Privacy policy
Who we are
Daily Classics is run by CoreDL d.o.o., a company registered in Zagreb, Croatia (II. Gajnički Vidikovac 14/2, 10090 Zagreb). Contact: [email protected]. We are the controller of the personal data described here. Servers are in the EU (Hetzner, Germany).
The short version
- You can play without an account, email or password: the app creates an anonymous player on first launch.
- Signing in (Apple, Google or email) is optional; it lets you use the same player on several devices.
- We keep what the game needs: a display name, an optional country and city for leaderboards, your timezone, and your game results.
- No ads, no tracking across apps or websites, no analytics or advertising SDKs, no sale of data. Our own servers count which app version you use, the days you open it, and the store or link that brought you.
- Leaderboards are public: they show your display name, country, city and points.
What we store and why
| Data | Where it comes from | Why | Legal basis (GDPR) |
|---|---|---|---|
| Random player ID and a hash of your device key | Created on first launch; the key stays on your device, we only keep its SHA-256 hash | To recognise your device without an account | Contract (providing the game) |
| Sign-in details (only if you sign in) | Apple or Google send us an account ID and usually your email address (Apple may give a private relay address); with email sign-in, the address you type | To recognise your account on each of your devices | Contract |
| Sign-in codes (email sign-in) | A 6-digit code we email you; we keep only a hash, for 10 minutes of use | To check that the address is yours | Contract |
| Display name | Generated ("Star 4821"); you can change it | Shown on leaderboards and league tables | Contract |
| Country and city | Suggested once at sign-up from the coarse location our network edge (Cloudflare) attaches to the request; you can change or clear them ("Prefer not to say") | Country and city leaderboards | Contract; you choose whether to keep them |
| Timezone | Your device setting | So "today" and reminders follow your local day | Contract |
| Game results and replays | Every ranked game: start and submit times, your moves, result, rank, points | To verify scores, rank days, run weekly leagues and stop cheating | Contract; legitimate interest (fair play) |
| Practice results | Game, difficulty, finished or not, time | To tune puzzle difficulty | Legitimate interest (game quality) |
| League history | Weekly tier, group, final place, promotions | Leagues and the week-end summary | Contract |
| Reminder setting and push token | Only if you turn on Daily reminder (iOS) | To send one reminder on days you have not played | Consent (you can turn it off in Profile) |
| Note of a lost reminder device | When Apple reports your push token gone (usually the app was uninstalled): your player, the platform and the date, not the token | To count uninstalls | Legitimate interest (running and improving the game) |
| App and install details | Your app sends its platform (iOS, Android or web) and version; we note each day it opens. Once, at first launch: the store it came from, the campaign tags of the link that opened it (such as utm_source or ref), the referring website (its address, not the page), Google Play's install referrer, and whether the device is a Google Play test device | To support the app versions in use and see which stores and links bring players | Legitimate interest (running and improving the game) |
| Server logs | Every request: IP address, time, path, status | Security and debugging | Legitimate interest |
We do not store your IP address with your player record. We never ask for your name, contacts, photos, precise location or advertising identifier, and we ask for an email address only if you choose email sign-in. We send email only for sign-in codes: no newsletters or marketing.
On your device
The app keeps your device key, a cached copy of your profile, your settings (sound, haptics, theme, reduced motion), a ranked game in progress (so it survives the app being closed), unsent results while offline, and a small cache of practice puzzles. Uninstalling the app removes them.
Who else handles data
| Provider | Role | Data |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting of servers and databases | Everything above |
| Cloudflare, Inc. | DNS, TLS and network edge in front of our servers | IP address and request metadata in transit; the coarse country/city header used once at sign-up |
| Apple (APNs) | Delivers reminder notifications on iOS, only if you opt in | Push token and the reminder text |
| Apple, Google | Sign in with Apple / Google, only if you use them | They confirm who you are to us; we receive the account ID and email they share |
| SMTP2GO (UK) | Delivers our sign-in code emails | Your email address and the code |
Each acts under a data processing agreement with us. Cloudflare may process data outside the EU under the EU Standard Contractual Clauses.
How long we keep it
- Player record, results and league history: as long as you keep playing, until you delete them in the app or ask us to.
- Server logs: until log rotation overwrites them, typically within 30 days.
- Push tokens: until you turn reminders off, uninstall, or Apple reports the token gone.
- Notes of lost reminder devices: kept for our uninstall counts; deleting your player removes the link to you.
Your rights
You can see and change your display name, country, city and reminder in the app (Profile). You can also ask us for a copy of your data, its correction or deletion, object to processing based on legitimate interest, or complain to your data protection authority. Write to [email protected] and include your player ID (Profile).
Profile → Settings → Delete my data (or Delete account once signed in) deletes your player at once: name, country, city, sign-in details, results, league history, leaderboard entries and push tokens, on every device. Practice statistics and notes of lost reminder devices are kept without any link to you. The app then starts over as a new player. Without the app, see https://dailyclassics.coredl.ai/delete-account.
Children
The game has no ads, chat or messaging and needs no contact details (email only if you choose email sign-in), so it is suitable for all ages. Display names are visible to other players; names and cities are checked against a list of offensive words, and you can report a name to [email protected]; we rename it.
Changes
We will post changes here and in the app's store listing, with the date of the latest version.
Last updated: 16 October 2026