Privacy policy

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

See also the legal notice (Impressum). We are not required to appoint a data protection officer.

2. Overview

What we process, why, and on which legal basis. Details follow in the sections below.

3. Hosting and server logs

BeeHints is hosted by Vercel Inc., USA. Our server functions run in Vercel's region iad1 in the United States. When you open a page, your browser sends technical data that Vercel receives and logs: your IP address, browser and device type (user agent), date and time, and the address of the page requested. This is needed to deliver the pages and to protect the site against attacks and misuse. Vercel keeps these logs for a limited time set by Vercel.

Legal basis: our legitimate interest in a secure, working website (Art. 6 (1) (f) GDPR). Vercel processes the data on our behalf under a data processing agreement and is certified under the EU-US Data Privacy Framework (section 12). More in Vercel's privacy policy.

The daily puzzle data is stored in a Neon Postgres database (Neon, hosted on Amazon Web Services in the US East region). It contains only puzzle letters, words and hints, no personal data. Our fonts are hosted on our own server, so your browser makes no requests to Google Fonts or other font services.

To count visits, we use Vercel Web Analytics. For each page view it records the page address, the referring website, the approximate location (country, region, city), and the device, operating system and browser type. It sets no cookies and stores nothing on your device. Instead of an ID, Vercel uses a hash of the request that is discarded after 24 hours, so a visit cannot be linked to a person or followed across sites. The script runs on our own domain. Legal basis: our legitimate interest in knowing how the site is used (Art. 6 (1) (f) GDPR). Details in Vercel's Web Analytics privacy notes.

4. Stored only in your browser

BeeHints uses your browser's local storage (not cookies) for things you ask the site to remember:

• your theme choice (light, dark or system);
• your cookie choice (section 5);
• your progress and stats in the unlimited game;
• the words you have ticked off in the word tracker;
• the hints you have revealed;
• copies of pages, scripts and word lists you have opened (the app cache of our service worker), so the site loads fast and the games work offline.

This data stays on your device and is never sent to us. You can delete it at any time by clearing this site's data in your browser settings. This storage is strictly necessary to provide features you asked for (section 25 (2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). The list of entries is in our cookie policy.

5. Cookie consent

When we use analytics, a banner asks whether you allow them. Analytics stay off until you choose "Accept all" or switch on "Analytics" in the settings. "Reject all" is just as easy. If your browser sends a Global Privacy Control signal, we treat that as a no and do not ask; you can still opt in under Cookie settings.

Your choice and the time you made it are saved in your browser's local storage under the key bh-consent-v1, so we do not ask again on every page. After 12 months we ask again. Saving the choice is strictly necessary (section 25 (2) no. 2 TDDDG) and serves our duty to respect and prove consent (Art. 6 (1) (c) and Art. 7 (1) GDPR).

You can change or withdraw your consent at any time, with effect for the future: Cookie settings. The link is also in the footer of every page.

6. Microsoft Clarity (only after your consent)

If you accept analytics, we use Microsoft Clarity, a service of Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, and its parent Microsoft Corporation, USA. Clarity shows us heatmaps and session recordings, so we can see where people get stuck and make pages easier to use. Without your consent, the Clarity script is not loaded at all.

What is processed

How you interact with our pages (clicks, taps, scrolling and mouse movement), the pages you view, device and browser information, and a pseudonymous identifier. Microsoft also receives your IP address when the script loads. Clarity masks text you type in input fields by default, so it is not recorded. Clarity sets cookies such as _clck, _clsk, CLID, ANONCHK, MR, MUID and SM; see the cookie policy.

Legal basis and withdrawal

Your consent (Art. 6 (1) (a) GDPR; for cookies and access to your device section 25 (1) TDDDG). You can withdraw it at any time under Cookie settings. We then tell Clarity to stop and delete its cookies, and the script is not loaded again.

Storage and transfer

Data may be processed in the USA. Microsoft is certified under the EU-US Data Privacy Framework (section 12). According to Microsoft's Clarity documentation, session recordings are kept for 30 days and heatmap and dashboard data for 9 months, then deleted. More in the Clarity data retention notes and the Microsoft privacy statement.

7. Google Search Console

We use Google Search Console, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, to see how BeeHints appears in Google Search: which searches show our pages, how often they are clicked, and whether Google can crawl the site. To prove that we own the site, our pages contain a verification meta tag. This tag is only text: it loads no script, sets no cookies and sends nothing about you to Google.

Google sees search data from its own search engine, under its own privacy policy, not data about visitors on our site. We only see summary figures. Legal basis: our legitimate interest in understanding and improving how people find the site (Art. 6 (1) (f) GDPR). More in the Google privacy policy.

8. When you email us

If you write to hello@beehints.com, we use your email address, your name if you give it, and your message only to answer you. We delete them when your request is settled, unless we must keep them by law. Legal basis: Art. 6 (1) (b) GDPR when your message is about a contract or request, otherwise our legitimate interest in answering (Art. 6 (1) (f) GDPR).

9. Links to our social profiles

We link to our profiles on Facebook, YouTube (handle @beehints). These are plain links: nothing from these networks is embedded or loaded on our pages, so no data goes to them unless you click a link. Once you are on a network, its own privacy policy applies.

10. Word clues from the Free Dictionary API

Some word clues come from the Free Dictionary API (dictionaryapi.dev). Our server fetches them, never your browser, and the requests contain only the word, no data about you.

11. What we do not do

No advertising, no ad tracking, no accounts or sign in, no newsletter, no contact forms and no social media plugins. If we add any of these later, we will update this policy first and ask for consent where needed.

12. Transfers to the USA

Vercel (hosting) and, only after your consent, Microsoft (Clarity) may process data in the USA. Both are certified under the EU-US Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023 (Art. 45 GDPR). Where a transfer is not covered by the framework, the providers use the EU Standard Contractual Clauses (Art. 46 (2) (c) GDPR).

13. How long we keep data

• Server logs: for a limited time set by Vercel, for security and operation.
• Local storage: until you clear it in your browser; your cookie choice for 12 months.
• Clarity: recordings 30 days, heatmaps and dashboard data 9 months, as stated by Microsoft.
• Emails: until your request is settled, longer only where the law requires it.

14. Your rights

Under the GDPR you have the right to:

• access the data we hold about you (Art. 15);
• have wrong data corrected (Art. 16);
• have your data deleted (Art. 17);
• have processing restricted (Art. 18);
• receive your data in a common, machine-readable format (Art. 20);
• withdraw consent at any time, with effect for the future (Art. 7 (3));
• object to processing based on our legitimate interests, on grounds relating to your situation (Art. 21).

To use any of these rights, email hello@beehints.com. Note that we cannot see data that only exists in your browser; you can delete it there yourself.

15. Right to complain

You can complain to a data protection supervisory authority (Art. 77 GDPR), in particular in the EU country where you live or work. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg), Stuttgart, Germany, baden-wuerttemberg.datenschutz.de.

16. Privacy rights for US visitors

We do not sell or share personal information, as those terms are used in the California Consumer Privacy Act as amended by the California Privacy Rights Act (CCPA/CPRA), and we do not use it for targeted advertising. We honor the Global Privacy Control signal: if your browser sends it, analytics stay off unless you explicitly opt in. Residents of California and other US states with privacy laws can ask to know, correct or delete their personal information by emailing hello@beehints.com. We will not treat you differently for using these rights.

17. Children

BeeHints is not directed at children under 13, and we do not knowingly collect personal information from them, in line with the US Children's Online Privacy Protection Act (COPPA). If you believe a child has sent us personal information, email us and we will delete it.

18. Other points

We do not use automated decision making or profiling under Art. 22 GDPR. You are not obliged to give us any personal data: every page, the game and the solver work without it. Only answering an email needs your email address.

19. Changes to this policy

We update this policy when the site or the law changes. The date at the top shows the current version.