Privacy policy

Last updated: 17 October 2026

puck.im is a private, invitation-only personal website operated by Puck ("we", "us"). This policy explains what personal data the site handles, why, and what rights you have. It applies to everyone with an account and to anyone visiting the site's public pages.

Data we collect

Your account

• Your email address, used as your login.
• Your username, shown to other users of the site (for example on leaderboards).
• Your password, stored only as a one-way hash. We never store or see it in plain text.
• Your account's permissions and creation date.
• Your display preferences, such as which home page widgets are turned off and how they are arranged.

Accounts are created by the operator. There is no public sign-up.

Your content

Tasks you add (their text, optional due date and whether they are done) and quick links you save (their name and web address) are stored in our database, visible only to you, until you delete them or your account is deleted.

Game scores

Each finished game of Minesweeper or Snake records your score (time or points), the game and the date with your account. Leaderboards show the best scores to every user of the site, with the name of the player who made them, identified by their username.

Cookies

• A session cookie, required to keep you logged in. It is deleted when you log out or close your browser.
• A "remember me" cookie, only if you tick that box when logging in. It keeps you logged in for up to 30 days.

Both are strictly necessary for the site to work. We use no analytics, advertising or third-party tracking cookies.

Server logs

Like any web server, ours records technical information about each request: IP address, date and time, requested page, browser user agent and response status. These logs are used only for security and troubleshooting, and are kept for at most 12 months.

Google account (optional)

If you choose to link a Google account from the Settings page to show your calendar on the home page, we receive and store:

• the email address of the linked Google account;
• a token allowing read-only access to your calendars, stored encrypted;
• the list of permissions you granted and the date you linked the account;
• if you choose them in Settings, the identifiers of the calendars to show on the home page.

With your permission (the calendar.readonly scope), the site reads the list of your calendars and the events of the current day, to display them to you on the home page. This calendar data is kept in a temporary server cache for at most 5 minutes, and is never written to our database. We cannot create, change or delete anything in your Google account.

Google API Services: Limited Use

puck.im's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained from Google:

• is used only to show your own calendar to you on puck.im;
• is never sold, shared with or transferred to anyone else;
• is never used for advertising, or to train any AI or machine learning model;
• is never read by a human, except with your explicit permission, for security reasons, or where required by law.

Weather

The weather and air quality widgets are fetched by our server from Open-Meteo for a fixed city. No personal data is sent to Open-Meteo. Links to Google Calendar take you to that website, whose own privacy policy applies.

Why we use your data (legal bases)

• Providing the service you use (your account, login cookies): performance of our agreement with you.
• Security and troubleshooting (server logs, login attempt limits): our legitimate interest in keeping the site safe.
• Google Calendar: your consent, given when you link your account. You can withdraw it at any time.

Sharing

We do not sell or rent personal data, and do not share it with anyone, except where required by law. The site runs on a server administered by the operator. When you link a Google account, requests to Google are made on your behalf, under Google's privacy policy.

How long we keep data

• Account data: until your account is deleted.
• Tasks and quick links: until you delete them, or your account is deleted.
• Game scores: until your account is deleted.
• Google link: until you unlink it in Settings or revoke access from your Google account. The stored token is deleted immediately.
• Calendar data: at most 5 minutes in a temporary cache.
• Server logs: at most 12 months.

Security

All traffic uses HTTPS. Passwords are hashed, Google tokens are encrypted, and repeated failed login attempts are blocked. No system is perfectly secure, but we take reasonable measures to protect your data.

Your rights

Under the EU General Data Protection Regulation (GDPR), you can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy of it. You can unlink your Google account at any time from the Settings page, or from your Google account's third-party connections.

You can also lodge a complaint with the French data protection authority, the CNIL.

Contact

For any question or request about your data, contact Puck through the channel by which you received your account invitation.

Changes

We may update this policy as the site evolves. The date at the top shows the latest version.