Privacy Policy
Last updated: 24 October 2026
This policy explains what personal data SymmetriCat collects, why, who receives it, how long we keep it, and what rights you have. You can play the daily puzzles without an account. Most of what is described below only applies if you create one.
1. Who is responsible
The data controller is Ekling AS (organisation number 920 765 769), Wessels gate 5, 0165 Oslo, Norway, which operates SymmetriCat. For any privacy question or request, contact us at hello@symmetricat.com.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account data: email address and a password (stored only as a secure hash by our authentication provider). If you sign in with Google or Facebook: the email address, name and profile picture link that they share with us. | Create and secure your account and let you sign in. | Contract (providing the service) |
| Username and profile picture: the username you choose, and a profile picture link if your sign-in provider supplied one. | Identify you on leaderboards. Your username, picture and solve times are visible to other players. Do not use your real name if you do not want it shown. | Contract |
| Game data: solve times, puzzle progress, daily streak and last puzzle date, PawPoints balance and transaction history, puzzle packs you own, and logs of pack purchase attempts. | Run the game, leaderboards, streaks, rewards and the PawPoint shop, and investigate problems with purchases. | Contract; legitimate interest in keeping the game fair and working |
| Time zone: your browser's time zone is sent when you complete a puzzle or open the site while signed in. | Work out your local calendar day for streaks. | Contract |
| Technical data: IP address and request details, which our hosting providers record in their server logs. | Deliver the site, protect it against abuse and fix errors. | Legitimate interest in security and reliability |
| Staff access data: IP addresses of administrators who may use the internal editing tools. | Restrict administration to approved locations. | Legitimate interest in security |
| Messages you send us: emails to hello@symmetricat.com. | Answer you and handle your requests. | Legitimate interest; legal obligation for privacy requests |
We do not collect your date of birth, address or payment details. We do not sell personal data.
3. Cookies and similar storage
SymmetriCat currently uses only strictly necessary browser storage:
- Your sign-in session, so you stay signed in (set by our authentication provider).
- Your puzzle progress and the date you last visited, so unfinished puzzles can be restored.
We do not use analytics or advertising cookies today, so no consent banner is shown. We plan to show advertising in the future. Before any advertising or analytics technology that is not strictly necessary is used, we will update this policy and ask for your consent first. You will be able to change your choice at any time.
4. Who receives your data
We use the following service providers (processors) that handle personal data on our behalf:
| Provider | Purpose |
|---|---|
| Supabase | Database and user authentication |
| Railway | Hosting of our application server |
| Netlify | Hosting of the website |
| Amazon Web Services (Amazon SES) | Sending account and support emails |
| esm.sh and jsDelivr | Content delivery networks that serve code libraries to your browser. They can see your IP address when you load the site. |
If you choose to sign in with Google (Google LLC) or Facebook (Meta Platforms Ireland Limited), that provider processes your data under its own privacy policy, and shares your email, name and picture with us. We do not post anything to your account.
We only share data with authorities when the law requires it.
5. Transfers outside the EEA
Our database and authentication data are stored in the EU (Ireland). Some of our other providers are based in or process data in the United States. Where data leaves the EEA we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework. You can ask us for details using the contact address above.
6. How long we keep data
- Account and game data: for as long as your account exists. When you ask us to delete your account, we remove your account, profile, solve times, progress, PawPoints and purchase history within 30 days.
- Server logs: kept by our hosting providers for short periods under their standard retention settings.
- Emails to us: kept as long as needed to handle your request, and normally no longer than 12 months afterwards.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent at any time, where processing is based on consent.
To use these rights, follow the steps on our data requests page. We reply within one month. You also have the right to complain to the Norwegian Data Protection Authority (Datatilsynet) or to the authority in your own country.
8. Children
SymmetriCat is not meant for children under 13, and we do not knowingly collect their data. If you believe a child has created an account, contact us and we will delete it.
9. Security
Data is encrypted in transit. Access to personal data is limited to the people who need it. Passwords are never stored in readable form.
10. Changes to this policy
If we change this policy in a way that matters to you, we will update the date above and, where required, tell you in advance or ask for your consent.