YOUR PRIVACY
Privacy policy
Last updated: October 11, 2026
Your puzzles work whether you allow optional analytics or not. This page explains what stays on your device, what is sent to our service providers, and how to change your choices.
1. Who operates this site
Gym Puzzles is an independent fan project operated by Rotem Natan under the Rutmus name, in Israel. To contact the operator, use the contact options below. You do not need an account to play.
2. Progress and privacy choices on your device
We use your browser’s local storage to remember puzzle progress, completed challenges, generated puzzle settings, and preferences. These saves remain on your device; they are not an online account or a cloud backup. Some game state and puzzle settings can also be included in analytics when you allow it, or in a report you choose to send.
We also store your analytics choice on this browser for up to 180 days, then ask again. Clearing site storage removes saves and choices. Different browsers and hostnames have separate storage, so your choice on rutmus.com does not automatically apply to gym-challenge.rutmus.com.
3. Optional analytics, errors, and session replay
With your permission, we use PostHog to understand visits, puzzle selections, starts, completions, hints, and generated challenges, and to diagnose application errors. This can include browser and device information, page URLs, timestamps, random visitor/session identifiers, selected levels, move counts, durations, puzzle settings, and error details.
Session replay can record interactions and rendered game-canvas frames so we can understand problems. Input fields are masked, the feedback form is excluded from replay, and console-log recording is disabled. These safeguards reduce collection; they do not make every analytics event anonymous. Your browser communicates with PostHog’s EU Cloud endpoints, which receive technical request information such as IP addresses.
The optional PostHog SDK is not loaded before you allow analytics. Choosing “Continue without analytics” keeps optional analytics, automatic error reporting, and replay off. You can withdraw permission using “Privacy choices” in the footer. Withdrawal stops future capture and clears this project’s stored analytics identity on your browser; it does not automatically delete information already received by PostHog.
4. Feedback and privacy requests
When you choose to submit feedback or a privacy request, we send your category, message, optional email address, and report context to PostHog. Context can include the page, browser, viewport size, selected puzzle, and game state or generator settings. For workshop playtests, submitted context also includes your optional difficulty and pacing answers, input device and experience, move attempts, undo/restart counts, active play time, completion, and whether you opened design notes. These observations stay in the tab until you choose to submit feedback. Page URL query strings and fragments are excluded from the report URL. Reports use a random identifier; when analytics is allowed, a report may use the current analytics identifier to help investigate it.
Feedback works even if optional analytics is declined. Submitting a report is a separate action you request. Email is optional and helps us reply. Please avoid passwords, payment details, or sensitive information in your message.
5. Google advertising
We are setting up Google AdSense to support the site. Verification information is present, but ad-serving placements are inactive. When advertising is enabled, Google and its advertising partners may use cookies, web beacons, IP addresses, and other identifiers to provide, measure, and, where permitted, personalize advertisements.
Advertising consent is separate from the PostHog analytics choice. Required advertising consent controls must be configured before ad serving starts. Google’s certified consent platform will provide advertising choices for relevant visitors. Declining analytics does not itself express a choice about advertising.
Learn more about how Google uses data from partner sites and Google’s ad-personalization controls.
6. Hosting, fonts, and external links
Our site is delivered using Sites infrastructure and Cloudflare. Loading the site involves technical connection data, such as IP address and browser information, used to deliver and secure it. Fonts are served from this site without requests to Google’s font servers. External reference links are governed by the destination’s privacy practices.
7. Why data is used and who receives it
We use data to operate and secure the site, save your choices, understand and improve the puzzles with your permission, investigate bugs, respond to reports and privacy requests, and support advertising when enabled. Depending on the feature, recipients include the site operator, PostHog, hosting/infrastructure providers, and Google and its advertising partners. Reports and individual analytics records can contain personal data; we do not describe all shared information as aggregated or anonymous.
Service providers can process information internationally under their terms and safeguards. See PostHog’s privacy notice and Google’s privacy policy.
8. Retention and security
Voluntary feedback is first validated and stored in our Cloudflare database, then forwarded to PostHog. Reports remain queued if forwarding is unavailable. Server copies become eligible for deletion after 30 days and are removed in bounded batches when later reports arrive. Short-lived rate-limit records use a salted hash of the network address; raw addresses are not stored with reports. These rate-limit records are removed after approximately two days of subsequent reporting activity. “Copy report” lets you keep a local draft when delivery is unavailable.
Game saves remain on this browser until you clear them or site storage is removed. Analytics choices expire after 180 days. We retain analytics and replay only as needed to understand usage and diagnose problems, and feedback only as needed to investigate and respond, subject to the provider’s configured retention and deletion controls. Retention varies by data type and service settings; contact us for details relating to your information.
We use HTTPS, restrict management access, mask replay inputs, and exclude the feedback form from replay. No internet service can guarantee absolute security.
9. Choices, rights, and contact
Use “Privacy choices” in any footer to allow or decline optional analytics. Browser controls can remove saved data and manage storage, but do not replace our consent choices. Changing a choice does not affect your ability to play.
Depending on applicable law, you may have rights to access, correct, delete, or restrict personal information, withdraw consent, or complain to a relevant authority. To ask a question or exercise a right, press Contact above or Send feedback below, choose “Other,” and describe your request. Include a reply email if you want a response. We may need information to locate a record and verify a request; we cannot always identify random analytics records from a name alone. Removing browser storage does not delete a report already sent.
The site is a nostalgic puzzle project, not a service asking children to submit personal details. If you are a parent or guardian concerned that a child has submitted information, contact us through the same form. Please do not send sensitive information.
10. Updates
We may update this policy when features or data practices change. The date at the top identifies the current version. Where a change requires renewed permission, we will ask for it.