Privacy at Diverday

Last updated: 25 September 2026.

Diverday is a puzzle app. This page tells you plainly who is responsible for your data, what we keep, what for, who it is shared with, for how long, and how you can ask for it or have it deleted.

In short. The person responsible for your data is Adrián Luque Arrebola, an individual, not a company, based in Spain. You can play without an account and without giving us your name or your email. If you create an account, we keep your name, your email and what you do in your groups. We count how the app is used only if you say yes. We do not sell data to anyone, and today there is no advertising from other companies. You can ask for your data, correct it or have it deleted by writing to [email protected].

1 · Who is responsible

The person responsible for your data (the “controller”, in data protection law) is Adrián Luque Arrebola, who runs Diverday as an individual, in Spain. There is no company behind Diverday. When this page says “we”, it means him.

• Email: [email protected].
• WhatsApp: +34 614 52 59 95.
• Spanish tax ID (NIF) and postal address: in the Legal notice.

We do not have a data protection officer, because the law does not require one here: Diverday is run by one person, it does not process data on a large scale and it does not monitor anyone systematically. For anything on this page, write to us at that email or on WhatsApp.

2 · What we keep

If you play without an account

Your games, your times and your settings stay on your phone. Only if you let us count how you use the app does something about them leave it —for example, that a game was left unfinished after 45 seconds—, and we explain that below.

Three things do leave the phone without us asking, as with most apps:

• Crash reports, if the app closes by itself. We explain them below.
• The IP address of your connection, when the app downloads its settings from our server. It is needed so the answer can reach you.
• An identifier from Google’s Firebase. The app uses Firebase for crash reports and notifications. When the app opens, Firebase creates on your phone a random number for the installation and registers it with Google. It is not the advertising identifier and it does not say who you are.

If you create an account

• Your name, the one your people see in groups. You can change it whenever you like from Your account.
• Your email, to send you the link or the code you sign in with. We do not use passwords.
• That you are 18 or over, which you confirm when you create the account.
• Your avatar: only which of the app’s drawings you chose. The drawings are inside the app; we do not keep any photo.
• Your phone’s language and time zone, to write to you in your language and show you times correctly.
• When you last signed in, so that someone else can run a group if the person running it stops signing in.
• Your progress: the streak of your own daily challenges, your best streak, the puzzles you have solved, your best times, your records and how you have set up your daily challenges.
• Your groups and your parties: which ones you belong to, whether you run any, the difficulty you play at, the times you send to their standings —with the difficulty and whether you used the assistant—, requests to join, and who has been removed from a group.
• The one-to-one challenges you send or play.
• The people you block. Only you can see this; nobody else knows you have done it.
• Your notifications: which ones you have switched on and at what time you want them. If you turn them on, we also keep an identifier for your phone, given by the system, so we can send them to you. It disappears when you turn them off.
• Whether you want emails with news and offers: your yes or no, and the date you said it. We keep the date because the law requires us to be able to prove you gave us permission.
• If you ask us to tell you when Premium is available (“Let me know when it’s out”): when you asked and from which screen.
• If you have Premium: until when, and how you got it.

How the app is used

We count things like “the app was opened”, “a Sudoku was started”, “a game was left unfinished after 45 seconds” or “the hint limit was reached”. It tells us which games people get stuck on, which difficulties are badly tuned and whether people come back. Each batch comes with some technical details about the phone: the system, the app version, the language, the screen size and the text size.

None of this is collected unless you say yes. We ask you the first time you open the app, with two buttons at the same level, and until you answer nothing is kept, not even the number that identifies it. If you say no, the app works the same.

It is linked to an installation identifier: a random number that your own phone creates. It is not the advertising identifier or any system identifier, it is not shared with anyone, it disappears if you uninstall the app or clear its data, and it is replaced by a new one if you delete your account. If you have an account, it is also linked to it.

We never keep your name or your email there, or who you play with, or what is on a board, or anything you write.

Google Analytics

When we turn it on, we will ask you separately whether what we count can also go to Google Analytics, which also works out your country from your connection. We will only ask people who already said yes to the question above. Until you say yes, nothing goes to Google Analytics.

Crash reports

If the app closes by itself, a technical report of the crash is sent: which part of the app broke, which version and which phone model. It does not say what you were playing or who you are. It is sent even if you said no to counting how you use the app, because without it we cannot fix crashes. Google (Firebase Crashlytics) receives it, and also sees the IP address of the connection. Each report goes with random identifiers of the installation, Firebase’s own: they are not the advertising identifier and they do not say who you are.

What other people see

• People in your groups see your name, your avatar and the times you send. You stop seeing the people you block.
• The name of a group or a party can be seen outside the app: it appears on the invitation page that anyone with the link can open, and in the preview that WhatsApp and other apps show when the link is pasted. Your own name does not appear there. Think about it before you name a group.

Reports and moderation

With an account you can report, from the app, a person in one of your groups. Whoever runs a group can also report the whole group, from Group settings. A report from the app has no text: you just press the button. If you want to explain why, or if the problem is a group you do not run, write to [email protected]. Each person can make at most ten reports a day from the app.

For each report we keep who makes it, about whom or which group, the date, its status and what was done. If you write to us about it, we also keep your message.

Each report arrives by email, within a minute, in the inbox of the person who moderates. That email includes:

• the name and email of the person reporting;
• if it is about a person: their name and email, since when they have had an account and how many groups they are in;
• if it is about a group or made from a group: its name, how many people are in it and the name and email of whoever runs it;
• how many reports there have been before about the same thing and what was done.

A person reads each report and decides, not a machine. They can remove the name, close the group, close the account or do nothing.

• Removing the name replaces it with a neutral one. Today that neutral name is written in Spanish on our server: a person becomes «Alguien» (“someone”), or «Alguien 2» if one of their groups already has an «Alguien», and a group becomes «Grupo sin nombre» (“unnamed group”), or a party «Party sin nombre». Everyone in the group sees it like that, whatever language they use the app in.
• Closing an account means it can no longer sign in and it leaves all its groups and parties. The account is not deleted.

When a decision is made, we tell both sides by email. The person who reported is told what was decided. The person or the group affected is told what was decided and why, and what they can do if they disagree. The person who moderates writes these emails by hand, to the addresses that already come in the report email. We do not tell the person reported who reported them. The Community rules explain what can be reported and what happens next.

If you write to us

From the app, “Write to us” prepares the message with what we need to understand what is happening: which screen you are writing from, the language, the app version, the phone’s system and whether you have an account. If you write while signing up, it also includes the email address exactly as you typed it. You see all of it before sending and you can change it.

Emails to [email protected] are read in a Gmail inbox (Google). WhatsApp messages go through WhatsApp (Meta).

This website

The website is served by Cloudflare. Like any server, it sees the IP address and the technical details of each visit —which page, which browser— so it can deliver it and protect it. The website does not set cookies or keep anything of yours to follow you. We explain it in section 11.

The app’s own messages

The app sometimes shows messages about Diverday itself. When one appears is decided on your phone, and they do not use any advertising identifier. If you let us count how you use the app, we also count how many of these messages are seen and what people do with them, like everything else. Today there is no advertising from other companies. If there ever is, we will say so here first and, if your permission is needed, we will ask for it.

3 · What for, and on what legal basis

• Your account, your progress, your groups, parties and one-to-one challenges, your blocks and your notifications.
  Legal basis: providing the service you ask for.
  How you control it: by changing it in Your account, or by deleting the account.
• Counting how the app is used, on our server.
  Legal basis: your consent, which we ask for the first time you open the app.
  How you control it: Count how the app is used, in Account → Privacy and data. You can turn it off and on again whenever you like, with or without an account.
• Also sending it to Google Analytics, when we turn it on.
  Legal basis: your consent, which we ask for separately.
  How you control it: Also tell Google, in the same place.
• Crash reports.
  Legal basis: our legitimate interest in the app not breaking.
  How you control it: the app has no switch to turn them off. You can object by writing to us, and we will answer you and weigh your case.
• Emails with news and offers.
  Legal basis: your consent, in a separate, unticked box. Keeping the date you gave it is a legal obligation.
  How you control it: News and offers, in Account → What you get. And every email will say how to unsubscribe.
• Telling you when Premium is available.
  Legal basis: your consent: you ask for it.
  How you control it: the app has no button to undo it; write to us and we will take you off the list.
• Handling reports, moderating and telling both sides what was decided.
  Legal basis: receiving reports and telling each side what was decided and why is an obligation under the EU Digital Services Act (articles 16 and 17). The rest of the moderation, applying our Community rules, rests on our legitimate interest in Diverday being safe for everyone.
  How you control it: you can object to the part that rests on legitimate interest by writing to us; we assess each case.
• Answering what you write to us.
  Legal basis: our legitimate interest in answering you. If it is about your account, it is part of the service.
  How you control it: write to us.
• Serving this website and the app’s settings, and protecting them.
  Legal basis: our legitimate interest in them working and being safe from attacks.
  How you control it: you can object by writing to us.

4 · Which data is required

To play, none. To have an account you need a name, an email and to confirm that you are 18 or over: without them we cannot create it. To be in a group you need an account. Everything else is optional.

We do not make automated decisions about you. What happens with a report is decided by a person.

5 · Who it is shared with

We do not sell or give your data to anyone. These providers process it on our behalf, as “processors”, under the data processing terms that are part of each one’s contract:

• Supabase: accounts, groups, results, reports and usage records. Where: European Union (Paris).
• Cloudflare: serving this website and the app’s settings; passing your email to the service that sends the sign-in link; delivering notifications to your phone; sending reports to the person who moderates; receiving emails sent to [email protected]. Where: worldwide network.
• Resend: sending the email with your sign-in link, and report emails to the person who moderates. Where: United States.
• Google (Firebase): crash reports and notifications to your phone. Where: United States.
• Google Analytics: how the app is used, only if you say yes, when we turn it on. Where: United States.
• Whoever sends the news emails: nobody yet, because we have not sent any. Before the first one, we will name them here.

Others process your data on their own account, under their own rules:

• Google (Gmail): the inbox where emails to [email protected] and reports are read, and from which we write to both sides of a report. It is an ordinary Gmail account, so Google handles those emails under its own terms, as with any Gmail. Where: United States.
• WhatsApp (Meta), if you write to us there.
• Google Play and the App Store, when you download the app or rate it.

6 · Outside the European Union

Our server keeps your data in the European Union (Paris). But Supabase, Resend and Google are United States companies, and Cloudflare works worldwide, so some data may leave the EU. When it does, it goes with the safeguards the law requires:

• Supabase: the European Commission’s standard contractual clauses, which are part of its contract.
• Cloudflare: the EU-U.S. Data Privacy Framework, which it belongs to, and the standard contractual clauses.
• Resend: the standard contractual clauses, and the EU-U.S. Data Privacy Framework, which it belongs to.
• Google (Firebase and Google Analytics): the EU-U.S. Data Privacy Framework, which it belongs to, and the standard contractual clauses where that does not apply.

7 · How long

• Your account: for as long as you keep it. When you delete it, it is deleted at once, and with it your progress, your place in groups, your results, your reports and your usage records. Today our server keeps no backup copies, so nothing remains in them; if that changes, this page will say how long a deleted account can remain in them.
• Detailed usage events: 90 days. After that, only a daily count remains, with no reference to you.
• The record of which days each installation was used, which tells us whether people come back: 400 days. And the installation itself, 400 days without being opened.
• Google Analytics, when we turn it on: 14 months.
• Crash reports: 90 days, Google’s period.
• Your phone’s notification identifier: deleted after 180 days without use. The notifications we send you, after 7 days.
• Requests to join a group: 30 days.
• One-to-one challenges: 7 days after they expire.
• A closed group: it can be reopened for 30 days. After that it stays closed, with its name; what each person had in it is deleted when that person deletes their account.
• Reports: for as long as the accounts involved exist. A report is deleted when the account of whoever made it is deleted, or the account or the group it is about. We keep them that long because, when something is reported again, the person who moderates needs to know whether it has happened before.
• Report emails in the moderator’s inbox, and the emails telling both sides what was decided: we delete them once they are more than two years old. We clear out the inbox once a year, so an email can stay up to a year longer.
• An account closed by moderation: it is kept closed for as long as the closure lasts, so that the same email cannot be used to come back. If whoever had it asks us to delete it, we delete it.
• What you write to us by email or WhatsApp: we delete it once two years have passed since the last message, in the same yearly clear-out, so it can stay up to a year longer.
• Your yes to news and its date: for as long as you keep the account.
• The list to tell you about Premium: for as long as you keep the account, or until you ask us to take you off it.
• Providers’ technical logs, such as IP addresses: we do not keep them ourselves. Cloudflare and Supabase keep them for the time each one sets in its own terms, to run and protect its service. We do not copy them or use them for anything else.

8 · Your rights

You can ask us, whenever you like, to:

• See what data of yours we have and get a copy.
• Correct anything that is wrong. You change your name yourself in Your account; for your email, write to us.
• Delete it. You delete your account yourself; we explain how in Delete your account.
• Stop using it for a while (restriction), for example while we check whether something is correct.
• Object to what we do on the basis of legitimate interest: crash reports, moderation under our Community rules and the website.
• Take it with you in a file that another program can read (portability).
• Withdraw a permission you gave us. It is as easy as giving it, and it does not change what was already done with it before.

Write to [email protected], ideally from your account’s email: that way we know it is you. If we are not sure, we will ask you to confirm it. It is free. We answer within one month; if the case is complicated, we can extend it by two more months, and we will tell you so within that first month.

If you ask for your data and you have been reported, we give you your own data, but not who reported you.

You can do three things yourself in the app, without asking anyone: turn off permission to count how you use the app, turn off news emails, and delete your account.

If you think we are not doing it right, you can complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, aepd.es), or to the data protection authority of the EU country where you live.

9 · Age

To play without an account, we do not ask your age, your name or your email. To create an account, and to give us any permission —counting how you use the app, sending it to Google Analytics when we turn it on, or emailing you with news—, you must be 18 or over. If you are younger, play without an account and say “No, thanks” when we ask. We explain why in the Terms of use.

We do not knowingly ask anyone under 18 for data. If we learn that an account belongs to someone under 18, we delete it.

10 · Security

Everything travels encrypted. The server’s tables are closed by default: each person can only read their own data and that of the groups they are in, and nobody can read the usage tables from the app.

11 · Cookies

This website does not set cookies or store anything in your browser to recognise you. That is why you do not see any cookie notice: there is nothing to ask your permission for. A cookie is a small file that a website leaves in your browser to recognise you the next time you visit; the law treats any other way of storing things in your browser or on your phone in the same way, so this covers all of them.

• No cookies, neither ours nor other companies’.
• Nothing stored in your browser to remember you.
• No tool to measure visits, no advertising, no social media buttons, and no videos or maps from other companies.

We checked this on 25 September 2026: we requested the pages from the live website and none of them asked to store a cookie, and the website’s code does not use cookies or any other storage in your browser.

The only technical thing is Cloudflare’s, which serves the website. It does two things worth telling you about, even though they are not cookies:

• Reports of loading errors. Cloudflare asks your browser to let it know, for 7 days, if a page on this website fails to load. It only sends something if loading fails, it cannot be used to recognise you, and it is there so the website works. It is called Network Error Logging.
• Hiding our email address from robots. So that programs that collect addresses cannot read [email protected], Cloudflare adds a small program that shows it when the page loads. It does not store anything.

The app is a different matter. It keeps your games and your settings on your phone, because that is what you ask it to do when you play. It also gives itself an installation identifier as soon as it needs one, without asking: it is what gives you your avatar when you play without an account. That number only leaves your phone if you say yes to us counting use. Firebase does write its own, without asking, so the app can report its crashes and receive notifications; we do not use it to follow you or for advertising. We explain both in section 2.

If there were ever cookies on the website. If they were essential —for example, remembering the language or the dark mode you chose—, the law does not require your permission, but we would still list them here: which one, what it is for and how long it lasts. If they were not essential —measuring visits with a tool that stores something, a video or a map from another company, or advertising—, before storing anything:

• you would see a notice with two buttons, Accept and Reject, equally visible;
• nothing would be stored until you chose, and carrying on reading the page would not count as a yes;
• if you rejected them, the website would work the same;
• you could change your mind whenever you liked, from a link on every page;
• your answer would last 24 months at most; after that we would ask you again;
• and we would update this page first, saying who sets each one, what for and how long it lasts.

Every browser lets you delete cookies and website data from its settings, usually under “Privacy”. You will not find any from this website.

12 · Changes

If what we count or who it is shared with changes, this page is updated and we ask again the people who had given their permission: a yes to an old text does not count for a new one. This applies to both questions, ours and Google’s.