Puzzle Collector

Privacy Policy

Last updated 2026-06-18

Puzzle Collector ("we," "our," or "us") makes a mobile-first app for cataloging jigsaw puzzles. This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and the choices and rights you have. It applies to puzzlecollector.com, its subdomains, and the Puzzle Collector application (together, the "Service").

We've written this in plain language. If anything is unclear, email us at support@puzzlecollector.com.

The short version

  • We collect what we need to run the app: your email, your name, the puzzle data and images you add, and a one-time approximate location at signup.
  • We use a small set of trusted service providers (Supabase, Vercel, Resend, Anthropic) to operate the Service.
  • We do not sell your data, show you ads, or use third-party analytics or tracking cookies.
  • Your collection is private to you unless you choose to share it.
  • You can edit or delete your data and email us to exercise your privacy rights.

Who we are

Puzzle Collector is operated from the United States and is the data controller for the personal information described here. You can reach us at support@puzzlecollector.com.

Information we collect

Information you give us

  • Account details: your email address and your name (last name optional).
  • Your collection: the puzzle information you choose to enter or import — titles, brands, piece counts, photos you upload, tags, notes, ratings, and any optional details you add such as purchase price, source, or storage location.
  • Preferences: settings such as your email opt-in choice, whether your collection is shared publicly, custom field labels, and units.
  • People you invite: if you lend a puzzle or invite a friend, you give us that person's email address so we can send them the relevant invitation or notification.

Information collected automatically

  • Approximate location at signup: when you confirm your account, we record an approximate city/region/country derived from your IP address (provided by our hosting platform). This is a one-time snapshot for understanding where our community is — it is not continuous location tracking.
  • Authentication: we use passwordless "magic link" sign-in. We do not create or store passwords. A secure session cookie keeps you signed in.
  • Basic technical data: standard server logs needed to operate and secure any web service. We do not run third-party analytics, advertising, or tracking technologies.

We do not currently collect payment information — paid subscriptions are not yet live. When they launch, this policy will be updated to describe our payment processor.

How we use your information, and our legal bases

For users in the EEA, UK, and Switzerland, the GDPR legal basis for each use is noted in brackets.

  • To provide the Service — create your account, store and display your collection, support sharing and lending. [Performance of our contract with you]
  • Transactional email — sign-in links, lending and return notifications, and account messages. [Contract / legitimate interests]
  • Onboarding and product update emails — only if you have opted in; you can unsubscribe at any time. [Consent]
  • Security and abuse prevention — rate limiting, protecting accounts, preventing misuse. [Legitimate interests]
  • Improving the product — understanding aggregate usage and fixing problems. [Legitimate interests]
  • Legal compliance — when we are required to retain or disclose information by law. [Legal obligation]

We do not sell your personal information, and we do not use it for third-party advertising.

The AI import feature

If you choose to import a puzzle from a web link, we fetch the contents of that page and send the page text to Anthropic (the maker of Claude) to extract structured details like title, brand, and piece count. We send the page content for that import only — not your account or collection data. Under Anthropic's API terms, this content is not used to train their models. Results are cached to avoid re-processing the same link.

Service providers we share information with

We share personal information only with the providers that help us run the Service, each under a data processing agreement and only as needed to perform their function:

  • Supabase — database, authentication, and file/image storage (hosted in the United States).
  • Vercel — application hosting and content delivery; also provides the approximate-location headers described above.
  • Resend — sending transactional and opted-in email.
  • Anthropic — the AI import feature described above.

We maintain a current list of these subprocessors and will update it as it changes. Beyond these providers, we share your information only: (a) with other people when you choose to — for example by making your collection public, lending a puzzle, or inviting a friend; (b) if required by law or to protect the rights and safety of our users or the public; or (c) as part of a business transfer (merger, acquisition, or sale), in which case the recipient must honor this Policy.

Sharing you control

Your collection is private to you by default. It becomes visible to others only through deliberate actions you take — publishing a public collection link, lending a puzzle to someone you invite, or sharing specific details. You can turn public sharing off at any time in Settings.

International data transfers

We are based in the United States and our providers store and process data in the United States. If you access the Service from the EEA, UK, or Switzerland, your information is transferred to the US. Where required, these transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the EU–US Data Privacy Framework where the provider participates.

How long we keep your information

We keep your information while your account is active. When you delete your account, we remove your personal information from our active systems promptly, and it ages out of routine backups within 90 days. We may retain limited information longer where we are legally required to.

Your privacy rights

Depending on where you live (including under the EU/UK GDPR), you have rights to:

  • Access a copy of the personal information we hold about you.
  • Correct inaccurate information — you can edit your name and account details directly in Settings.
  • Delete your account and personal information.
  • Port your data — receive a copy of your collection in a portable format.
  • Restrict or object to certain processing.
  • Withdraw consent — turn off marketing email any time via the unsubscribe link or your Settings; this doesn't affect transactional messages needed to run your account.

You can manage your profile and email preferences in Settings, export a copy of your collection yourself from Settings → Export my data, and permanently delete your account and all of your data yourself from Settings → Delete account. For any other data we hold about you, email support@puzzlecollector.com and we will action your request. We will not discriminate against you for exercising any of these rights. EEA/UK users also have the right to lodge a complaint with their local data protection authority.

Email choices

We send transactional emails (sign-in links, lending and account notifications) because they're needed to operate your account. We send onboarding and product-update emails only if you've opted in, and every such email includes an unsubscribe link. We never send unsolicited marketing.

Cookies and local storage

We use a small number of strictly necessary cookies and browser storage:

  • Authentication cookies set by Supabase to keep you securely signed in.
  • Local storage for interface preferences (for example, your view and display settings).

We do not use advertising, analytics, or third-party tracking cookies — so there's no cookie-consent banner to click through. You can block cookies in your browser, but the Service may not function correctly (for example, you may not be able to stay signed in).

How we protect your information

We encrypt data in transit (HTTPS/TLS) and at rest through our hosting providers, and we limit access to personal information. No method of transmission or storage is ever completely secure, so we cannot guarantee absolute security, but we work to protect your information and respond promptly to any issues.

Children

The Service is not directed to children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

California residents

If you are a California resident, the CCPA/CPRA gives you the right to know what personal information we collect and how we use it (described above), to access and delete it, and to not be discriminated against for exercising your rights. We do not sell your personal information and do not share it for cross-context behavioral advertising. To exercise these rights, contact us at support@puzzlecollector.com.

Changes to this policy

We may update this Policy to reflect changes to the Service or the law. When we do, we'll revise the "Last updated" date above, and for material changes we'll provide a more prominent notice. If you don't agree with an update, you can delete your account.

Contact us

Questions about this Policy or your data? Email support@puzzlecollector.com.