Privacy policy

Last updated: 7 October 2026.

Daily Box is a free puzzle game, one box to open every day. This page explains what data the game uses, why, where it is processed and what your rights are. The service is meant for a general audience; it is not designed for children in particular and does not ask for your age.

Controller

Lucas Deneudt. Contact for any question about your data : contact@dailybox.fr. The legal notice gives the publisher’s identity.

Data used

• An anonymous identifier, created automatically on first launch (Firebase Authentication). No name, no address, no date of birth.
• A nickname drawn at random, shown in the ranking.
• Your results on the daily boxes: box number, time, number of errors, stars, cogs, and the hint marks (used for the share text). To verify a result, the game also sends the sequence of moves played and the box’s seed; they are only used to replay the game on the server and are not kept.
• Your time zone, sent with the request for the box of the day to know whether your day has started; it is not kept.
• If you link an account: your e-mail address (sign-in link), or your e-mail address and your Google account identifier (Google sign-in). Nothing else from your Google account is read.
• On your device (the browser’s local storage): your progress (streak, cogs, results), your settings (language, sound), results waiting to be sent while you are offline and, while signing in, the e-mail address a link was sent to.

Purposes and legal bases

• Running the game — box of the day, verifying results, ranking, streak, finding your progress on another device: performance of the service you use (Article 6(1)(b) GDPR). Local storage on your device is strictly necessary for this service and needs no consent.
• Advertising (see “Advertising” below): your consent (Article 6(1)(a) GDPR and Article 82 of the French data protection act), collected by a consent management platform certified by Google (TCF v2.3) before any advertising cookie or identifier is stored or read. You can change or withdraw it at any time with “Manage cookies” (Settings), as easily as you gave it.

Where the data is processed

Results, nickname and game content are hosted by Google (Firebase: Cloud Firestore and Cloud Storage) in the European Union, in Paris (europe-west9 region).

Authentication is processed in the United States. Firebase Authentication — which handles the anonymous identifier and, if you link an account, your e-mail address or your Google sign-in — processes this identity data in the United States, with no option to choose another region. This transfer outside the European Union is covered by the European Commission’s standard contractual clauses agreed with Google.

Recipients

Google, as processor, to run the game (Firebase: hosting, database, authentication). For advertising, Google (the Google AdSense ad network) acts as a separate controller, for its own advertising purposes and under its own policy (see “Advertising”). Other players only see your nickname and your time in the ranking. The publisher sells no data.

Advertising

The game is free and is funded by advertising. It uses the Google AdSense network; Google is our advertising partner. Ads may be offered, for example in exchange for an extra hint, a saved streak or doubled cogs (you can also decline or, when offered, spend cogs instead). While the network is not switched on for the site, no consent message, no Google advertising script and no advertising cookie is loaded.

• Consent first. Once the network is switched on, the game loads Google’s consent message (“Privacy & messaging”, a TCF v2.3 certified platform), shown in the European Economic Area, the United Kingdom and Switzerland. The advertising script is only loaded after your choice, or where the law of your country requires none. You can accept, refuse or customise; refusing does not stop you from playing.
• What Google may collect, depending on your choice: advertising cookies and identifiers, IP address, information about your browser and device, pages viewed, interactions with ads, in order to show ads (personalised with your consent, non-personalised otherwise), measure them and fight fraud.
• What the publisher does not do: it passes neither your nickname, nor your results, nor your e-mail address to the ad network.
• Transfers outside the European Union. Google may process this data in the United States and other countries; these transfers are covered by the EU–US Data Privacy Framework and the European Commission’s standard contractual clauses.
• Learn more and act: how Google uses data from sites and apps of its partners, Google’s privacy policy, My Ad Center (manage ad personalisation).

Retention

Your data is kept as long as your account exists. “Delete my account” (Settings → Account) erases it entirely and at once: results, streak, cogs, nickname, e-mail address. The data on your device stays there until you clear it (or delete your account).

Your rights

You have the right to access, rectify, erase, restrict, object to and port your data, and to set instructions for what happens to it after your death. In the game: “Export my data” gives you all your data in a file; “Delete my account” erases it. For any other request: contact@dailybox.fr. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the authority of your own country.

Cookies and trackers

The game only uses the local storage it needs to work, which needs no consent. Google’s advertising cookies and identifiers (AdSense network) are only stored or read with your consent, collected before any ad is shown where the law requires it; you can change or withdraw it at any time (“Manage cookies”, in the game’s settings, once the network is switched on).