Privacy

Who processes your data

The controller is PIXELHIT LTD, Eleftheriou Venizelou 95, Office 102, Anavargos, 8026 Paphos, Cyprus, represented by its director Paul Komoszki. Contact: info@cridoku.com; further details in the imprint.

Without an account

You can use the whole site without an account: play the daily case, take hints, check a culprit. We store nothing about you while you do.

When you open a page, our host processes the connection data needed to deliver it (IP address, time, address requested, browser identification) and to fend off attacks. The legal basis is our legitimate interest in a working service (Art. 6(1)(f) GDPR).

Without your consent we embed no third-party services: no analytics, no fonts from other servers, no social media widgets.

With an account

If you create an account we process your email address, a display name you choose, and your progress: which cases of Volume I you confirmed as solved, on which days you solved the daily case, and which awards you claimed.

The sole purpose is to show you that progress on every device. The legal basis is performance of the user relationship (Art. 6(1)(b) GDPR).

Signing in works without a password: you receive a one-time code by email. For the signed-in session we set one strictly necessary cookie.

Advertising measurement

We advertise the book off this site — through Taboola, Meta (Facebook and Instagram), Reddit and Pinterest. To recognise which ad actually brings someone to the book, a counting pixel may load, belonging to whichever provider you arrived through: Taboola Europe GmbH, Luisenstraße 40, 10117 Berlin, Germany; Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland; Reddit Ireland Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland; or Pinterest Europe Limited, Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland. It reports the page view and the click on the order button to that one provider, processing IP address, browser identification and an identifier in your browser storage.

Only the pixel of the one provider you came through is ever loaded — never several. Someone arriving from a Reddit ad is not reported to Meta, and the other way round.

You are asked at all only if you arrive through one of our ads, which we recognise by a marker in the address. Anyone opening the site directly, from a search engine or from the book is not measured and therefore never sees the question.

The pixel loads only if you agree. The dialog names the provider. The legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG). If you decline, or decide nothing at all, nothing is loaded and nothing is stored; the site works unchanged.

We remember your decision in your browser storage under “cridoku.consent”, separately per provider. You can withdraw it at any time by clearing this site's data in your browser — we will then ask again. All four providers may transfer data to the USA, covered by the EU standard contractual clauses.

The order button leads to Amazon. What you do there is invisible to us; Amazon only reports in aggregate how many orders followed advertised clicks.

Our own count

Separately, we count for ourselves how often the book page is opened and how often it leads to a click through to Amazon. Stored are only: the time, the language of the page, the ad marker from the address (if any) and whether the dialog was agreed to. No IP address, no identifier, nothing on your device — the entries cannot be traced to a person and bear no relation to your account.

The purpose is to know the share the ad platforms' own measurement never sees: someone who declines is not counted by the provider, but is counted by us. The legal basis is our legitimate interest in a reliable check on our advertising (Art. 6(1)(f) GDPR); with no personal reference, no consent is required for it.

Shared awards

If you claim an award and share its link, anyone with that link can see the name you put on it, what it was for, and the date. Your email address and the rest of your progress are not reachable through the link. You may put any word there instead of your real name.

Who processes the data for us

Hosting: Vercel Inc. Database and sign-in: Supabase, data centre Frankfurt am Main (AWS eu-central-1). Both process data on our behalf under data processing agreements. Vercel may involve transfers to the USA, covered by the EU standard contractual clauses.

How long

Account data stays until you delete the account. You can do that yourself at any time under “Account”, and progress and awards go with it. The host's server logs are deleted automatically after a short period.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. Write to the address in the imprint. You may also complain to a data protection authority, for example the Cyprus Commissioner for Personal Data Protection or the authority where you live.