Skip to content
You're previewing the new Puzzel.org Back to the current site
Legal

Everything an IT department asks, answered from the running code.

Hosting, sub-processors, the domains to unblock, what data is stored and where it lives. The verbatim procurement questionnaire is one toggle away.

Vendor sheet · updated August 2026
In one line
A website, not an installation
Any modern browser, any device. No plugin, no app, no account needed to play.
Hosting
Vercel in front, Google Firebase behind
Vercel delivers the application; accounts, activities and results sit in a Firebase realtime database.
Data location
United States by default, EU available
Files and account data are two separate region settings. Uploaded files can be re-pointed by any account; moving the account data itself needs an active subscription.
Firewall
A short allowlist — websocket included
The database talks over wss://, which is the rule strict school filters break most often.
1

Who you are buying from

Puzzel.org is a Dutch one-person company, so the sales contact, the technical contact and the person who writes the code are the same. These are the details a purchasing department needs to register the vendor.

Support is unlimited and runs by email — replies come from the developer, not a ticket queue.
The contact below is also the security and data-breach contact; there is no separate escalation path.
Legal name
Puzzel.org
Contact and point of contact
Daan Weustenraad
Address
Sneekermeer 13, 3825XT Amersfoort, The Netherlands
Chamber of Commerce (KvK)
66090091
VAT number
NL002191535B44
Support
Unlimited, by email, 09:00–22:00 CET
2

What a school actually deploys

Nothing is installed. Teachers open puzzel.org in the browser they already have, and players open a link or an activity embedded in your own page — no account, no download, no admin rights.

Chrome, Firefox, Safari and Edge are supported; Internet Explorer is not.
No Flash, Java or browser extension is involved, and nothing is stored on the device.
Pages are small — typically well under 1 MB — so wireless is sufficient; no wired connection needed.
Playing works on phones and tablets; building an activity is more comfortable on a tablet or a desktop.
Chromebooks and locked-down managed devices are fine: everything runs inside the browser.
3

Firewall, allowlist and page headers

Unblock the domains below. The realtime database connects over a websocket, which is the thing a strict content filter tends to drop silently — if activities open but results never save, that is the rule to look at first.

Only the region your account uses is needed: a US account never contacts the EU database, and the other way round.
Stripe is contacted only while buying or renewing a subscription — it can stay blocked on classroom devices.
Domains to allow through the filter
puzzel.org The application itself
puzzelorg-cdn.s3.us-west-1.amazonaws.com Images and audio uploaded by accounts stored in the US
puzzelorg-image-cdn.s3.eu-north-1.amazonaws.com Images and audio uploaded by accounts stored in the EU
*.googleapis.com Sign-in and token refresh (Firebase Authentication)
puzzelorg.firebaseapp.com The sign-in pop-up for Google and Microsoft accounts
wss://puzzelorg.firebaseio.com Realtime database — accounts stored in the US wss
wss://puzzelorg-2.europe-west1.firebasedatabase.app Realtime database — accounts stored in the EU wss
fonts.googleapis.com, fonts.gstatic.com Web fonts
checkout.stripe.com Only while buying or renewing a subscription

Wildcards are Google's own hosts for Firebase Authentication; the rest are exact.

Response headers set on every page
Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
Forces HTTPS for a year, subdomains included
X-Content-Type-Options: nosniff
Stops the browser guessing content types
Referrer-Policy: strict-origin-when-cross-origin
Sends only the origin, never the full URL, to other sites
X-Frame-Options: SAMEORIGIN
Blocks framing of the platform — activity embeds are the deliberate exception
Content-Security-Policy: frame-ancestors 'self'; upgrade-insecure-requests;
Repeats the framing rule and upgrades any plain-http request
4

Logins, roles and single sign-on

Teachers sign in with an email address and password, or with the Google or Microsoft account your school already manages. Players stay anonymous unless a teacher deliberately switches registration on for an activity.

Every teacher has their own login; the school account owner invites colleagues to it and can take a seat back.
Roles are deliberately flat: the owner manages seats, and every teacher only ever sees their own activities.
Embedded activities support OIDC single sign-on: your portal passes a signed token, which is checked against your identity provider's published keys before a player is let in. Issuers are allow-listed per account, set up on request.
There is no Clever, ClassLink or SAML connector today — ask before assuming it.
5

What data the platform holds

By default an activity records nothing about the player: no account, no name, no score. Recording results and asking a player who they are are two separate settings a teacher switches on per activity, and every field asked for is picked by hand from the list below.

Teacher account: email address, name, the activities built, and any images or audio uploaded.
Player data: only the registration fields that teacher chose, plus the answers given in that one activity.
No advertising or analytics trackers anywhere on the platform, and no third-party scripts on the play screen.
The AI assistant is used per query: what a teacher types is sent to OpenAI to generate content. Player data never is.
Fields a teacher can choose to ask a player for
NameFirst nameLast nameEmailPhone numberStudent IDEmployee IDOrganisationClassCountryOther infoPasswordA question you write yourself

None of these is asked unless the teacher adds it to that specific activity.

6

Isolation, encryption and who can see your data

Every read and write passes through Firebase Security Rules: an account can only reach its own data and the results submitted to its own activities. That check runs on Google's servers, not in the browser, so it holds even for someone who rewrites the page in front of them.

Traffic is HTTPS end to end, and data is encrypted in transit and at rest by Google Firebase.
Uploaded images and audio are served from a public S3 URL. Treat them as public: keep anything confidential out of activity media.
Puzzel.org opens an account only when its owner asks for help with something in it.
Sub-processors
Vercel Application hosting and delivery
Google Firebase Authentication and the realtime database holding account data
Amazon S3 Storage for uploaded images and audio
Stripe Subscription payments and invoicing
OpenAI Generates content when a teacher uses the AI assistant

Everything the platform depends on. No other party receives account or player data.

7

Where the data is stored

Two settings, deliberately independent: one decides which S3 region holds uploaded files, the other which database region holds account data. A new account starts in the region its browser timezone suggests — Europe and Africa get the EU database — and either can be changed afterwards.

Account data: a Google Firebase realtime database in the United States (the default) or in europe-west1, Belgium.
Files: an Amazon S3 bucket in us-west-1 (California) or eu-north-1 (Stockholm). Existing files keep working after a switch.
Moving account data to the other region runs as a background migration and needs a paid subscription.
8

Deletion, retention and breach notice

Everything a teacher creates, that teacher can delete — immediately, without a support request. Deleting an activity also deletes what players submitted to it.

Delete one result and it is gone; delete an activity and its content, statistics and player registrations go with it.
Deleting the account removes its activities, folders, presets, payment records and the login itself.
There is no fixed retention period: data stays until the account holder removes it.
After a breach, account holders are emailed by the contact above with what happened, who is affected and what it means for them.
9

Embedding, LMS and the API

Most schools use Puzzel.org embedded in something they already run — a Canvas page, a school site, a blog. Activity pages are the only ones another site is allowed to frame; the rest of the platform refuses framing outright.

Canvas: an LTI launch lets a teacher pick one of their own activities and drops it into the page as an embed.
Anything else: copy the embed code and paste it into any page — no integration work needed.
A REST API can create activities from your own systems, capped at 10 requests a day per key.
Nothing has to be imported into Puzzel.org first — no roster sync, no student upload.
10

Licensing, procurement and payment

The school subscription is a yearly licence for one school account with room for colleagues, sized by the number of player sessions you expect per month. It never auto-scales into an overage bill: you pick the size, and can raise it whenever you need to.

A purchase order works when it can be paid by card or bank transfer. Cheques cannot be accepted — the company is not US-based.
Payments run through Stripe, so card details never reach Puzzel.org's own systems.
Need a formal document before ordering? The quote builder produces a PDF quote with your school's details on it.
School subscription at a glance
Price per year
€125 / $150
Teacher accounts included
5
Player sessions per month
5,000
Scaling up
1,000 more sessions a month for €25 / $30 a year
Without a subscription
2 activities and 60 player sessions a month, free
Something here still unclear? Ask instead — legal pages that need a follow-up email are badly written.