Sanasauna – privacy policy

Effective from 20 October 2026 · Version 1.0

The Finnish version is the primary text; this is its translation.

This policy explains what personal data the Sanasauna app (iOS and Android) and its server process, why and for how long, and how you can exercise your rights. You can also read it in the app: Asetukset (Settings) → Tietosuoja (Privacy).

1. Controller

• Huotari OÜ (private limited company, Estonia)
• Registry code: 16614218 (Estonian Business Register)
• Address: Pronksi tn 3-24, 10124 Tallinn, Estonia
• Privacy contact: sanasauna@huotari.ai

2. In short

• You can play Sanasauna entirely without an internet connection. Puzzles, game progress and settings stay on your phone.
• The app has no account and no sign-in. It does not ask for your email address or phone number.
• When your phone is online, the app registers it with our server under a random identifier and backs up your game progress. It also sends minimal usage statistics that help us tune puzzle difficulty. You can turn the usage statistics off in the settings.
• Our server is in Finland.
• In party mode, the game travels directly between phones over Bluetooth or a Wi-Fi network, not through our server. When the game ends, the host's phone sends a results summary to our server.
• The app has no ads, no ad tracking and no third-party analytics. We do not sell your data.
• You can delete the data stored on our server in the app: Asetukset (Settings) → Tili ja synkronointi (Account and sync) → Poista tili (Delete account).

3. What data we process

3.1 Data that stays on your phone

The following data is stored only on your phone. It is not sent to us unless sections 3.2–3.6 say otherwise:

• puzzles, game progress, scores and results
• your nickname and settings (theme, contrast, text size and language)
• the ledger of free puzzles and hints and of purchased balances
• party results, which contain the players' nicknames, scores and ranks
• Vuorotellen (pass the phone) games, in which players take turns solving a puzzle on the same phone, and the names of their players
• the device key pair (Ed25519). The private key is kept in the phone's secure key store (iOS Keychain or Android Keystore) and never leaves the phone.

This data is removed when you uninstall the app. On an iPhone or iPad, however, the device identifier and the key pair may remain in the device's Keychain, in which case a reinstalled app continues with the same device identifier. Your phone's own backups (for example iCloud or Google) may include app data, depending on your phone settings. The key pair cannot be restored from a backup onto another device.

3.2 Device identifier and sync

When your phone is online, the app contacts our server when it starts, when you return to it, when you solve a puzzle or make a purchase, and when you choose Synkronoi nyt (Sync now). It then does the following:

• Device registration. The app sends the device's public key and proves with a signature that it holds the matching private key. The server gives the phone a random device identifier and a session token valid for 90 days. The server stores the public key and the device identifier, and when the phone registered and when it was last in contact. The identifier contains no name, phone number, serial number or advertising identifier.
• Backup of game progress. For puzzles you have started, the app sends the puzzle identifier, the letters you have filled in, elapsed time, the number of hints used, score, the time the puzzle was solved and the last change time, plus the content of puzzles generated on the phone so that they can be restored.
• Results. For solved puzzles, the app sends the puzzle identifier, the score and the time the puzzle was solved. Party results are covered in section 3.5.
• Weekly puzzles and puzzle packs. The app fetches the puzzle catalogue and downloads new packs. Packs are signed, and the app checks the signature before using them.
• Balances. The app fetches the balance of purchased puzzles and hints from the server.

Sync runs automatically. You can turn off sending usage statistics (section 3.4), but that does not affect the backup of your game progress or your results. Without a network connection nothing is sent, and the app still works fully.

3.3 No account

The app has no account and no sign-in, and it does not ask for your email address or phone number. The data stored on our server is linked only to your phone's random device identifier (section 3.2).

3.4 Usage statistics

The app sends minimal usage statistics to our server, which we use to tune puzzle difficulty and improve clues. Each event contains:

• the event type: puzzle started, puzzle solved or hint used
• the time
• the identifier of the puzzle started or solved
• for a solved puzzle, the time taken in seconds and the number of hints used
• the app's language and version.

Events are linked to the device identifier. They contain no free text, location, contacts or advertising identifiers. We do not use third-party analytics or crash reporting services.

Sending usage statistics is on by default. You can turn it off under Asetukset → Lähetä käyttötilastoja (Settings → Send usage statistics). While it is off, the app neither records nor sends events, and events not yet sent are deleted from the phone. Events already sent are deleted from the server after 24 months, or earlier if you delete your data (sections 8 and 9). Results of solved puzzles and the backup of your game progress are sent regardless of this setting (section 3.2).

3.5 Party mode

Party mode works directly between phones: on iPhone and iPad over Bluetooth or the same Wi-Fi network, on Android phones over the same Wi-Fi network. Game data does not pass through our server or the internet.

• When you host a game, your phone announces the game's four-letter code to nearby devices. Over Bluetooth only the code is announced. On a Wi-Fi network the announcement also contains your nickname, and it is visible to every device on that network that looks for Sanasauna games.
• When a player joins, the phones exchange nicknames, a random player identifier, the puzzle, the letters entered, scores and timer data.
• At the end of a game, every phone stores the results (the players' nicknames, scores and ranks) locally.
• If the host's phone is online, it sends our server a results summary signed by the host. It contains the puzzle identifier, the players' nicknames and random player identifiers, and the scores, ranks and times of the players and teams. Guests' phones do not send party results to the server.
• Your nickname does not have to be your real name. If you do not set one, the app uses a name like "Pelaaja 123".

Permissions: on iPhone and iPad the app asks for permission to use Bluetooth and the local network. The Android app uses the Wi-Fi network for party mode and does not ask for the Bluetooth or location permission.

3.6 Purchases

Purchases are made through Apple's App Store or Google Play. Apple or Google processes the payment, and we never see your card or bank details. Apple and Google process purchase data under their own privacy policies.

To verify and restore purchases we use RevenueCat (RevenueCat, Inc., United States), which processes data on our behalf. The app contacts RevenueCat only when you open the store, make a purchase or restore purchases. RevenueCat receives:

• the app user identifier, which is the device identifier assigned by our server. If the phone has not registered with our server yet, RevenueCat creates a random identifier of its own instead.
• purchase data: product, time, price, currency, country and store transaction identifiers
• technical data, such as the operating system and its version, the app version and the IP address.

RevenueCat notifies our server of each purchase. We store the purchase event's identifier, type, product and app user identifier, together with the event data RevenueCat sends (for example store, country, price, currency and transaction identifiers), and add the purchased puzzles or hints to your balance.

3.7 Server logs

For every request, the server logs the time, the request method, the requested path, the response code and the processing time. Download link signatures are masked in the logs. The logs contain no IP address, device identifier or session token, and the proxy in front of the server does not log requests. We use the logs to fix faults and prevent abuse. Device registration requests are rate-limited by IP address; this information is kept only in the server's memory.

4. Purposes and legal bases

5. What we do not do

• The app has no ads and no advertising identifiers (iOS IDFA, Android advertising ID), and we do not track you across other apps or websites. That is why the app does not show iOS's App Tracking Transparency prompt.
• We do not sell or rent your data or hand it over for marketing.
• We do not collect location, the contacts on your phone, photos or audio.
• We do not make automated decisions or profile you in a way that has legal effects on you.

6. Recipients and processors

• Server: Hetzner Online GmbH (Germany), data centre in Helsinki. Hetzner provides the server that runs our service and its database.
• Purchases: RevenueCat, Inc. (United States) as a processor. Apple and Google are independent controllers for payments.
• Authorities, where required by law.

7. Data location and transfers outside the EU

Our server is in Finland, in Hetzner's data centre in Helsinki, so the data stored on it stays in the EU. RevenueCat is a US company; transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. Apple and Google may transfer data under their own policies.

8. Retention

9. Deleting your data

In the app, choose Asetukset → Tili ja synkronointi → Poista tili (Settings → Account and sync → Delete account) and confirm with Poista (Delete). The button is shown while sync is in use. Deletion

• removes from the server the phone's device identifier and public key, together with the phone's game progress, results (including the summaries of parties it hosted), balances, purchase events, usage statistics and session tokens
• creates a new device identifier and key pair on the phone, so new data cannot be connected to the deleted data
• keeps the puzzles, game progress and available balances on the phone.

Deletion is permanent: the data is removed from the server at once and cannot be restored. Puzzle and hint packs are one-off purchases, so they cannot be restored after deletion; the balance already on the phone remains. Results summaries sent by other hosts, which may contain your nickname, are removed when the data of those phones is deleted. Deletion does not remove RevenueCat's, Apple's or Google's own purchase records. You can also ask us by email at sanasauna@huotari.ai to delete your data at RevenueCat.

Deletion instructions are also on the web at https://sanasauna.fi/en/delete-account, and you can request deletion by email at sanasauna@huotari.ai. Because there is no account, the data on our server is linked only to your phone's random device identifier, and we cannot tell from an email which data is yours. Please therefore use the deletion option in the app, and do it before you uninstall the app.

10. Children

Sanasauna is suitable for all ages but is not aimed specifically at children. Playing requires no account and no personal details. A guardian can delete the data of a child's phone as described in section 9.

11. Your rights

You have the right to

• know what data we process about you and get a copy of it
• have inaccurate data corrected
• have your data deleted
• restrict processing
• receive the data processed on the basis of a contract in a machine-readable format and transfer it to another controller
• object to processing based on legitimate interest, such as usage statistics and logs. You can stop usage statistics yourself in the settings (section 3.4) and delete data already sent as described in section 9; for anything else, contact us.

Send requests to sanasauna@huotari.ai. We reply within one month. If we cannot identify which data is yours (section 9), we will tell you.

Huotari OÜ's lead supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, aki.ee). If you believe your data is processed unlawfully, you can lodge a complaint with it or with the data protection authority of the country where you live, in Finland the Office of the Data Protection Ombudsman (tietosuoja.fi).

12. Security

• Connections to the server are encrypted (HTTPS/TLS).
• The server stores only a hash (SHA-256) of each session token.
• The device's private key stays in the phone's secure key store.
• Puzzle packs are signed, and the app does not use modified packs.
• Party results are signed with the host's key.
• Access to servers and the database is limited to administrators.

13. Changes

We update this policy when the app or the way we process data changes. We announce significant changes in the app or in the update notes. The effective date and version are shown at the top of the policy.