend a legal claim, or to investigate a serious breach of our Terms of Service;
- to a successor, if the service is transferred or incorporated — on notice to you, and subject to this policy.
6. What is visible to other players
Some information is public by design. Your display name or handle, your level, and your scores appear on leaderboards and in multiplayer rooms, visible to other players. Your chat messages are visible to everyone in that room.
Your email address is never shown to other players. If you would rather not be identifiable, choose a display name that is not your real name — you can change it at any time in your profile.
7. Where your data goes
Our providers may store and process data on servers outside India. Section 16 of the DPDP Act permits such transfers except to countries the Central Government restricts by notification; we will stop transferring to any such country if it is notified. Wherever the data sits, this policy and our contracts with providers continue to apply to it.
8. How long we keep it
| Data | Kept for |
|---|---|
| Account data | Until you ask us to delete your account, then erased within 30 days — apart from backup copies, which age out within a further 90 days |
| Gameplay and leaderboard data | Deleted or irreversibly de-linked from you when your account is deleted |
| Guest player records | Purged after a period of inactivity if never claimed by an account |
| Chat messages | Retained while the room exists and for a short period after, so grievances can be investigated |
| Hashed IP addresses | Retained for abuse prevention, then purged |
| Server logs | Short-lived — typically days, per our hosting provider |
Section 8(7) of the DPDP Act requires us to erase personal data once you withdraw consent or the purpose is no longer being served, unless we are required by law to keep it. That is what the periods above implement.
9. How we protect it
- Passwords are stored as bcrypt hashes, never in a form we or an attacker could read back.
- Session cookies are encrypted and signed, marked
HttpOnlyso page scripts cannot read them, and markedSecurein production. - IP addresses are stored only as salted SHA-256 hashes, which cannot be reversed to the original address without the secret salt.
- Audio and artwork are served through short-lived signed URLs, not public buckets.
- All traffic is encrypted in transit over HTTPS.
- Administrative access is separately authenticated and limited to people who need it.
No system is perfectly secure. If a personal data breach occurs, we will notify the Data Protection Board of India and every affected user, as Section 8(6) of the DPDP Act requires, and we will report incidents to CERT-In within the timelines set by its directions.
10. Your rights
Under Chapter III of the DPDP Act, you may:
- Access a summary of the personal data we hold about you and how we process it (Section 11);
- Correct or complete inaccurate data, and erase data we no longer need (Section 12);
- Withdraw your consent at any time, as easily as you gave it (Section 6(4)) — which for most processing means asking us to delete your account;
- Nominate another person to exercise these rights on your behalf if you die or become incapacitated (Section 14);
- Complain to us, and then to the Data Protection Board of India if we do not resolve it (Section 13).
To exercise any of these, email scalystic@gmail.com from the address on your account. We will respond within 15 days and will not charge you. We may need to verify that the request is really from you before acting on it.
The DPDP Act also places duties on you: do not impersonate someone else when giving us data, do not suppress material information, and do not file a false or frivolous complaint (Section 15).
11. Children
Cluecade is intended for users aged 18 and over. We do not knowingly collect the personal data of a child under 18 without verifiable parental consent, and we never track, profile, or serve behavioural advertising to children — both prohibited by Section 9 of the DPDP Act.
If you are a parent or guardian and believe your child has given us data, email scalystic@gmail.com and we will delete the account and its data.
12. Complaints
If you are unhappy with how we have handled your data, contact our Grievance Officer — details, and the deadlines we hold ourselves to, are on the Contact & Grievances page. If we do not resolve your complaint, you may escalate it to the Data Protection Board of India.
13. Changes to this policy
If we change what we collect or why, we will update this page, change the “last updated” date, and — where the change materially affects you — tell registered users by email or in the product before it takes effect. Where a change requires fresh consent, we will ask for it rather than assume it.