Privacy

Updated 29 September 2026. No ads, no tracking across sites, no cookies for statistics: visits are counted by our own Umami, on our own server.

What we keep

• Your player: the name and face you pick for scoreboards. Guests get a random id instead.
• Sign-in: your email address and how you sign in (email link, passkey, or a provider such as Google). We don't keep the provider's name or picture.
• What you play: solve times and moves, ratings you give levels, race results and your race rating, the puzzles you make and the levels you publish.
• Races: a scrambled key made from your IP address, so we can spot one person racing themselves. The address itself isn't stored.
• Server logs: requests with IP addresses, kept 90 days for security.
• Visit counts: which pages are opened (without the part of the address that names a puzzle or a room), from which site you came, your browser, system, screen size and language, how fast the pages load, and your country and city worked out from your IP address. We also count a few things done, such as a puzzle started or solved, a hint asked for, a room made or a link shared, with a word or two about them (a daily or a community level, a race or co-op), never which puzzle, room or player. For some visits, where you click and how far you scroll are kept for a heat map, and the screen is recorded (a session replay) so we can see where the game is hard to use: what you type is never recorded, and neither is your email address. The address itself isn't stored, no cookie is set, and a visit can't be tied to you or to your account. If your browser asks not to be tracked, nothing is counted.

We use it to run the game you asked for: your account, scoreboards and races (GDPR Art. 6(1)(b)). The race key and the logs protect the site and fair play, and the visit counts show us which pages and features people use (our legitimate interest, Art. 6(1)(f)). Your name, times and published levels are public; your email never is.

You don't have to give us anything: you can play as a guest. An email address, or a provider sign-in, is needed only for an account. Nothing is decided about you automatically; the race rating only sorts the scoreboard.

On your device

A sign-in cookie, or a guest cookie that keeps your results for 30 days after your last visit, plus your settings and progress in the browser's storage. All of it is needed for the game to work, so there is no consent banner.

Who else handles it

The site's server is in Hungary, at our hosting provider: PR-Telecom Zrt., 3527 Miskolc, József Attila utca 45., tax number 11951216-2-05, ugyfelszolgalat@prtelecom.hu. Sign-in emails are sent from that server too.

If you sign in with Google, you do it on Google's own page, under its privacy policy; of what Google tells us, we keep only your email address. Google is based in the USA. The visit counts are made and kept on our own server, with Umami, open-source software we run ourselves; no analytics company sees them. We don't sell or share data with anyone else.

How long

An account's data: until you delete the account. A guest's: 30 days after its last visit, then it is deleted with everything it did. Server logs: 90 days. Visit counts stay, as they can't be linked to anyone. Levels you publish stay after you go, without your name.

Your rights

You can see what we keep about you, have it corrected or deleted, get a copy to take elsewhere, have its use restricted, and object to what we do for our legitimate interest. You can delete your account and data yourself on the account page; for anything else, email info@hashiarena.com. We answer within a month.

You can also complain to the Hungarian data protection authority, the Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH, naih.hu), or to the one where you live.