Privacy Policy
Effective 24 October 2026
1. Who we are
Pikro is the website nonogram.pikro.club and Android and iOS apps with nonogram (picture logic) puzzles. The controller of personal data is the owner of the Pikro service. For any question about your data, write to the developer email on Pikro’s Google Play or App Store page.
The Pikro server is located in the European Union.
2. You can play without an account
Without signing in, Pikro does not know who you are: your progress and settings are kept only on your device. An account lets you keep progress on the server and move it between devices, take part in rankings, play with friends, publish your own puzzles and make purchases.
3. What we process and why
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address; password — only as a hash held by our processor Supabase | signing in; sign-in, confirmation and recovery emails | performance of a contract, Art. 6(1)(b) |
| Progress: solved puzzles, stars, time, hints, daily streak, quests, XP, leagues, tournaments, unlocked packs, board theme, language | running the game and syncing between devices | Art. 6(1)(b) |
| Your own puzzles and scans: clues, cells, colours, title | puzzle library | Art. 6(1)(b) |
| Friends: friend code, the name you set, shared streak, nudges | playing with friends | Art. 6(1)(b) |
| Puzzles you publish, likes, follows, reports | community | Art. 6(1)(b) |
| If you allowed it (the iOS app): how much of a purchase has been used — the share of a pack's puzzles begun or solved, of hints and freezes spent | telling Apple when you ask for a refund, so that Apple decides fairly | consent, Art. 6(1)(a); withdrawn in “Settings → Account” |
| Purchases: product, date, subscription period, the purchase number of the app store or Stripe; for purchases on the website — your customer number at Stripe | giving what you bought, and never twice | Art. 6(1)(b) |
| Photo of a puzzle | reading its clues | Art. 6(1)(b) |
| Server access log: IP address, time, requested path, browser type | security and troubleshooting | legitimate interests, Art. 6(1)(f) |
| Daily usage counter: per account, or without an account per hash of the IP address (the address itself is not kept) | free-plan limits, abuse prevention | Art. 6(1)(f) |
| Email address of a blocked account | preventing a ban from being bypassed | Art. 6(1)(f) |
Puzzle photos are processed in the server's memory and are not stored; only the recognised clues and grid are kept, if you save the puzzle. In Settings you can choose on-device processing, in which case the photo is not sent anywhere.
We do not use your data for advertising, do not sell it, and do not make automated decisions with legal effects on you.
4. What other players see
- In rankings (leagues, tournament, daily puzzle) — not your email but a mask of it: its first one or two letters and “•••”.
- Friends see the name you set (or the same mask), whether you solved today, and your shared streak.
- In the community — puzzles you published, signed “@mask”.
5. Storage on your device
Pikro does not use cookies. The website and apps keep in browser storage (localStorage, sessionStorage, service worker cache) only what is needed to work: your sign-in key, progress, own puzzles, settings (theme, language, sounds, reminders, game rules), “tip already shown” flags and files for offline use. There is no analytics, advertising or third-party tracking, so no cookie consent banner is shown: this storage is strictly necessary for the service you requested. You can remove it by clearing site data in your browser or by uninstalling the app.
The apps ask for camera and photo access only to take or pick a picture of a puzzle, and schedule reminders as local notifications on the device itself.
6. Who else receives data
- Server hosting in the EU — all data in section 3, only to run the server.
- Supabase Inc. — sign-in: email, password hash, sign-in emails, IP addresses of sign-in requests. Supabase is a US company; transfers are covered by the EU Standard Contractual Clauses.
- Google and Apple — when you buy in the app: the store handles the payment under its own terms, and we verify the purchase with it. Instead of your email the store gets an anonymous tag of the account from us. With a purchase the app asks Google (Play Integrity) or Apple (App Attest) to confirm that the request comes from the genuine Pikro app — a protection against hacked copies; the store itself processes the data about the device, and we keep only a note of the result in the log of purchases. If you ask Apple for a refund and allowed it in the app, we tell Apple how much of the purchase has been used; Apple receives nothing else. Requests about what Apple keeps go to privacy.apple.com.
- Stripe (Stripe Payments Europe, Ireland) — when you pay on the website: your account's email (for the receipt), an anonymous tag of the account and what you buy; you enter card and other payment details directly on Stripe's page, Pikro never receives them. For payment data Stripe is also responsible itself (fraud prevention, legal duties) — under its own privacy policy.
Processors use the data only on our instructions (GDPR Art. 28).
7. Retention
- Your account and everything linked to it — while the account exists; deleted immediately when you delete the account, including at Supabase.
- Sign-in: a session lasts 180 days from your last visit and is then deleted; a sign-in code — 15 minutes.
- Daily usage counters — 7 days.
- Server access log — until it reaches 30 MB, then the oldest entries are erased.
- Email of a blocked account — while the block is in force.
- The store's purchase number is kept after the account is deleted, without your email or other data about you, so that one purchase cannot be given twice. Payment records are kept by the app store, and for website purchases by Stripe, as long as accounting and tax law requires (5 years in Poland), even after the account is deleted.
- Data on your device — until you remove it.
8. Your rights
You may access your data and receive it in a machine-readable format, rectify it, erase it, restrict or object to its processing (GDPR Art. 15–21).
- Delete your account — in the app: “Profile → Settings → Delete account”, or as described on the Account deletion page.
- A copy of your data, changing your email and other requests — write to the developer email on Pikro’s Google Play or App Store page from the account's address; we reply within one month.
If you believe we infringe your data rights and we have not resolved it ourselves, you may complain to a public data protection authority — in the country where you live, or in Poland: the President of the Personal Data Protection Office (uodo.gov.pl).
9. Security
Connections are encrypted (HTTPS). Sign-in keys and codes are stored on the server only as hashes; the password is stored by Supabase as a hash. Only the administrator has access to the server.
10. Changes
We will announce changes to this policy in the app. The date of the latest change is shown at the top.