Privacy policy
Draft, not yet in effect. This text describes how Puzzle Studio works today and must be reviewed by a lawyer before launch. Bracketed items still need filling in.
Who we are
Puzzle Studio is run by [OPERATOR: your legal name or FOP registration], [POSTAL ADDRESS] (“we”). Questions about your data: [CONTACT EMAIL].
What we keep, and why
- Your account: email, name (optional) and a scrypt hash of your password. We never store the password itself.
- Sign-in: one session cookie (HttpOnly). We store only a hash of it, with the browser name it came from, for 30 days. Failed logins are recorded by email for 15 minutes to stop password guessing.
- Password reset: a hash of the emailed link, valid for one hour and usable once.
- Your shop: imprint name, bonus link, prices, Etsy category, autopilot settings and interface language.
- Your books: the book settings, listing copy, research ideas (with the public web sources they cite), review history, and the PDFs and images we build.
- Etsy, if you connect it: your Etsy shop id and name, and the access token Etsy gives us, encrypted. We use it only to create draft listings and to publish one listing when you press “Approve & publish” on it. We don’t read your buyers, orders or payments.
- Billing records: your plan changes and invoice references.
Language: to show the site in your language we look up the country of your IP address in a copy of the DB-IP country database on our own server. The address and country are not stored or sent anywhere. Your language choice is kept in a cookie (ps_lang) for a year.
We use no analytics, advertising or tracking cookies.
Who else handles data
- OpenAI writes listing copy, book plans and research. It receives book facts (titles, themes, word lists, your imprint name) and research prompts, not your email or password.
- Etsy, only if you connect your shop, receives the listings you create through us.
- Email provider [NAME]: sends password reset emails to your address.
- Railway (Railway Corporation, USA; servers in the EU (Amsterdam, Netherlands)): hosts the servers, database and files.
- Payment provider [NAME, once chosen]: handles payments; we never see your card.
How long we keep it
As long as you have an account. When you delete your account (Settings › Your data), we delete your account, shop, books, files, ideas, history and Etsy connection straight away. Billing records are kept for [N] years because accounting law requires it. Server backups roll over within [N] days.
Your rights
You can download everything we hold about you (Settings › Your data › Download my data), correct it in Settings, or delete it. You can also object to or ask about any processing at [CONTACT EMAIL]. If you are in the EU/EEA or the UK you may complain to your data protection authority; in Ukraine, to the Ukrainian Parliament Commissioner for Human Rights. [CONFIRM LEGAL BASES AND APPLICABLE LAW WITH A LAWYER.]
Security
Traffic is encrypted (HTTPS). Passwords and session cookies are stored only as hashes, Etsy tokens are encrypted, and each seller’s data is kept apart from every other seller’s.
Changes
If we change this policy in a way that matters, we’ll email you before it takes effect.