Privacy Policy

Development draft — not counsel-reviewed. Operator legal entity, registered address, and privacy contact are publish blockers. Do not invent a company name.

Who we are

Operator entity: [TO BE FILLED BEFORE LAUNCH]
Privacy contact: [TO BE FILLED — e.g. privacy@your-domain]
Brand / site: AI Crossword Maker at https://crosswordmaker.app (PUBLIC_SITE_URL).

What we process (product-aligned)

• Local drafts: stay in your browser IndexedDB until you sign in and save to the cloud.
• Account: email (magic link or Google OAuth), optional display name, session cookies (HttpOnly).
• Cloud puzzles: titles, grids, clues, versions, activity packs, and share tokens you create — stored in Cloudflare D1 / private R2 for exports you request.
• Anonymous AI demo: hashed IP + user-agent for daily quota; optional Turnstile token verification. We do not put API keys in the browser.
• Billing: Stripe/Creem process payments. We store order/subscription ledger rows and provider customer IDs — not full card numbers.

AI providers

When you use AI Topic, prompt content is sent to the configured model provider under their terms. Where supported we set store: false. We do not claim zero retention across the entire vendor chain.

Logs & admin

Operational logs should not store full word lists, clues, or email bodies by default. Admin overview shows aggregates and order metadata, not raw puzzle content.

Before charging customers

Replace this draft with counsel-reviewed text, fill the operator fields above, and publish a working privacy contact. Until then, treat legal pages as incomplete.