Privacy Policy - Frog Noggin

Frog Noggin Limited ("Frog Noggin", "we", "us", "our") operates frognoggin.com and its subdomains (the "Site"), where you can play our puzzle games, create an account, and track your progress. We refer to all of this collectively as the "Services". This Privacy Policy explains what information we collect from you ("User", "you") when you use the Site or Services, and how we use and protect it.

Frog Noggin Limited is the controller of the personal information described in this policy, which means we decide how and why it is used. You can reach us about it at any time; see Contact below.

Frog Noggin Limited is registered in England and Wales (company number 17419507). Registered office: Suite RA01, 195-197 Wood Street, London, E17 3NU.

1. Our Main Principle

We collect only the data necessary to operate the Services and provide core features such as saved progress, account access, and player statistics.

We use analytics to understand how the Services are used and to improve them, but we do not sell your data or use it to build advertising profiles.

2. Information We Collect

When you create an account, we collect:

Account information: Username, email address, and password (securely hashed)
Profile information: An optional bio
Game data: Which levels you have completed, your completion times, and your streaks

When you play games, we collect:

Gameplay analytics: For each attempt at a level, how long the attempt took, whether you finished it, how far into the puzzle you got, and how many hints, solutions, and wrong guesses you used
Session data: A browser session, used to save your game progress when you are signed in, and to count an attempt correctly when you are not. See the Cookies section below.

If you play without an account, this gameplay data is not linked to any identity. It is tied only to a random session identifier that we cannot trace back to a person.

If you later sign up or log in on the same browser, the games you played there without an account are added to your account, so your progress and streaks carry over.

When you visit the Site, we record for each page you open:

The page, and the page on our Site you came from
Where you came from: the domain of another website that linked you to us (for example "listdle.com", never the full address), and any campaign tags in the link you followed (the "utm_" parameters)
Device and country: whether you are on a phone, tablet, or computer, and your country, as reported by our network provider. We do not store your IP address.
A few actions on a page, such as sharing a result or opening How to Play

This sets no cookie and stores nothing on your device. To count visitors without one, we combine your IP address and browser type with a random value that we replace and delete every day, and keep only a scrambled result. The same visitor can be counted within a day, but not linked from one day to the next, and the result cannot be turned back into your IP address. If you already have a session cookie from playing, the visit is also linked to that session, and to your account if you have one. When you create an account, we note where your first visit came from, so we can tell which links bring new players.

When you submit a bug report, we collect:

Your description of the issue
The page URL where the bug occurred
Your browser's user agent string (browser and device information), to help us reproduce and fix the issue

When you write to us through the Contact Us form, we collect:

Your email address, so that we can reply to you
Your message, and the page you were on when you wrote it
Your username, if you are signed in

Contact messages are not saved to our database. They are emailed straight to our support inbox, so they will not appear in a data export. Your IP address is checked briefly to limit how often the form can be submitted, and is not stored with your message.

3. How We Use Your Information

We use your information to:

Provide and improve our games
Save your game progress across sessions
Display your statistics and achievements
Analyze gameplay patterns to improve puzzle difficulty
Understand how people find and use the Site, for example which links bring new visitors, which pages they use, and whether players come back, so we can improve it and know where to share it
Respond to bug reports and support requests
Email you about game updates and new content, only if you ticked the box to agree

Email updates (newsletter): This is off unless you choose it, when signing up or under Newsletter on your profile. We record when and where you agreed. You can turn it off anytime on your profile or with the unsubscribe link in every email; turning it off does not affect emails we must send about your account, such as password resets.

Our legal basis

Data protection law requires a reason for each way we use your information. Ours are:

Providing the Services you ask for (performance of a contract): your account, saving your progress, your statistics and streaks, and any subscription.
Our legitimate interests in understanding and improving the Site: gameplay analytics, counting page visits, and noting where visitors came from. We keep this to the minimum described above and pseudonymous where we can, and you can object to it (see Your Rights).
Our legitimate interests in keeping the Site secure and working: limiting request rates, error monitoring, and handling bug reports.
Your consent for email updates, which you can withdraw at any time.
Legal obligations, where the law requires us to keep records, for example of payments.

4. Third-Party Services

We work with the following service providers, which process user data on our behalf:

Stripe (Payments)

Any payments made on our Site are processed by Stripe. We do not store your payment details; they are handled directly by Stripe under Stripe's privacy policy.

https://stripe.com/privacy

Google OAuth (Optional Sign-In)

If you choose to sign in with Google, we receive your name, email, and profile picture from Google. We store only your email address to link your account.

https://policies.google.com/privacy

Resend (Email Service)

We use Resend to send transactional emails (password reset, email verification), our email updates if you have chosen to receive them, and to deliver the messages you send us through the Contact Us form. Your email address and the content of those emails are transmitted to Resend for delivery.

https://resend.com/legal/privacy-policy

Railway (Hosting)

Our application is hosted on Railway. All data is stored on their servers in accordance with their privacy policy.

https://railway.com/legal/privacy

Cloudflare (Network and Security)

All traffic to the Site passes through Cloudflare, which protects it from attacks and helps it load quickly. To do this, Cloudflare sees your IP address and basic details of each request, and it tells us which country a visit comes from. We use the IP address it passes on only to count visitors and limit request rates, as described in this policy, and we do not store it.

https://www.cloudflare.com/privacypolicy/

Sentry (Error Monitoring)

When something on the Site breaks, a report of the error is sent to Sentry so we can find and fix it. Reports contain technical details such as the page, the type of browser, and what went wrong. We have set Sentry not to collect personal information such as your IP address, cookies, or account details.

https://sentry.io/privacy/

International transfers

Some of these providers process data outside the UK, including in the United States and the European Union. Where they do, the transfer is protected by safeguards recognised under UK data protection law, such as the UK International Data Transfer Addendum to standard contractual clauses, or the UK–US data bridge.

5. Cookies and Local Storage

We use only first-party, essential cookies:

sessionid — Keeps you logged in and saves your progress on a level. If you play without an account, it is what lets us recognise your browser's play from one visit to the next: it counts each attempt once, remembers which levels you have played so they show as solved, and works out your daily streak. We also use it for statistics, such as whether players come back and which link first brought them to the Site. It holds a random identifier only, never your name or email, and is only set once you open a puzzle or sign in. It expires a year after you last played.
csrftoken — Protects form submissions against cross-site request forgery.
messages — Temporarily carries confirmation notices (for example, "profile saved"). It is deleted as soon as the notice has been shown.

If you play without an account, your daily streak is worked out on our server from the games played in your browser session, so it needs nothing else stored on your device.

We also remember whether you have house labels turned on, in your browser's local storage. This is a display preference only and is never sent to us.

We do not use third-party tracking cookies or advertising cookies. Signing in with Google or paying through Stripe takes you to their sites, where their own cookies and privacy policies apply.

6. Your Rights (GDPR)

You have the right to:

Access your data: Download all your data from your profile page as a machine-readable JSON file
Delete your data: Permanently delete your account and all associated data
Correct your data: Update your profile information in your account settings
Object: to our use of your information based on legitimate interests, including analytics. We will stop unless we have compelling reasons to continue, such as keeping the Site secure.
Restrict: ask us to pause using your information while a concern about it is being resolved.
Withdraw consent: for email updates, at any time, without affecting anything else.

To use any of these rights, contact us (see Contact below). We will reply within one month.

If you play without an account, your information is tied only to a random identifier in your browser's session cookie, so we cannot look it up by name or email. Clearing the cookies for frognoggin.com in your browser breaks that link for good, and daily visitor codes cannot be linked to you at all. If you would like us to remove your logged-out play, contact us and we will work out with you how to identify it.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. We would appreciate the chance to sort out your concern first.

7. Data Retention

Account data: Retained until you delete your account
Gameplay analytics: Records tied to your account are deleted with your account. Records from play without an account are kept to help us tune puzzle difficulty and understand how our games are played. They are tied only to a random session identifier and a daily visitor code, neither of which can be traced back to you.
Page visits: Deleted after 13 months, or with your account if they are linked to it.
Bug reports: Retained indefinitely (anonymized if you delete your account)
Contact messages: Held in our support inbox rather than our database, and deleted once we no longer need them. Deleting your account does not remove an email you have already sent us.

8. Data Security

We protect your data using:

HTTPS encryption for all data transmission
Secure password hashing (PBKDF2)
CSRF protection on all forms
HTTP security headers (HSTS, X-Frame-Options, etc.)
Limits on how often requests can be made, to protect the Site from abuse. For this, your IP address is briefly held in scrambled form and expires once the time limit has passed (at most an hour).

9. Children

The Services are not intended for anyone under 16, and our Terms of Service require users to be at least 16. We do not knowingly collect personal information from children under 16. If you believe a child has given us personal information, please contact us and we will delete it.

10. Contact

For privacy-related questions or to exercise your rights, use the Contact link at the bottom of any page, or email us at [email protected].