Privacy Policy

1. Who we are

Crossword Studio is a personal project operated by Antun Pukanić, an individual based in Croatia, who is the data controller for crosswordsstudio.com. It is not currently a commercial service and does not take payments. Contact: hello@crosswordsstudio.com.

2. What we collect

• Account data: your email address and password (stored hashed) when you register.
• Waitlist / newsletter: your email address, if you join the waitlist or opt in to updates.
• Content: the word lists and puzzles you create in your workspace.
• Word Search game: if you sign in with Stadion, your Stadion user ID and scores; for guests, a session identifier and scores.
• Technical data: IP address (used to enforce free-tier rate limits and prevent abuse) and standard server logs.
• Cookies: essential cookies only (session and CSRF). See our Cookie Policy.

3. Why we use it and our legal basis

• To provide the service (accounts, generation, exports), performance of a contract.
• To send verification and service emails, performance of a contract / legitimate interest.
• To send waitlist and marketing updates, your consent (withdraw any time via the unsubscribe link).
• To prevent abuse and secure the service (rate limiting by IP), legitimate interest.
• To take payment (when paid plans launch), performance of a contract and legal obligation (tax/invoicing).

4. Who we share it with (processors)

We use trusted providers who process data on our behalf under data-processing agreements:

• Hetzner (EU) — hosting.
• Brevo (EU) — transactional and waitlist email.
• Stripe — payment processing (when paid plans launch).
• Stadion — identity (SSO) and leaderboard for the Word Search game, only if you choose to log in with Stadion.

We do not sell your personal data.

5. International transfers

Our hosting and email are in the EU. Some providers (e.g. Stripe) may process data outside the EEA under appropriate safeguards such as Standard Contractual Clauses.

6. How long we keep it

We keep account data while your account is active (you can delete your account and its data at any time from your account settings). Waitlist entries are kept until you unsubscribe. Technical logs and rate-limit data are kept for a short period (about 30 days). If paid plans launch later, payment and invoicing records will be kept as required by law.

7. Your rights

Under the GDPR you can request access, correction, deletion, restriction, portability, and object to processing, and withdraw consent at any time. To exercise these, email hello@crosswordsstudio.com, or delete your account and its data yourself from your account settings. You also have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, Croatia.

8. Changes

We may update this policy; we'll change the "last updated" date above and, for material changes, notify you.