Privacy Policy
Last updated: August 19, 2026
Data controller: Miguel Arechaga
Tax ID (DNI): 72083190-V
Website: https://mundosudoku.com
Contact email: contacto@mundosudoku.com
1. Purpose of processing
Personal data that may be collected through this website will be used to: respond to inquiries sent by email, statistically analyze site usage to improve it, and ensure the technical operation and security of the site.
2. Data collected
This website does not require registration to play. The data that may be collected includes:
- Contact data: if a user writes by email, their address and the content of the message will be processed solely to respond to them.
- Browsing data: through cookies and similar technologies, data such as IP address, device and browser type, pages visited and time spent may be collected (Google Analytics).
- Game data: when a sudoku is completed, our server records the variant, the difficulty, the time taken, the number of hints used and the date. This is used to calculate streaks, levels, missions, achievements and rankings, and to prevent falsified times. If the user has no account, this data is linked to a random identifier generated in their browser that does not identify them personally and that disappears if they clear the site data.
- User account (optional): registered users provide a username and a password. The username and avatar are public: they appear in the rankings, in the daily standings and next to comments on the daily sudoku. The avatar is not a photograph: it is a drawing generated by the site itself from the options the user chooses.
- Notifications (push): only if the user explicitly turns them on. Three items are stored: the notification address provided by their browser (a technical URL, not a personal identifier), their time zone and their language. Their name, email address and IP address are not stored. The date consent was given and the version of the text accepted are also kept. All of it is deleted as soon as notifications are turned off.
- Daily sudoku comments (optional): the text written and the username, both of which are public. Only registered users can comment. A comment may be hidden if several different users report it.
- Local preferences: language, visual theme, sound and board notes are still stored only in the user's browser (localStorage) and are not sent anywhere.
- Purchase data (only if MS Coins or the VIP Club are bought in Hotel MS): the public address of the wallet used to pay, the transaction signature, the amount in SOL and its equivalent in euros, the exchange rate, the date, and the declarations of legal age and acceptance of the terms. These are detailed in section 12. Playing is free and requires no purchase.
3. Legal basis
The legal bases for processing are: the user's consent (art. 6.1.a GDPR) for analytics cookies and for push notifications, which can be withdrawn at any time; the performance of a relationship when the user contacts us or creates an account (art. 6.1.b GDPR); and the controller's legitimate interest in maintaining and securing the website and in preventing the manipulation of times and rankings (art. 6.1.f GDPR). For purchases of MS Coins or the VIP Club, the legal bases are the performance of the contract (art. 6.1.b GDPR) and compliance with the controller's accounting and tax obligations (art. 6.1.c GDPR), as detailed in section 12.
Playing without an account requires no additional consent: games are recorded against a random identifier that cannot identify any person, so that users keep their own progress and rankings cannot be falsified.
4. Data retention
Data is retained only for as long as necessary to fulfill the purpose for which it was collected. Contact emails are kept until the inquiry is resolved. Analytics data is retained according to the periods configured in Google Analytics (maximum 26 months).
Game data (games, streaks, levels and achievements) is kept for as long as the account exists, because it is the user's own progress. For users without an account it is kept against their random identifier. The notification subscription is deleted as soon as the user turns notifications off, and also automatically once their browser stops accepting them. Comments are kept for as long as their author's account exists; once deleted, they stop being shown.
5. Advertising
This website does not use third-party advertising networks and sets no advertising cookies. The only advertisement that may appear — and only on the Spanish version of the site — is an own link, labelled as advertising in the footer, to tirasnasales.es, a project run by the same site owner: being a static link, it loads no third-party scripts or pixels and collects no user data.
6. Data sharing and international transfers
Personal data will not be shared with third parties except where legally required or necessary to provide the service. The provider used (Google Analytics) may involve international data transfers, covered by the corresponding standard contractual clauses.
7. Third-party services
This site uses the following third-party service: Google Analytics (usage statistics), which may use cookies, detailed in the Cookie Policy.
In addition, this site's contact form is sent through FormSubmit (Devro LABS), a service used solely to deliver messages to the contact email address. When that form is submitted, the name, email address, subject and message text entered by the user are transmitted to that provider, together with their IP address. It is not used for any other purpose and no other data is sent to it.
8. User rights
Users can exercise their rights of access, rectification, erasure, objection, restriction of processing and portability by emailing contacto@mundosudoku.com, indicating which right they wish to exercise. They also have the right to file a complaint with the Spanish Data Protection Agency (www.aepd.es).
9. Push notifications: what they are and how to turn them off
The site may send at most one notification a day, to point out that the daily sudoku is available or that a streak is about to be lost. It is a completely optional feature: it is only enabled from the user's profile and only after they explicitly accept.
Notifications are delivered through the notification service of the browser itself (Google, Mozilla, Apple or Microsoft, depending on the browser). The content of the message does not travel through those services: the notification handed to them is empty, and the text is requested by the user's own browser directly from our server at the moment it is displayed.
To stop receiving them, simply turn off the switch on the profile page, which deletes the subscription from our servers. They can also be blocked from the browser settings.
10. Public content: rankings and comments
Registered users appear with their username and avatar in the site's public rankings and in the daily standings. Comments on the daily sudoku are public and visible to any visitor, together with the username of whoever wrote them.
Anyone who does not wish to appear publicly can play without creating an account: their progress is still saved, but it does not appear in any public listing. A registered user can delete their own comments at any time, and request deletion of their account by writing to contacto@mundosudoku.com.
11. Minors
This website offers content suitable for all audiences and does not knowingly collect personal data from children under 14. If a parent or guardian discovers that a minor has provided personal data, they may request its deletion by email.
12. Purchases in Hotel MS: card and crypto payments
This section applies only to users who buy MS Coins or the VIP Club membership inside Hotel MS. Entering the hotel, playing and earning MS Coins by playing are free and involve none of this processing.
There are two ways to pay. By card or other electronic means, through the Stripe payment gateway: the payment form is served and processed by the provider itself, and card details never pass through this site. Or with crypto, on the Solana network, directly between the user's wallet and the site owner's address, with no gateway in between.
Data recorded when paying by card:
- The username receiving the MS Coins or the membership, and the product purchased.
- The payment session and charge identifiers assigned by the payment service provider.
- The amount in euros and the date and time of the request and of the payment confirmation.
- The two declarations the user ticks before buying: that they are over 18 and that they accept the terms of sale.
- If a refund or chargeback occurs: its date, its amount and the payment it relates to.
The card number and its other details are received directly by the payment service provider: they do not reach this site, are not processed here and are not stored here. Any email address the user enters on the payment screen is processed by that provider under its own privacy policy.
Data recorded when paying with crypto:
- The username receiving the MS Coins or the membership, and the product purchased.
- The payment's reference address: a public key generated by the site to identify that specific purchase.
- The public address of the wallet used to pay and the transaction signature (hash) on the network.
- The amount in SOL and in lamports, its equivalent in euros, the exchange rate applied and the source of that quote.
- The network used and the date and time of the request and of the payment confirmation.
- The two declarations the user ticks before buying: that they are over 18 and that they accept the terms of sale.
Purpose: to perform and evidence the purchase, deliver the product, handle claims and refunds where applicable, prevent duplicate or fraudulent charges, and comply with the owner's accounting and tax obligations.
Legal basis: performance of the purchase contract (art. 6.1.b GDPR); compliance with legal accounting and tax obligations (art. 6.1.c GDPR); and the legitimate interest in preventing fraud and duplicate charges (art. 6.1.f GDPR).
Retention: payment records are kept for the tax and commercial limitation periods applicable to the owner, which may reach six years from the transaction, even if the user deletes their account. After that period they are erased.
Recipients: for card payments, the data needed to process the charge is disclosed to Stripe Payments Europe, Limited (and, for regulated payment services, Stripe Technology Europe, Limited), domiciled in Ireland, which acts as an independent controller of the payment data and processes it under its own privacy policy. For crypto payments, to check that a payment has arrived, the Solana network is queried through a node provider, which receives the reference address and the transaction signature — data that is already public on the network itself. To calculate the equivalent in euros, the price of SOL is requested from external providers (CoinGecko and, failing that, Kraken); no user data is sent to them: only the price is requested.
What the blockchain makes public and permanent. This applies only to crypto payments. A Solana transaction is public, immutable and irreversible by design: the wallet address, the amount and the date are written to the network and anyone can look them up. The owner of this site cannot delete, rectify or undo them, because he does not control the network. The rights to erasure and rectification may be exercised over the data held on our servers, subject to the legal retention obligations mentioned above, but not over what is already written on the blockchain. This is worth bearing in mind before paying from a wallet the user associates with their identity.
Legal age. Purchases are reserved for users over 18, and that declaration is recorded alongside the payment. If a purchase is found to have been made by a minor, the terms of sale of MS Coins will apply, and the matter will be handled with the parent or legal guardian through contacto@mundosudoku.com.
13. Security
Technical and organizational measures have been adopted to protect personal data, including encrypted browsing via HTTPS across the entire site.
14. Changes to this policy
This policy may be updated to reflect legal or technical changes. The date of the last update appears at the top of this page.