Legal
Updated: October 1, 2026
For online puzzles we collect your email address, account identifier, purchases, entitlements, credit balance, unlocked puzzles, saved letters, completion history, streak dates, hints, reminder preferences, and timestamps. If you set a player name, we store it with your profile. Checkout also records order and payment references. Payment card or M-Pesa credentials are handled by Paystack and are not stored by Mseto.
We use this information to authenticate you, verify payment, deliver access, restore progress, provide support, prevent fraud, understand product performance, and maintain the reliability of the service. Optional daily and streak emails are sent only when you enable them, and marketing consent is stored separately. We do not sell personal information.
Supabase provides authentication and database services. Resend delivers account and optional reminder emails. Paystack processes payments. Our hosting provider runs the website. Meta provides advertising measurement. When enabled, PostHog provides product analytics and Sentry provides error monitoring. These providers receive only the information needed to perform their services under their own security and privacy terms.
If you previously allowed product analytics, we may measure page visits, puzzle milestones, checkout steps, and technical failures. When you sign in, this analytics may be attached to your account. We do not send crossword answers, saved letters, full payment details, or email addresses as analytics event properties. If you arrive from an ad, we may store campaign parameters and click identifiers (such as UTM fields, fbclid, or gclid) on your device so we can attribute a purchase to the campaign that brought you. These are associated only with an order you complete. The free daily puzzle may use browser storage to preserve progress on that device. You can clear it through your browser settings.
We use the Meta Pixel and Conversions API to measure page views, product views, cart additions, checkouts, and verified purchases. Meta may receive your browser and IP information, the page path, product details, purchase value in KSh, and a one-way hash of your checkout email where available for matching. Browser and server events share an ID to avoid double counting. We never send crossword answers, saved letters, account or order-access tokens, or raw payment payloads to advertising tools. Meta may combine these signals with its own data under Meta's terms. You can turn off advertising measurement here; purchases still work.
Purchase and payment records are retained for accounting, fraud prevention, and dispute handling. Puzzle progress and account access are retained while your account remains active. You can export your player data or request permanent account deletion from account settings. We use access controls and secure account authentication, but no online service can guarantee absolute security.
You may request access, correction, export, or deletion of your personal information, subject to records we must retain for legal or accounting reasons. You may also opt out of non-essential marketing messages. Email privacy@crossword.co.ke or support@crossword.co.ke.