Privacy Policy

Effective date: 2026-09-03
Operator: Not Just a Puzzle, LLC (“Not Just a Puzzle”, “we”, “us”, “our”)
Contact: webmaster@donlinestore.com

1. What this Policy covers

This Privacy Policy describes what personal information Not Just a Puzzle, LLC collects, why we collect it, how we use it, with whom we share it, and the rights you have over your data. It applies to all of our services (together, the “Services”):

  • notjustapuzzle.com — our storefront, blog, free tools, and interactives (the “Site”).
  • studio.notjustapuzzle.com — NotJustAPuzzle Studio, our web app for creating puzzle and activity books (the “Studio”).
  • api.notjustapuzzle.com — the backend service that stores your Studio account and projects when you are signed in.

2. Information we collect

We collect only what we need to run the Services and respond to you.

2a. On the Site (notjustapuzzle.com)

  • Information you give us directly
    • Reader Club email signups — your email address (and the timestamp + IP at the moment of signup, for spam-prevention).
    • Order information — when you buy a product, our payment processor (Amazon, Stripe, or PayPal, depending on the purchase route) collects the billing details required to complete the transaction. We receive a record of the order but not your full payment card number.
    • Contact form submissions — anything you choose to type into a contact form (typically: name, email, message).
    • Comments — if you leave a comment, the email and name you provide are stored alongside the comment.
  • Information collected automatically
    • Standard web-server logs (IP address, browser user-agent, requested URL, referrer, timestamp). Retained for up to 30 days for security and debugging.
    • Strictly-necessary cookies (described in our Cookie Policy).

2b. In NotJustAPuzzle Studio (studio.notjustapuzzle.com)

You can use the Studio signed out — in which case your projects are stored only in your own browser and never reach our servers — or you can create an account to save projects to the cloud. Depending on how you use it, we collect:

  • Account information (only if you sign up) — your name, email address, and a password. Your password is stored only in a securely hashed form (bcrypt); we never store or see your actual password.
  • Your project content — the material you create in the Studio: puzzle words and themes, clues, quotes and authors, worksheet text, project names, page layouts, and any images you choose to add (images are embedded inside your project). When you are signed in, this content is saved to our server so you can access it across devices. When you are signed out, it is saved only in your browser’s local storage.
  • Authentication data — when you sign in, a login token and your basic account details (id, name, email, plan) are stored in your browser so you stay signed in.
  • Server session records — when you use the signed-in service, our backend records standard session data including your IP address and browser user-agent, for security and abuse-prevention.

Information the Studio does NOT collect: we do not run analytics, advertising, or cross-site tracking in the Studio, and the Studio does not process or store your payment-card details (see section 5).

Across all Services we do NOT: use Google Analytics, Facebook Pixel, Hotjar, or any third-party advertising trackers as of the effective date; and we do not sell, rent, or trade personal information to third parties.

3. Why we use it (legal bases)

Purpose Legal basis (GDPR / UK GDPR)
Send Reader Club emails you signed up for Consent
Process orders, ship products, handle refunds Contract performance
Create and maintain your Studio account and save your projects Contract performance
Generate AI-assisted suggestions when you ask for them Consent
Respond to contact-form messages Legitimate interest (replying to you)
Server logs / session records for security and debugging Legitimate interest (Service integrity)
Legal compliance (e.g. tax records) Legal obligation

4. How long we keep it

  • Reader Club emails: until you unsubscribe. After unsubscribe, your email is suppressed (kept in a “do-not-email” list) so we don’t accidentally re-add you.
  • Orders: 7 years (US tax-record retention) or longer if law requires.
  • Studio account & projects: for as long as your account is active. If you delete your account, your projects are deleted with it; residual backups are overwritten on our normal backup cycle.
  • Studio projects stored while signed out: kept only in your browser until you clear your browser data.
  • Comments: indefinitely, unless you ask us to delete them.
  • Contact form messages: 24 months, then deleted.
  • Server logs / session records: up to 30 days.

5. Who we share it with

We share personal information only with the service providers we need to run the Services, each under their own privacy terms:

  • Hosting & database: DreamHost (US) — hosts the Site, the Studio, and the account/project database.
  • Email delivery: WP Mail SMTP (transactional) and, for Reader Club newsletters, an email service provider such as MailerLite.
  • Payments: Amazon Associates, Stripe (US), or PayPal (US) — they receive payment information directly under their own privacy policies.
  • AI providers (only when you use an AI feature): short text you enter (for example, a puzzle theme) may be sent to a third-party AI provider — currently Groq, Inc. and/or NVIDIA — to generate suggestions. See section 6.
  • Web fonts: the Studio loads fonts from Google Fonts (Google LLC), which means Google receives your IP address and user-agent as part of delivering the font files.
  • Search engines: we submit URLs (not personal data) to Bing IndexNow, Google, and similar indexing services.
  • Legal requirements: if we receive a valid subpoena or court order, we may have to comply.

We do not share personal information for advertising or marketing by third parties.

6. AI & automated features

The Studio offers optional AI-assisted features — for example, suggesting a list of themed words for a word-search or number puzzle. These features are off until you choose to use them, and the app asks for your permission before anything is sent to an AI provider.

  • What is sent: only the short topic or theme text you type for that request (a few words, truncated to a short length), together with the type of puzzle and how many items you want.
  • What is NOT sent: we do not send your name, email, account details, saved projects, or any images to any AI provider.
  • Who processes it: a third-party AI provider — currently Groq, Inc. and/or NVIDIA — generates the suggestions and returns them to us. They process your text only to produce that output, under their own terms.
  • Training: we do not use your content to train our own AI models.
  • Human control: AI suggestions are just a starting point. You review, edit, keep, or discard them; nothing is published or sold automatically.
  • Not yet active: some advertised AI features (such as “AI Story Book”) are not yet enabled and require additional setup. If and when we turn them on, we will update this Policy to describe exactly what they send and to whom, and we will ask for your consent.

7. Your rights

Wherever you live, we treat these as universal rights. Some are codified by GDPR (EU/UK), CCPA/CPRA (California), and similar laws elsewhere; we extend them to all visitors.

  • Right to access — request a copy of the personal information we hold about you.
  • Right to deletion / erasure — ask us to delete your personal data (subject to legal retention obligations such as tax records). In the Studio you can also delete your account, which deletes your saved projects.
  • Right to correction — fix anything that’s wrong.
  • Right to withdraw consent — unsubscribe from emails at any time; decline or stop using AI features at any time.
  • Right to portability — receive your data in a machine-readable format. Studio projects can be exported directly from the app.
  • Right to object — to processing based on legitimate interest.
  • Right to non-discrimination — we will not deny service, charge more, or provide a lesser experience because you exercised a privacy right.
  • California “Do Not Sell or Share”: we do not sell or share personal information as those terms are defined by the CCPA/CPRA, so there is nothing to opt out of — but you may still contact us with any request.

To exercise any of these rights: visit /your-data/ or email webmaster@donlinestore.com. We respond within 30 days.

8. Children

The Services are intended for adults — including parents, teachers, and other educators who create material for children. They are not directed to children, and we do not knowingly collect personal information from children under 13 (or under 16 in the EU/UK). If you believe we have inadvertently collected information from a child, please contact us and we will delete it.

9. Security

We use HTTPS across all Services, store passwords only in hashed form, and follow security best practices for our hosting and admin access. No method of transmission over the internet is 100% secure; we will notify affected users in the event of a confirmed data breach involving personal information, in line with applicable breach-notification laws.

10. International transfers

Our servers and processors are located in the United States. If you access the Services from outside the US, your personal information will be transferred to the US. Where an AI or font provider processes data, that processing may also occur in the US or other countries in which those providers operate.

11. Changes to this Policy

If we make material changes, we will update the effective date above and, where required, notify Reader Club subscribers or signed-in Studio users.

12. Contact

Questions, requests, or complaints: webmaster@donlinestore.com.