Puzzel.org privacy policy
Effective date: 18 September 2026
Puzzel.org (\"we\", \"us\" or \"our\") is built and run by Daan Weustenraad in the Netherlands, and we take protecting your privacy seriously. This policy explains what information we collect when you use our services, what we use it for, who we share it with and how we protect it. It is written to comply with the General Data Protection Regulation (GDPR).
If you create an account, we collect the following types of information:
We process and store your information for one reason: to keep the platform working and as easy to use as possible. It is not used for anything beyond what the platform needs to function.
We process personal data on the following legal grounds:
We keep your personal data only for as long as we need it for the purposes we collected it for, including any legal, accounting or reporting requirements.
We may share your information with:
An AI assistant you connect. You can connect an AI assistant (such as ChatGPT or Claude) to your Puzzel.org account. It is off until you connect one, and you can disconnect it at any time under Connected apps in your dashboard, which ends its access at once.
A connected assistant can do what you ask it to in your account: make an activity, list, read, change and copy your activities, and open or close a PIN. To do that it receives the names, content and settings of your own activities, and the names of your folders. It never receives student results, registrations, or anything a student typed; no part of the connection can read them.
What you type to the assistant is handled by the company that provides it, under its own terms. Puzzel.org receives only the content the assistant sends to make or change an activity. A picture you give the assistant for an activity is copied into your own Puzzel.org storage.
We store which assistant you connected, what you allowed it to do, and when it was last used, with your account. The access keys the assistant holds are stored only as one-way hashes. They are kept until you disconnect the assistant; an access key that is not renewed expires by itself.
A teacher can connect Puzzel.org to Google Classroom to put an activity in one of their classes and have each student's score written back to it. Nothing here happens unless a teacher connects it and assigns an activity; playing a Puzzel.org activity from an ordinary link works exactly as described in the rest of this policy.
What we access, and why
What we store
How scores are calculated and shared: a score is calculated on our servers from the answers given in the activity — never taken from the student's browser — and the only thing we send to Google is that score, to a submission that already exists in the teacher's class. We do not sell Google user data, use it for advertising, or use it to train AI models, and we transfer it to nobody else.
How long we keep it: a student's record on an assignment is removed when the teacher stops syncing that assignment or deletes the activity. When a teacher disconnects Google Classroom, or deletes their account, their token is revoked at Google and deleted. Grades already written to Google Classroom stay there: they belong to the school's gradebook, and the teacher or school manages them in Google Classroom.
Schools: when a school uses Puzzel.org with Google Classroom, the school decides what happens with its students' data and Puzzel.org processes it on the school's behalf, only to calculate and deliver scores.
Your school's own learning platform (LTI): a school can also connect Puzzel.org to its own learning platform — such as Moodle, Canvas or Brightspace — through the LTI 1.3 standard. A school administrator registers Puzzel.org once, signed in with a Puzzel.org account. When a student opens a Puzzel.org activity from a course, the platform tells us who they are: the ID the platform uses for them and, if the school's settings share them, their name and email address. We use this only to sign them in to that activity; no Puzzel.org account is created for them. When a teacher has chosen to send scores, we store for each student that platform ID, the address of the gradebook column and the score last sent, and we send the platform only the score, calculated on our servers as described above. We never ask the platform for class lists or other coursework. A student's record on a placement is removed when the teacher stops syncing it or deletes the activity; scores already written stay in the school's gradebook. As with Google Classroom, the school decides what happens with its students' data, and Puzzel.org processes it on the school's behalf.
Puzzel.org's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
If we transfer your data outside the European Economic Area (EEA), we make sure an adequate level of protection applies — for example through standard contractual clauses.
We use appropriate technical and organisational measures to safeguard your data, including restricted access, secure servers and every measure Google Firebase itself takes to comply with regulations: https://firebase.google.com/support/privacy
Under the GDPR you have the following rights:
We do not use automated decision-making or profiling that significantly affects you.
Our website uses functional browser storage only, to keep track of your active session — when you are logged in, or when you are creating or playing activities. The one cookie we set is a short-lived one while an activity is opened from a school's learning platform. There are no tracking or advertising cookies. You can clear this storage in your browser settings.
We may update this policy from time to time. We will let you know about any material changes with a notice on the website.
If you have questions or concerns about this policy, or want to exercise any of your rights, contact us at:
Email: daan@puzzel.org
If you believe we have not complied with applicable data protection law, you have the right to lodge a complaint with the relevant supervisory authority in your country.
", "legaldoc_privacy_lms": "Added 24 September 2026, updated 25 September 2026. This addendum applies only to Puzzel LMS — the part of Puzzel.org where a teacher makes a class list and shares courses with that class. None of the data below is collected anywhere else: playing an activity from an ordinary link, or anywhere outside a teacher's course, works exactly as described in the policy above.
What we store
Who can see it
The teacher who owns the class sees all of the above for that class. Students see the names on the class list so they can pick their own; beyond that, a student sees only their own results, their own work and the feedback on it — never a classmate's. Files a student hands in are stored in Amazon S3, in the teacher's chosen storage region, under an address that cannot be guessed: anyone who is given that address can open the file, and Puzzel.org shows it only to the student and their teacher.
How long we keep it
Until the teacher deletes it. Removing a student from the student list takes them out of every class, with their results. Removing a student from a class deletes that student's results, work and feedback in the class; deleting a class deletes all of it; resetting a student's progress deletes their results, work and feedback in that course. A teacher can also delete any file a student handed in, or every student file in a course at once. The name-switch log is the one part deleted automatically, after 30 days.
Schools and Academies: when a school or an Academy uses Puzzel LMS with its students or learners, it decides what happens with their data and Puzzel.org processes it on its behalf. Our data processing agreement describes this processing in detail.
", "legaldoc_terms": "Effective date: 1 November 2026. This version replaces the Terms effective 18 September 2026.
Puzzel.org is operated by Daan Weustenraad, a sole proprietorship (eenmanszaak) registered with the Dutch Chamber of Commerce (KvK) under number 66090091, at Sneekermeer 13, 3825 XT Amersfoort, the Netherlands (\"Puzzel.org\", \"we\", \"us\"). These terms and conditions (the \"Terms\") govern your access to and use of the Puzzel.org website, apps, API, embeds, courses and related services (together, the \"Services\").
You accept these Terms when you create an account, place an order, or otherwise use the Services. If you do not agree, do not use the Services.
The plain-language summary shown with these Terms on our website is there for convenience. Only the full text of these Terms is legally binding. Where the Services are offered in more than one language, the English version of these Terms prevails.
Consumers and business customers. If you use the Services for purposes outside your trade, business or profession, you are a consumer. Where these Terms say \"business customers\", they mean everyone else, including teachers using the Services for their work, schools, companies and other organisations. Nothing in these Terms limits rights that consumers have under mandatory law in their country of residence.
By creating an account you confirm that you are at least 16 years old, or that you are acting for a school, company or other organisation that has authorised you to do so. Players of an activity do not need an account and may be younger; section 7 explains who is responsible for them.
You must give accurate information when you create an account and keep it up to date. You are responsible for everything that happens under your account and for keeping your login details confidential. Tell us at once if you believe your account has been used without your permission.
If you create an account for an organisation, you confirm that you are authorised to bind it to these Terms, and \"you\" in these Terms includes that organisation.
You may use the Services to create, share, embed, print and play activities and courses, within the limits of your plan. You agree to:
All content that we created for the Services, including text, graphics, logos, activity templates, sample activities and software, belongs to Puzzel.org or its licensors and is protected by intellectual property law. You get no rights in it other than the right to use the Services under these Terms.
The free plan costs nothing. Paid plans are priced as shown on the pricing page at the time you order, and prices include VAT where it applies. We show you the price and the billing period before you pay.
Automatic renewal. Paid subscriptions renew automatically at the end of each billing period until you cancel. Your account dashboard shows whether your plan renews and when.
Cancelling. You can switch off automatic renewal from your account dashboard, or ask us to at daan@puzzel.org. Cancellation takes effect at the end of the current billing period, and you keep your plan until then.
Price changes. We may change the prices on the pricing page at any time. A change applies to new orders. An existing subscription renews at the price it was bought at. If we ever change the price of an existing subscription, the change applies only from its next renewal, and we give the subscribers concerned at least 30 days' notice so they can cancel first.
Right of withdrawal for EU consumers. If you are a consumer in the EU, you may withdraw from a purchase within 14 days of ordering, without giving a reason, for a full refund. Email daan@puzzel.org to do so.
Refunds. Beyond the right of withdrawal and the cases in sections 10 and 15, fees are non-refundable, except where the law requires otherwise or we agree in writing.
Credits and allowances. AI credits, player sessions and other allowances are part of your plan. They have no cash value, cannot be transferred, and are not refundable, except where the law requires otherwise.
Plans paid for by someone else. If a school or organisation pays for your plan or gives you a seat, your access to paid features depends on that plan and ends when it ends or when your seat is removed.
Late or failed payment. If a payment fails, we may suspend paid features until it is settled. Your content stays in your account during a suspension.
Everything you upload to or create on the Services, such as word lists, questions, images, audio, activities and courses, is your content (\"User Content\"). You keep ownership of it and all intellectual property rights in it. We never claim ownership of User Content.
The licence we need. So that the Services can work, you grant Puzzel.org a non-exclusive, worldwide, royalty-free licence to host, store, reproduce, adapt for display (for example resizing an image or generating a printable version), display and distribute your User Content. We use this licence only to provide the Services to you and to the people you share your activities with. The licence ends when you delete the content or your account, except as described below and for copies in routine backups, which are removed on their normal schedule. We will not use your User Content for any other purpose, including training AI models, without your explicit consent.
Sharing and embedding. When you share an activity by link, QR code, PIN or embed, anyone with access to it can view and play it. You decide what you share and with whom.
Publishing to the public library. When you publish an activity to the public activity library, you also grant every other user of the Services a non-exclusive, worldwide, royalty-free, perpetual licence to view and play it, copy it into their own account, adapt it, and use their copy for teaching, training and learning. Unpublishing or deleting your activity removes it from the library. Copies other users made before then remain theirs to keep and use.
Moving content into a school library. When you move an activity or course into your school's or organisation's shared library, it is held in that school's account. You grant the school a non-exclusive, worldwide, royalty-free, perpetual licence to keep, use, adapt, copy and delete it, and to let its members do the same. It stays with the school if you leave or your seat ends. What happens to shared-library content is decided by the school.
Your responsibility. You confirm that you own or have the necessary rights to all User Content you submit, including the rights needed for the licences in this section, that it does not infringe anyone's rights, and that you have any consent needed from people who appear in it. You are responsible for your User Content and for what you share, including with students. Keep your own copies of content that matters to you: the Services are not a backup service.
You may not upload, create or share content that is unlawful; infringes intellectual property or privacy rights; is sexual, hateful, harassing, violent or otherwise unsuitable for the audience you share it with (which is often children); contains malware or misleading links; or collects personal data from players beyond what the Services' registration fields provide for.
Reporting. Anyone can report content they believe breaks these rules or infringes their rights. Email daan@puzzel.org with a link to the content and a description of the problem. For rights claims, include your contact details and a statement that you are the rights holder or authorised to act for them. Library entries can also be reported with the Report button on their page. We review reports promptly.
Copyright notices from the United States. We respond to notices under the US Digital Millennium Copyright Act. Send them to our designated agent, Daan Weustenraad, at daan@puzzel.org or the postal address in section 1, with the information that 17 U.S.C. § 512(c)(3) requires. We remove or disable access to material that a valid notice identifies. We may close the accounts of repeat infringers.
What we may do. We may remove or disable access to content, or restrict sharing of it, when we reasonably believe it breaks these rules or the law, when we receive a well-founded report, or when a court or authority requires it. When we do, we tell the account holder what we did and why, and how to object, unless the law or the safety of others prevents it. We are not obliged to monitor User Content and do not do so, and we are not responsible for User Content created by others.
The Services are made for teachers, trainers and organisations. Players, including children, can play activities without an account. When you enable player registration, you choose which fields players fill in. Collect only what you need for your purpose.
You are responsible for your players. If you share activities with students or other minors, you confirm that you are allowed to do so, that you have obtained any consent required from parents, guardians or your school under the laws that apply to you (for example COPPA or FERPA in the United States, or the GDPR in the EU), and that your use complies with your school's or organisation's policies.
We process on your behalf. For personal data of players that you collect through the Services, such as registration fields, answers, scores and gradebook data, you (or your school or organisation) are the controller and Puzzel.org is the processor. We process that data only to provide the Services to you and as described in our Privacy Policy. We do not sell it, do not use it for advertising, and do not use it to build profiles of students. Schools and other business customers can request a data processing agreement at daan@puzzel.org.
Your own data. How we handle your own account data is described in our Privacy Policy, which forms part of these Terms.
If you connect the Services to Google Classroom, a learning management system (for example through LTI) or another gradebook:
AI features. The AI features draft clues, questions, answers, images and other content from what you give them. Their output is a suggestion generated by an automated model: it may be inaccurate, incomplete, biased or unsuitable for your audience. Review and edit AI output before you publish or share it; you are responsible for what you publish. Content you generate with AI features is your User Content. We do not guarantee that AI output is free of third-party rights. Some features send short pieces of text to an AI provider while an activity is played, for example to check whether a guessed word exists.
Embedding and API. You may embed activities on your own website or LMS and use the API within your plan's limits and the API documentation. You are responsible for the site or system you embed into, and for complying with its rules. We may change or retire API endpoints with reasonable notice.
Third-party services. The Services rely on third-party providers, including hosting, databases, file storage, payment processing, AI model providers and gradebook platforms. Those providers act under their own terms and privacy policies. We choose and instruct them with care, but we are not responsible for their availability, changes to their services, or losses caused by their acts or omissions, except where we are liable under mandatory law.
We work to keep the Services available and reliable, but we do not promise uninterrupted or error-free operation. The Services may be unavailable for maintenance, updates, failures of third-party providers, or events outside our reasonable control.
We keep improving the Services. We may add, change or remove features, activity types or plan limits. If we remove a feature or activity type that your paid plan includes, we announce it on the website at least 30 days in advance where reasonably possible. You may then cancel before the change takes effect and receive a pro-rata refund of prepaid fees for the remaining period.
By you. You may close your account at any time from your account dashboard, or by emailing daan@puzzel.org. Closing your account switches off automatic renewal. It does not entitle you to a refund except as described in sections 4, 10 and 15.
By us. We may suspend or terminate your access to the Services, with notice where reasonably possible, if you materially breach these Terms, if your use harms the Services or other users, if we are required to by law or a competent authority, or if your account has been inactive for more than 24 months and holds no paid plan. Where a breach can be fixed, we give you a reasonable chance to fix it first.
Before you go. Save anything you want to keep. You can print your activities, and on plans that include it, download results as a spreadsheet. Activities you shared stop working once your account is deleted.
Your data afterwards. When your account is deleted, we delete your account data and User Content. We keep only:
Sections that by their nature should survive termination continue to apply after your account is closed. These include sections 5, 12, 13, 14 and 16.
The Services are provided \"as is\" and \"as available\". To the extent the law allows, we make no warranties, express or implied, including about merchantability, fitness for a particular purpose, non-infringement, accuracy of content (including AI output and automatically calculated grades), or that the Services will meet your requirements, work without interruption, or be free of errors or harmful components.
For consumers, this section does not limit the statutory right to receive Services that conform to the contract.
What we are not liable for. To the fullest extent permitted by law, Puzzel.org is not liable for indirect, incidental, special or consequential damages; for loss of profit, revenue, business, goodwill or reputation; for the cost of substitute services; or for fines or penalties imposed on you by a third party or authority. This applies however the damage arises, even if we were told such loss was possible.
Lost or damaged data. If User Content or other data is lost or damaged through our fault, we will make reasonable efforts to restore it. Any further liability for it falls under the cap below. You remain responsible for keeping your own copies of content that matters to you (section 5).
Cap. To the fullest extent permitted by law, our total liability to you for all claims arising out of or relating to the Services or these Terms, whether in contract, tort (including negligence), breach of statutory duty or otherwise, is limited to the greater of (a) the fees you paid us in the 12 months before the event giving rise to the claim, and (b) EUR 100. This cap applies to all claims together, per calendar year.
Notice first (business customers). We are liable for a failure to perform only after you have told us about it in writing, describing it in reasonable detail, given us a reasonable period to fix it, and we have still not fixed it. This does not apply where fixing it is no longer possible.
Events beyond our control. We are not liable for a failure or delay caused by events beyond our reasonable control. These include outages or failures of hosting, database, payment, AI or other third-party providers; internet or power failures; denial-of-service and other attacks we could not reasonably prevent; government action; and natural disasters.
Who can rely on this. The limitations in this section also protect our staff, contractors and suppliers. They may rely on them as if they were a party to these Terms.
Exceptions. Nothing in these Terms excludes or limits our liability for death or personal injury caused by our negligence, for fraud, for damage caused by our intent or deliberate recklessness (opzet of bewuste roekeloosheid), or for anything else that cannot be limited under the law that applies to you. For consumers, the limitations in this section apply only to the extent permitted by the mandatory consumer protection law of their country of residence.
Time limit for claims. Any claim against Puzzel.org must be brought within 12 months after you became aware, or should reasonably have become aware, of the facts giving rise to it. After that the claim lapses. This does not apply to consumers where the law gives them a longer period.
Your responsibility. You are responsible for the results of your own decisions based on the Services, including grades you rely on, content you publish, and consents you were required to obtain.
To the extent the law that applies to you allows, business customers will defend, indemnify and hold harmless Puzzel.org and its owner, staff and contractors from and against all claims, demands, losses, damages, fines, costs and expenses (including reasonable legal costs) brought by a third party and arising out of or relating to:
This does not apply to the extent the claim is caused by our own breach of these Terms or of the law.
We will tell you promptly about any such claim and let you control its defence. You may not settle a claim in a way that admits fault on our part or imposes obligations on us without our written consent.
Consumers are liable to us for such claims only under the general rules of the law that applies to them.
We may update these Terms, for example when we add features, when the law changes, or to make them clearer.
For changes that materially affect your rights or obligations, we publish the new version with a notice on the website at least 30 days before it takes effect. The notice appears on this page and in our public updates. If you keep using the Services after the effective date, you accept the new Terms. If you do not agree, you may close your account before the change takes effect and, for a paid plan, receive a pro-rata refund of prepaid fees for the remaining period. Minor changes, such as clarifications or corrections, take effect when we publish them.
The effective date at the top of these Terms shows the current version. Earlier versions are available on request.
These Terms and any dispute arising out of or relating to them or the Services are governed by the laws of the Netherlands, without prejudice to mandatory consumer protection law of the country where a consumer lives.
Talk first. If you have a complaint or dispute, email daan@puzzel.org. We aim to resolve the matter informally, and both of us agree to try this before starting legal proceedings.
Courts. If we cannot resolve it, the competent court in the Netherlands has exclusive jurisdiction. Consumers in the EU may also bring a claim in the courts of their own country of residence.
Entire agreement. These Terms and the Privacy Policy form the entire agreement between you and Puzzel.org about the Services and replace any earlier terms, together with any separate agreement described in the next paragraph.
Separate agreements come first. If you or your organisation has signed a separate agreement with us, such as a data processing agreement, a student data privacy agreement or an order form, that agreement prevails over these Terms where the two conflict. On anything it does not address, these Terms apply. Terms in your own purchase orders or procurement documents do not apply unless we have signed them.
Severability. If any part of these Terms is found invalid or unenforceable, that part is applied to the maximum extent the law allows and the rest remains in force.
No waiver. If we do not enforce a provision of these Terms at some point, that does not mean we have given up the right to enforce it later.
Assignment. You may not transfer your rights or obligations under these Terms without our consent. We may transfer ours to a successor of the business, for example a company we control. We will announce it if we do.
Contact. Questions about these Terms: daan@puzzel.org. Legal notices must be sent to that address or to the postal address in section 1.
", "legaldoc_terms_previous": "Effective date: 18 September 2026
These terms and conditions (the \"Terms\") govern your access to and use of the Puzzel.org website, services and products (together, the \"Services\"). By using the Services you agree to be bound by these Terms. If you do not agree with them, do not use the Services.
To use the Services, you must agree to comply with these Terms and with applicable laws.
You agree to:
If you create an account, you must provide accurate and complete information.
If you connect the Services to Google Classroom or another school gradebook:
We may suspend or terminate your access to the Services if:
You may also close your account at any time: delete it from your account dashboard, or ask us to by emailing daan@puzzel.org.
To the fullest extent permitted by law:
You agree to indemnify Puzzel.org and hold it harmless from any claims, losses or damages arising out of your violation of these Terms or your misuse of the Services.
We may update these Terms from time to time. We will notify you of significant changes by a notice on the website. If you continue to use the Services after a change, you accept the updated Terms.
These Terms are governed by the laws of the Netherlands. Any dispute will be resolved in the courts of the Netherlands.
Disputes may be resolved through negotiation: attempt to resolve the dispute informally first.
If you have questions or concerns about these Terms, email us at daan@puzzel.org.
Puzzel.org
Daan Weustenraad — daan@puzzel.org
Sneekermeer 13, 3825XT, Amersfoort, the Netherlands — https://puzzel.org
The school subscription gives access to the online platform for creating educational, interactive activities, including uploading your own content.
It runs for one year and includes:
Yes — an active internet connection, over either Wi-Fi or a mobile network.
The solution uses an internet-based login.
Wireless is sufficient. Pages are light — mostly under 1 MB each.
Any current browser: Chrome, Firefox, Safari and Edge all work. Internet Explorer is too old and is not supported. No plugins such as Flash are needed.
The website is fully responsive, so it works on mobile devices as well as desktop computers.
Building activities is best done on a desktop computer or a tablet: the larger screen keeps an overview of what you are building.
Not a factor — the website runs on any reasonably modern hardware.
No. It is a complete web application and runs entirely in the browser.
Not by default. The platform uses no tracking cookies or ads at all. Staying signed in uses the browser's own storage, not a cookie.
When creating an activity, the owner can switch on 'Keep track of stats' and 'Force registration' to collect individual activity results. Each registration field is chosen by hand, so the form can be kept as privacy-friendly as possible.
Each of these is entirely optional:
Optionally, PII: first name and last name, email address, student ID.
It can be used immediately — all the puzzle generators are publicly available. Upgrading to a paid subscription also takes effect immediately.
For Puzzel.org to work fully, allow the following hosts:
The realtime database connects over a websocket, which is the rule a strict content filter tends to drop silently: if activities open but results never save, that is the rule to look at first. Only the region your account uses is needed — a US account never contacts the EU database, and the other way round. Stripe can stay blocked on classroom devices.
Data is stored in the EU or in the United States: a new account gets the region its browser timezone suggests, and Europe and Africa get the EU. Two settings decide where, independently of each other:
A new account starts in the region its browser timezone suggests — Europe and Africa get the EU database — and either setting can be changed afterwards. Moving account data to the other region runs as a background migration and needs a paid subscription. The application is hosted and delivered through the CDN of Vercel.
Only for static content pages.
No. All communication runs through the activity owner, who in most cases is the teacher. The one exception is optional: when a school switches on student accounts in Puzzel LMS, each student gets one email to set their password.
Four routes in:
A teacher can also connect an AI assistant (such as ChatGPT or Claude) to their own account. It is off unless a teacher connects one, it shares only that teacher's own activities with the assistant they chose and never student data, and it runs on puzzel.org itself, so there is no additional host to allow.
Yes. Each teacher creates their own login with their email address. That individual login can later be connected to a school-account subscription, where available.
Yes — by email, daan@puzzel.org.
(Provided you put some effort into trying features and reading the existing documentation.) Available between 9 AM and 10 PM (CET).
Yes and no. Students can register (if you force registration) and, when they solve activities while signed in, you have access to their activity results. You have no control over their accounts, though.
You can delete any of their results at any time.
No. There is little hierarchy in Puzzel.org: only the school-account owner has extra rights, namely to invite other teachers to join the main school account (which gives them Premium access).
No, but there is a good amount of documentation in the features and activity-builder sections, and questions are always welcome by email. The platform is also designed to be easy to pick up.
No. Importing data is not a requirement at all.
Account holders are notified by email. The point of contact at Puzzel.org is Daan Weustenraad (see details above). The notification describes the breach, who was affected and what the consequences are.
The application is hosted by Vercel, one of the larger application delivery networks, and is therefore secured in the best possible way. Accounts, activities and results sit in a Google Firebase realtime database; uploaded images and audio are stored in Amazon S3.
The full list of sub-processors — no other party receives account or player data:
Logically, through authentication. While signed in to your account, you only reach the data stored by you as the activity owner, or on behalf of your activities (the activity players' data). This is fully enforced by the Firebase Security Rules implementation.
More on Firebase Security Rules
Traffic is HTTPS end to end, and account data is encrypted in transit and at rest by Google Firebase.
'Firebase services encrypt data in transit using HTTPS and logically isolate customer data.' — Firebase
Two exceptions to know about. Uploaded images and audio are stored in Amazon S3 and served from a public URL — treat them as public and keep anything confidential out of activity media. The AI assistant is used per query: what a teacher types is sent to OpenAI or Google Gemini to generate content. One thing a player types can reach OpenAI: in a Wordle with the word check switched on, a guess that isn't in our own word lists is sent as a single word, with nothing that identifies the player.
Authentication runs through Google Firebase. Teachers sign in with an email address and password, or with the Google or Microsoft account your school already manages. Players stay anonymous unless a teacher switches registration on for an activity.
Embedded activities support OIDC single sign-on: your portal passes a signed token, which is checked against your identity provider's published keys before a player is let in. Issuers are allow-listed per account and set up on request. There is no Clever, ClassLink or SAML connector today.
https://firebase.google.com/docs/auth
A user account can be deleted at any time. This completely wipes every record of its activities and their activity results.
Only the activity owner has access to their own data. Puzzel.org staff can access an account for debugging purposes, but never without an explicit request from the account holder.
Yes, when the PO can be paid by card or bank transfer. Cheques cannot be accepted, as Puzzel.org is not based in the US. Payments run through Stripe, so card details never reach Puzzel.org's own systems. If you need a formal document before ordering, the quote builder produces a PDF quote with your school's details on it.
Yes. Credit or debit card, PayPal, Apple Pay and Google Pay are accepted in every currency; when paying in euros, iDEAL, Bancontact, Giropay and other local methods are offered as well, and bank transfer is available. Every payment runs through Stripe. The full list for your country is shown on the pricing page.
" }