Privacy

Last updated 1 October 2026

Cyfa is a daily number puzzle. You can play without giving us anything about yourself. This page says what we keep, why, and how to have it deleted.

Who runs Cyfa

Cyfa is run by Kantos Limited, a company registered in England and Wales (number 10955081), whose registered office is Northdown Business Park, Ashford Road, Lenham, Kent, ME17 2DL. Questions about your data go to cyfa@kantos.com.

What we keep

• If you just play: your result for each daily puzzle. That means which answers you found and in what order, how long each took, the hints you used and when you paused. It is linked to an anonymous account number created when you find your first answer. We do not know who you are.
• If you sign in: your email address, so you can sign in on another device and keep your progress and streak. If you sign in with Google, Google also tells us your name and profile picture. We do not keep them.
• On your device: your current game and stats, so refreshing the page does not lose them, and your sign-in, so you stay signed in. Cyfa sets no cookies.

What we use it for

• Saving your progress, stats and streaks.
• Showing how everyone did after you finish a puzzle. This only ever shows totals, such as how many players found each answer. It never shows anyone's name, email or individual result.
• Finding and fixing problems with the game.

We do not sell your data, show adverts or send marketing email. The only emails Cyfa sends are sign-in links you ask for.

Who else handles it

• Google (Google Cloud and Firebase) hosts the game and stores your results in London. Google also handles sign-in and sends sign-in emails. Sign-in records may be kept outside the UK, under Google's data protection terms.
• Plausible Analytics counts visits and a few actions: starting and finishing a puzzle, sharing a result, opening How did everyone do?, a save sent after a lost connection, and starting or finishing sign-in or deleting an account. It records how a puzzle went (solved or revealed, hints, streak length) but never who you are: it uses no cookies, collects no personal data, and is hosted in the EU.
• Sentry receives a report when something in the game breaks. Reports carry no personal details, and IP addresses are not stored. Sentry stores them in the EU.

Our legal basis

We keep game results because we have a legitimate interest in running the game and keeping it working. If you sign in, we keep your email address to provide the cross-device saving you asked for.

How long we keep it

As long as your account exists. When you delete your account, your games, stats and email address are removed straight away. Our database backups are kept for 7 days, so deleted data is gone from them within a week.

Your rights

You can ask what we hold about you, ask us to correct or delete it, or object to how we use it. To delete everything yourself, open the You button in the game and choose Delete my account. For anything else, email cyfa@kantos.com. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Cyfa is not meant for children under 13.

Changes

If this page changes, the date at the top changes with it.