@SoulsDokuCollectionSettingsBuy me a coffee
Legal

Privacy Policy

The short version: SoulsDoku is free and fully playable without an account — your progress lives in your own browser. If you choose to create one, we store your email address and mirror that progress so it follows you between devices. Community puzzle statistics are collected anonymously, reminders are opt-in, and we use Google Analytics to see how the site is used. Advertising pays the running costs — section 9 says exactly what our ad partner receives, and you can turn personalised ads off at any time.

Last updated: August 23, 2026

1. Who we are

SoulsDoku ("we", "us") is a free, fan-made daily puzzle game available at this website. This policy explains what data is involved when you play, where it lives, and the choices you have. Questions are always welcome via the Contact.

2. Data stored on your device

SoulsDoku keeps your game data in your browser's localStorage. This includes:

  • Puzzle progress, guesses, streaks, and statistics
  • Preferences such as language, display settings, and game configuration

Signed out, this data stays on your device and does not follow you across devices; clearing your browser's site data erases it permanently. If you sign in, a copy is also mirrored to your account — that is section 4, and the rest of what reaches our servers is described in the sections after it.

3. Accounts

An account is optional — every mode is fully playable signed out, and it exists for one reason: to carry your progress between devices. If you sign up with an email address, we store that address and a password we never see, because authentication is handled by Supabase and only a hashed form of the password is kept. If you sign in with Google or Discord instead, we receive the email address and account identifier those services return, and nothing beyond that basic profile — your password for them is never shared with us.

Accounts live in a database shared by the games in our Doku network, so a single sign-in can work across them, and we record which site an account was created on. We never ask for your name, age, address, or payment details — there is nothing here to pay for.

4. Progress synced to your account

While you are signed in, the game mirrors the data listed in section 2 — completed puzzles, streaks, souls, level, and preferences — to a single row belonging to your account, and merges it back when you sign in on another device. It is gameplay data only: no message content, no contacts, nothing about you beyond how you have played.

Database rules confine every read and write to your own row, so no other player can reach it and no part of the site reads it on someone else's behalf. Signing out clears that browser's local copy.

5. Community puzzle statistics

To power the community statistics shown after a puzzle (for example, "42% of players picked this boss"), the site submits your completed daily-puzzle picks to our database together with a random anonymous identifier stored in your browser. That identifier is a randomly generated string — it is not derived from your identity, it is not attached to your account even when you are signed in, and it exists only so the same device is not counted twice for the same day.

6. Notifications

Daily and streak reminders are off until you turn them on and your browser grants permission. Turning them on stores the push subscription your browser issues — an address for that browser plus the two keys needed to encrypt a message to it — along with your current streak, the day of your last completed daily, your time zone offset, whether you chose the morning or evening bonfire, and your account identifier if you are signed in. That is what decides who receives a reminder and when; it identifies a browser, not a person.

Turning reminders off in Settings, or revoking notification permission in your browser, stops them. Subscriptions the browser reports as gone are deleted automatically, and you can ask us to delete yours at any time.

7. Bug reports and feature requests

If you send a bug report or a feature request, we store what you wrote, the page you sent it from, your browser's user-agent string, any contact detail you chose to add, and your account identifier if you are signed in. It is used to reply to you and to fix or build the thing you raised, nothing else. Your IP address is used only to rate-limit the form against spam and is not stored with the report.

8. Server logs

Like virtually every website, our hosting infrastructure may automatically record standard technical logs (such as IP address, browser type, and pages requested) for security and reliability purposes. These logs are not used to identify or profile you and are retained only as long as the hosting provider's standard practice requires.

9. Cookies, analytics & advertising

We use Google Analytics to understand how the site is used — pages visited, approximate region, and device type.

We also send Google Analytics a small set of product events: that a puzzle was started, finished, given up on or shared, which mode it was, how many guesses it took, which buttons were used, that a sign-in or sign-up happened and by which method, and that a reminder was offered or a notification opened. These describe the session, not the person — they carry no name, email or account id, and they are never used to build a profile of you.

If you sign in, your browser also holds a session cookie that keeps you signed in and lets our servers recognise your account. It is strictly necessary for the account to work, carries no advertising purpose, and is cleared when you sign out.

Google Analytics sets cookies (the _ga family) to distinguish visitors; see Google's privacy policy for how Google processes this data. You can block these cookies with any content blocker or your browser settings, and the game works exactly the same without them.

SoulsDoku is free to play because advertising pays for it. The ads are sold and served by NitroPay, the advertising arm of Overwolf, which runs a real-time auction across third-party ad exchanges for every slot on the page. We do not pick the ad you see, and no advertising partner is given your email address, your account, or anything you type into the site.

To run that auction your browser sends the exchanges what any ad request carries: your IP address, your user agent and the characteristics of your device and browser, an approximate location derived from that IP address, the page you are on, and whether an ad was shown or clicked. Where you have agreed to it — or where local law allows it without agreement — that data can also be used to choose ads based on your interests, to limit how often you see the same one, to measure campaigns, and to detect fraud. Advertising partners may set their own cookies, or read identifiers already on your device, for those purposes.

In the European Economic Area, the United Kingdom and Switzerland, NitroPay's IAB-registered consent tool asks before any of that happens and stores your answer on your device. You can change it whenever you like through the consent link at the bottom of every page. Refusing is a real choice: the game plays identically and you simply see ads that are not personalised.

The full list of advertising vendors, and the purpose each one asks permission for, is shown inside that tool. NitroPay's own privacy policy explains what it does with the data as a company. If you live in California, section 13 sets out a separate opt-out that does not depend on this consent tool.

10. Who else handles this data

The list of companies involved is deliberately short:

  • Vercel — hosts the site and serves every page
  • Supabase — stores accounts, synced progress, pick statistics, notification subscriptions, and feedback
  • Google Analytics — the usage measurement described above
  • Resend — delivers account emails such as confirmation and password-reset links
  • Google and Discord — only if you choose to sign in with them

Vercel, Supabase, Google Analytics and Resend act as service providers on our behalf, and none of them is given your data for its own advertising. Advertising is the exception: NitroPay and the exchanges it auctions to receive the ad-request data described in section 9 and use it for their own purposes, which is why section 13 treats that as a sale and a share under California law. Data may be processed in the United States, where these providers operate.

11. Children

SoulsDoku is suitable for a general audience and does not knowingly collect personal information from children under 13. The game is fully playable without an account, which is the only place personal information enters at all. If you believe a child under 13 has created an account here, contact us and we will delete it.

12. Your rights & your data

Depending on where you live (for example under the GDPR or CCPA), you may have rights to access, correct, or delete personal data. Signed out, everything is on your device: clear this site's data in your browser settings and your progress and the anonymous identifier are gone, so nothing new we hold can be associated with that device.

If you have an account, there is no self-service delete button yet: email us and we will delete the account along with its synced progress, its notification subscriptions, and any feedback attached to it, and confirm when it is done. You can also ask for a copy of what we hold about you, or for the pick submissions tied to your anonymous identifier to be removed.

13. California privacy rights

If you live in California, the CCPA — as amended by the CPRA — gives you specific rights over the personal information described above. This section is written for you, and everything in it is in addition to the rest of this policy.

In the last twelve months the site has collected these categories of personal information:

  • Identifiers — an email address and account id if you create an account, a random identifier stored in your browser so anonymous puzzle statistics are counted once, and the IP address that every web request carries
  • Internet or network activity — the pages you visit, the puzzles you start, finish, give up on or share, the buttons you use, and whether an ad was shown or clicked
  • Approximate location — a region inferred from your IP address, never precise or device-level location
  • Inferences — interest categories that advertising partners may derive in order to choose which ad to show

We collect it to run the game, to keep an account working across devices, to measure how the site is used, and to sell advertising. We do not collect the categories the CCPA calls sensitive personal information, and we keep each category only for as long as the sections above describe.

We do not sell personal information for money. But the CCPA defines "sale" and "sharing" broadly, and letting advertising exchanges receive the identifiers, activity, approximate location and inferences described in section 9 in order to serve interest-based ads falls inside those definitions. We treat it as a sale and a share, and disclose it as one rather than argue about the wording.

You can opt out at any time with the "Do Not Sell or Share My Personal Information" link, which sits in the footer of every page, including this one. Choosing it records your decision in this browser and instructs every exchange we work with not to sell or share your information. Ads keep running; they stop being tailored to you. Because the record lives in your browser, repeat it on any other browser you play on, and after clearing this site's data.

If your browser or an extension sends a Global Privacy Control signal, we treat it as an opt-out request for that browser, with nothing for you to click.

You also have the right to:

  • know what personal information we have collected about you, where it came from, why we collected it, and who received it
  • get a copy of that information in a portable form
  • correct anything that is inaccurate
  • delete it, subject to the narrow exceptions the statute allows
  • not be treated differently for exercising any of these rights — the game, its features and your progress are identical either way

To make a request, email us or use the Contact. We reply within 45 days, and tell you if we need the extension the statute allows. So that we hand your data to you and not to somebody else, we verify a request by asking you to send it from the email address on the account; signed out there is no account to look up, and your data ends where your browser's stored data ends. An authorised agent can act for you with written permission that we can confirm with you directly.

We have no actual knowledge of selling or sharing the personal information of anyone under 16.

14. Third-party links

The site links to other games in the Doku network and occasionally to external sites. Those sites have their own privacy practices, which we do not control — check their policies when you visit.

15. Changes to this policy

If our data practices change, we will update this page and revise the "last updated" date above. Material changes will be noted clearly on the site.

16. Contact

For any privacy question or request, reach us through the Contact or email thedlenetwork@gmail.com.