Privacy policy

At a glance

Contents

1. At a glance
2. Who we are
3. What we use data for
4. Our games on Steam, Epic, iOS, Android and Switch
5. This website
6. Cookies and similar technologies
7. Newsletter
8. Buying web games (Paddle) and vouchers
9. Web games
10. Love Box
11. Community, social media, press and jobs
12. Who receives your data
13. Transfers outside the EEA
14. Your rights
15. Children, security and other information
16. Changes and contact

Who we are

The controller of your personal data (the company that decides why and how it is used) is:

Eleven Products Sp. z o.o.
ul. Domki 14, 31-519 Kraków, Poland
VAT (NIP): PL6793208772
Privacy contact: privacy@elevenpuzzles.com

We make and publish games under the name Eleven Puzzles. We have not appointed a data protection officer; the address above is the right place for every privacy question or request.

This policy covers the website elevenpuzzles.com (including Love Box, the newsletter and the purchase and voucher pages), our web games at game.elevenpuzzles.com and lab.elevenpuzzles.com, and our games Unsolved Case, Unboxing the Cryptic Killer and Parallel Experimenton every platform where we publish them (Steam, Epic Games Store, GOG, itch.io, the App Store, Google Play and Nintendo Switch).

Stores and platforms are separate companies with their own privacy policies. When we say that a platform is an independent controller, it means that it decides about its own use of your data, and that this policy does not replace its policy.

What we use data for

This table is a summary. The sections below explain each use in detail: what we collect, why, who receives it, and how long we keep it. “Art.” refers to the EU General Data Protection Regulation (GDPR).

Our games on Steam, Epic, iOS, Android and Switch

This section covers Unsolved Case, Unboxing the Cryptic Killer and Parallel Experiment.

What is the same everywhere

• There are no accounts in our games, we do not ask for your name, e-mail or age, and the games contain no advertising, in-app purchases or tracking of your behaviour.
• Your progress is saved on your device. Your platform may also store it in its cloud (see the platform sections below).
• There is no text or voice chat in our games. Players talk through other tools of their choice.

Playing online with a friend

The games are cooperative and are played online by two players. To connect you, the game contacts our lobby server (the “matchmaker”) and then a game server that we run.

• What we receive: the display name from your platform (for example your Steam, Epic, Game Center, Google Play Games or Nintendo name), your platform, the game version, the character you chose, the room code if you join a friend, and your IP address (it is part of every internet connection). In Parallel Experiment the host also sends the saved game so that you can continue together.
• What we do with it: to connect you with your partner, pick a game server near you based on the approximate country of your IP address and run the game session (Art. 6(1)(b) GDPR). We also count players by country to see where our games are played and where we need servers (our legitimate interest, Art. 6(1)(f) GDPR). We do not store IP addresses in our databases.
• What your partner sees: your display name. Your partner does not see your IP address, because the game is not peer-to-peer: both of you connect to our server.
• How long: the state of the game lives in the memory of the server during your session and is gone shortly after it ends (the games allow a few minutes to reconnect). Our server logs record the details of the rooms that were created and the display names and are kept for a short time, usually no longer than 30 days, to find and fix problems (Art. 6(1)(f) GDPR).
• Where: our game servers run in data centres of Google Cloud in Europe (Poland, Germany, Switzerland), the USA, Israel, Hong Kong and India, and for some games at DigitalOcean in Frankfurt. The matchmaker chooses a server close to you, so your data may be processed outside the EEA (see Transfers).

Crash reports and diagnostics

Unsolved Case, Unboxing the Cryptic Killer and Parallel Experiment send crash reports to Unity Technologies (the maker of our game engine) when the game crashes: the device model, operating system, graphics and memory information, the technical details of the crash and the last lines of the game’s log, which can include your platform display name. All our games also send basic hardware statistics through Unity. We use them to find and fix bugs and to decide which devices to support (legitimate interest, Art. 6(1)(f) GDPR). Unity Technologies acts as our processor for crash reports; see Unity’s privacy policy.

Steam (Valve)

On Steam, Valve Corporation is an independent controller of your account and purchase data (see Valve’s privacy policy). Through Steamworks the game uses your public Steam profile name (to show it to your partner), records your achievements and, in Parallel Experiment, stores your saved game in Steam Cloud, which Valve operates. We do not receive your real name, e-mail or payment details.

Epic Games Store (Epic Online Services)

In the Epic Games Store versions you sign in with your Epic account through Epic Account Services. Epic Games, Inc. and its group companies are independent controllers of your Epic account data, as described in Epic’s privacy policy. We use the basic profile that you allow (your Epic display name and account identifier) to show your name to your partner, to record achievements and, in Parallel Experiment, to store your saved game in Epic’s cloud. We do not store your Epic account data on our servers beyond the online session and the short-lived logs described above. You can ask us to delete any Epic account data we hold by writing to privacy@elevenpuzzles.com, and you can manage the permissions in your Epic account settings.

iOS (App Store)

Apple is an independent controller of your Apple account and purchases. The game uses Game Center for your display name and achievements, can store saved games in iCloud (Parallel Experiment) and may show Apple’s standard prompt to rate the game. We do not use advertising identifiers and do not track you across apps. Apple provides us with anonymous sales and usage statistics for users who agreed to share them with developers.

Android (Google Play)

Google is an independent controller of your Google account and Play Store purchases. The game uses Google Play Games Services for your display name and achievements, can store saved games in Google’s cloud (Parallel Experiment) and may show Google’s standard prompt to rate the game. We do not use advertising identifiers. Google provides us with anonymous statistics and crash information (Android vitals) for users who agreed to share them.

Nintendo Switch

On Nintendo Switch the game shows the nickname of your Nintendo account to your partner. Nintendo is an independent controller of your Nintendo account and we do not receive any other data from it.

GOG and itch.io

GOG and itch.io sell and distribute the game to you and are independent controllers of your purchase data. We receive sales reports from them, which do not identify you personally.

This website

Hosting and server logs

The website is hosted by Cloudflare (Cloudflare Pages). When you open a page, Cloudflare receives your IP address, browser and device information and the address of the page you request, which it needs to deliver the page and to protect it against attacks. We do not keep these logs ourselves. Our legal basis is our legitimate interest in running and securing the website (Art. 6(1)(f) GDPR).

Fonts, images and links

Our fonts and images are served from our own domain, so your browser does not contact Google Fonts or other image hosts. Links to Discord, Facebook, Instagram, X (Twitter), TikTok, Steam and other sites are normal links: nothing is sent to those sites until you click, and after you click their own privacy policies apply. The share buttons on blog posts work the same way.

Google Analytics

If you allow analytics, we use Google Analytics 4 to see which pages are visited, which devices and browsers are used and roughly where visitors come from, so that we can improve the site. Google sets the cookies _ga and _ga_LTZEP3DZZ9 and receives your IP address, device information and the pages you view. We have switched off Google Signals and advertising features, we keep the data for 2 months, and we do not load Google Analytics at all if your browser sends the “Do Not Track” signal. Google acts as our processor (Google Ireland Limited and Google LLC). Our legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings.

YouTube videos

Some pages show YouTube videos. Nothing is requested from YouTube until you click “Load video” or allow embedded videos in the cookie settings. After that, your browser contacts YouTube (Google) through the privacy-enhanced domain youtube-nocookie.com, so Google receives your IP address and may set cookies. Our legal basis is your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law). Videos opened from the pop-up players on our game pages start only after you click them and also use youtube-nocookie.com.

Writing to us

If you e-mail us (contact@, support@, press and similar addresses), we use your address and what you write to answer you (legitimate interest, Art. 6(1)(f) GDPR) and keep the conversation for as long as needed to help you and then until the limitation period for possible claims ends. Our e-mail is operated by our mail provider as our processor.

Questions about any of this: privacy@elevenpuzzles.com.

Cookies and similar technologies

Cookies are small files that a website stores in your browser; similar technologies, such as browser storage, work in the same way. Under Polish law (Art. 399 of the Electronic Communications Law) we need your consent for everything that is not strictly necessary, so Google Analytics and YouTube are off until you say yes. You can accept all, reject all or choose in the cookie settings, and you can change your choice at any time:

Open cookie settings

When you open the checkout to buy a web game, Paddle may set its own cookies; see Paddle’s privacy notice. You can also delete cookies or block them in your browser settings.

Newsletter

What we collect. Your e-mail address and a few labels that tell us where you signed up (for example the page of the website or that you bought a web game). Our newsletter provider Mailchimp also records when and from where you confirmed your subscription and whether you open and click our e-mails, so that we can see which news is interesting.

Why and on what basis. To send you news about our games, patches and offers, about one e-mail a month. The basis is your consent (Art. 6(1)(a) GDPR and, for sending marketing by e-mail, Art. 398 of the Polish Electronic Communications Law). When you sign up on the website we first send you an e-mail to confirm your address. If you tick the marketing box when you buy a web game, Paddle passes that choice to us and we add you to the list. You must be at least 16 years old.

Who receives it. Mailchimp (The Rocket Science Group LLC, part of Intuit, USA) as our processor.

How long. Until you unsubscribe (the link is in every e-mail) or write to us. After that we keep only the address on a suppression list so that you are not added again by mistake (legitimate interest). You can withdraw your consent at any time without affecting what happened before.

Buying web games (Paddle) and vouchers

Paddle

Our web games are sold through Paddle. Paddle is the merchant of record: it sells the game to you, takes your payment and handles payment security, VAT and refunds. For this, Paddle is an independent controller of your data (Paddle.com Market Limited, Paddle Payments Limited, Paddle.com Inc. and its other group companies). Your card details go to Paddle only; we never see them. Please read Paddle’s privacy notice.

What we receive from Paddle: your e-mail address, name, country, the order number, the price and tax details and whether you agreed to receive marketing from us. What we do with it: our system creates your access code and returns it to Paddle, which includes it in your receipt; we store the access code together with the order number (not with your e-mail) in our database. We use the data to deliver the game, to answer support questions and to prevent abuse (Art. 6(1)(b) and (f) GDPR). If you agreed to marketing at the checkout, we add your e-mail to our newsletter (see above). We keep the order data until the limitation period for claims related to the order ends.

Prices and the checkout. The pages where you can buy load Paddle’s script from Paddle’s servers and ask Paddle for the price in your currency, so Paddle receives your IP address and browser details when you open them. Other pages of the website do not contact Paddle.

Vouchers

If you redeem a voucher code on the Redeem page, you give us your e-mail address. We check the code, create an access code, store the e-mail address and the new access code with the voucher and send the access code to you by e-mail through Twilio SendGrid (processor). The basis is the contract about the game you got with the voucher (Art. 6(1)(b) GDPR). We do not add you to any marketing list. We keep this data until the limitation period for claims ends.

Web games

The browser versions of our games (Unboxing the mind of a Cryptic Killer at game.elevenpuzzles.com and Parallel Lab at lab.elevenpuzzles.com) work with the access code that you got when you bought or redeemed the game.

• What we collect: your access code (kept in a cookie for 3 hours so that you stay logged in), the name you type in, your team, your progress, a log of your actions in the game, whether you are online and your browser information (user agent). Rollbar receives technical data about errors in the game. Only if you agree, we also use Google Analytics for Firebase, which stores a random identifier in your browser, to understand how the game is used.
• Why and on what basis: to run the game and to let you and your teammates play together (Art. 6(1)(b) GDPR); for error reports, our legitimate interest in finding and fixing bugs (Art. 6(1)(f) GDPR); for analytics, your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law), which you can withdraw at any time in the game.
• Who sees it: your teammates see the name you chose. Google Firebase (USA) hosts the game and the data; Rollbar (USA) receives error reports.
• How long: while your access code is valid and afterwards for a limited time so that we can help you with support requests.

Please do not type your real name if you do not want your teammates to see it.

Love Box

Love Box lets you hide a message behind puzzles and send the link to someone by e-mail.

If you create a box (sender)

• What we collect: the e-mail address and password you register with (the password is stored only as a hash by Google Firebase Authentication), the message you write, and the dates you created and changed it.
• Why and on what basis: to give you the service you asked for (Art. 6(1)(b) GDPR).
• Who receives it: Google Firebase (login and database, USA) and Twilio SendGrid (sends the e-mail, USA). We do not read your messages; our administrators can technically access the database for support, to prevent abuse and to comply with the law.
• How long: a box and the copies you sent are deleted 24 months after the last change, or earlier when you click “Delete my account” on the Love Box page. That deletes your login, your message and every box you sent.

If someone sent you a box (recipient)

We got your e-mail address from the person who created the box, because they entered it. This is information under Article 14 GDPR. We use the address only once, to send you one e-mail with the link to the puzzle. We do not store the address and we do not use it for marketing or anything else. Our legal basis is our legitimate interest in delivering the message that the sender asked us to deliver (Art. 6(1)(f) GDPR). The e-mail is sent by Twilio SendGrid, which keeps delivery records for a short time. We do not tell you who the sender is.

Anyone who has the link can open the box, so do not forward it if you want to keep the message private. We record when a box is opened and when its puzzles are solved. You may object to this at any time and you may ask us to delete the box: write to privacy@elevenpuzzles.com and include the link from the e-mail.

The people who send boxes decide who gets them. Please send a box only to someone who will be happy to receive it. Love Box is for people aged 16 and over.

Community, social media, press and jobs

Social media and Discord

We have pages and communities on Discord, Facebook, Instagram, X and TikTok, and we publish videos on YouTube. When you interact with us there, the platform processes your data under its own policy. For the statistics of our Facebook and Instagram pages, Meta and we are joint controllers; Meta is responsible for the information about that processing and for your rights regarding it. We may read and answer what you write to us there, and we may share public posts about our games, with credit, on our channels.

Contests and surveys

Sometimes we ask you to send answers through a form (for example Google Forms). The form tells you what is collected. We use it to run the contest or survey, to contact winners and to send prizes (Art. 6(1)(b) GDPR) and delete the data when the contest is over, unless we need it to deal with claims.

Press, creators, partners and job applications

If you write to us as a journalist, a creator or a partner, we use your contact details and what you send us to answer you, to send review keys and to cooperate with you (Art. 6(1)(b) and (f) GDPR). We keep this correspondence for as long as the cooperation lasts and until the limitation period for claims ends.

If you apply for a job (for example at careers@elevenpuzzles.com), we use your application to run the recruitment. For an employment contract, we process the data that Art. 22¹ of the Polish Labour Code allows an employer to ask for to comply with that law (Art. 6(1)(c) GDPR), and any other data that you decide to include in your application on the basis of your consent (Art. 6(1)(a) GDPR), which you give by sending it. For a civil-law or B2B contract, the basis is the steps you ask us to take before concluding it (Art. 6(1)(b) GDPR). We keep applications for 6 months after the recruitment ends. If you agree that we consider you for future openings (Art. 6(1)(a) GDPR), we keep your application until you withdraw that consent.

Who receives your data

We do not sell your personal data and we do not share it for advertising. We share it only with the companies below and with authorities when the law requires it (for example a court or the tax office), or to protect our rights, our players or others. If our business is sold or reorganised, personal data may pass to the new owner, who must respect this policy.

Companies that work for us (processors)

They may use the data only on our instructions, under a data processing agreement.

Platforms and stores (independent controllers)

They receive your data when you use their services, and decide about it themselves, under their own privacy policies.

Transfers outside the EEA

Some of the companies above are outside the European Economic Area, and our game servers are placed in several parts of the world so that you get a good connection. When data leaves the EEA we make sure that it stays protected by using one of the safeguards required by the GDPR: a decision of the European Commission that the country is adequate, the EU–US Data Privacy Framework (for certified US companies) or Standard Contractual Clauses. Most US providers rely on both, so protection continues if one of them is invalidated. You can get a copy of the safeguards by writing to us.

Your rights

You have the following rights under the GDPR. To use any of them, write to privacy@elevenpuzzles.com. We answer within one month and do not charge for it. We may ask you to confirm who you are.

• Access: to know whether we process your data and to get a copy.
• Correction: to correct data that is wrong or incomplete.
• Deletion: to have your data deleted when we no longer need it, when you withdraw consent or when you object successfully. Love Box users can also delete their account on the Love Box page.
• Restriction: to ask us to pause the use of your data in some situations.
• Portability: to receive the data you gave us in a common format when we use it based on consent or a contract.
• Withdrawing consent: at any time, for example in the cookie settings or with the unsubscribe link, without affecting what happened before.

Complaints. You can complain to the supervisory authority. In Poland it is the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl. You can also complain in the EU country where you live or work. We would appreciate the chance to fix the problem first.

Children, security and other information

Children

Our games are for a general audience, but they do not ask for personal data and have no accounts, so children do not give us information beyond the technical data described in the section about our games. Our website services that require an e-mail address (Love Box, the newsletter and buying web games) are for people aged 16 and over, and we do not knowingly collect personal data from children under 13, or under 16 where the law requires a parent’s consent. If you are a parent and believe that your child has given us personal data, write to us and we will delete it.

Do you have to give us your data?

Nobody has to give us personal data to play our games on a store. For the services on our website the data that we ask for is necessary to provide them (for example an e-mail to receive a code); without it we cannot provide that service. Analytics, videos and the newsletter are always optional.

Automated decisions

We do not make decisions about you based only on automated processing that have legal or similarly significant effects. Choosing a game server near you based on your country does not have such effects.

Security

We protect personal data with encrypted connections (HTTPS/TLS) where they are supported, access limited to the people who need it, and the security features of our providers. No system is completely secure. If a breach puts your rights at risk, we will notify you and the authority as the law requires.

Residents of California and other US states

We do not sell your personal information and we do not share it for cross-context behavioural advertising. You can ask us what personal information we have about you, ask us to delete or correct it, and we will not treat you differently for doing so. Write to privacy@elevenpuzzles.com.

Changes and contact

We update this policy when our games, our website or the law change. The date at the top shows the latest version. If a change is important (for example a new way of using your data), we will say so on the website or by e-mail where we have your address and, if the law requires it, ask for your consent again.

Questions, requests, complaints: privacy@elevenpuzzles.com
Eleven Products Sp. z o.o., ul. Domki 14, 31-519 Kraków, Poland