Privacy Policy

Last updated: 2026-07-08

This page explains, in plain language, what Crosswords-Studio.com actually collects and why. If anything here is unclear, contact us.

Account data

Crosswords-Studio.com accounts are created and signed into with a passkey — no password ever exists. When you register, we store the display name and email address you provide, plus a cryptographic public key generated by your device. Your email is used only to send automated account-security notifications, such as when a passkey is added to or removed from your account.

Session cookie

A single cookie (csid) keeps you signed in for up to 30 days. It holds a random token; we only ever store a scrambled (hashed) copy of it in our database, so a database leak alone would not reveal usable logins.

Game history & stats

If you're signed in, we save the outcome of games you finish (opponents, score, date) so we can show you your stats and history. Games played while signed out aren't saved.

Email addresses you provide

We only collect an email address belonging to someone other than you when you explicitly type it in — to invite a friend to a live game, or to schedule a game for later. That address is used solely to deliver the invite (and, for scheduled games, a calendar file) via our email provider, Resend. We don't add it to any list or use it for anything else.

Push notifications

If you enable "it's your turn" notifications, your browser gives us a notification subscription endpoint (not your personal contact info) so we can deliver that one specific alert.

Payment information (Studio Pass)

Crosswords-Studio.com never sees or stores your card number. Subscribing to Studio Pass hands you off to Stripe's own secure, hosted checkout page. All we store on our side is a Stripe customer ID, a Stripe subscription ID, and its current status (active, canceled, etc.) — enough to know whether you're subscribed, nothing about how you pay.

Third parties we use

• Stripe — payment processing for Studio Pass
• Resend — delivering invite, scheduled-game, and account-security emails

Each of these only receives the minimum information needed to do its job (e.g. Stripe receives your email and payment details directly from you, not through our servers).

What we don't do

We don't sell your data, run third-party ad trackers, or share your information with anyone beyond the services listed above.

Questions

Reach out any time via the contact page.