Privacy Policy and Data Inventory

Version 2026-09-23.1
Effective September 23, 2026 · Technical inventory verified September 4, 2026

Publisher and privacy-request channel

Pasianssia is published by MB „NM Media“. No verified privacy-request channel with a tracked response workflow is currently configured: an operator and counsel must establish and verify that workflow and the required public wording before this notice can advertise that privacy requests may be submitted. The complete controller identity/address, jurisdiction-specific legal bases, rights wording and response deadlines also remain unverified.

Current data practices

The entries below disclose the fields, purpose, provider, activation condition, retention, deletion path and transfer status observed in the current application.

On-device game and preference data

Saved games

Active

Technology / records: localStorage · solitaire:game:v1 · playsolitaire:game:draw2:v1 · playsolitaire:game:freecell:v1 · playsolitaire:game:spider:v1 · playsolitaire:game:daily:v1 · playsolitaire:game:turn3:v1 · playsolitaire:game:turn3-legacy:v1 · playsolitaire:game:spider2:v1 · playsolitaire:game:spider4:v1 · playsolitaire:game:golf:v1 · playsolitaire:game:yukon:v1 · playsolitaire:game:russian:v1 · playsolitaire:game:alaska:v1 · playsolitaire:game:pyramid:v1 · playsolitaire:game:tripeaks:v1 · playsolitaire:game:scorpion:v1 · playsolitaire:game:wasp:v1 · playsolitaire:game:fortythieves:v1 · playsolitaire:game:crescent:v1 · playsolitaire:game:canfield:v1 · playsolitaire:game:eightoff:v1 · playsolitaire:save-envelope:v2:* · playsolitaire:save-quarantine:v2:* · playsolitaire:save-exit:v1:* · sessionStorage: playsolitaire:save-exit-owner:v1
Provider: Your browser (first-party storage)
When it activates: Each non-demo game writes a rollback-compatible raw record plus a validated versioned sidecar. When a dirty page is hidden or closed, it first stages one local page-exit snapshot before the same checked dual writer runs. A later load resumes that snapshot only through its exact predecessor checkpoint, or uses the existing cross-tab conflict recovery if another tab advanced first. Unsupported or damaged records are marked in local quarantine, writes to that game slot stop, and automatic recovery restores a compatible copy or removes an unusable pair before reloading.
Fields: game variant and rules mode
deal seed or FreeCell deal number
card positions, stock, waste, foundations and other variant-specific piles
move count, status, start time and final time when won
full undo history, with a quota fallback that keeps the latest 20 entries or removes the history while retaining the current board
daily date key or onboarding metadata when applicable
save format version, rules version, monotonic revision and update time
pseudonymous deal and attempt identifiers derived from the game slot, seed, rules and start time
a bounded pending-replacement journal containing predecessor lifecycle summaries (variant/mode, finite first-action category, status, move/final totals and pseudonymous identifiers), plus a crash-completion marker while the rollback copy catches up
one temporary page-exit snapshot per document for the game slot, its creation time, a session-scoped opaque document owner identifier, an opaque random per-stage journal generation identifier, its expected revision and non-cryptographic hashes of the predecessor records; if storage quota rejects the full snapshot, undo history is reduced to the latest 20 entries or removed while the current board is retained
quarantine reason, detection time, record size and a non-cryptographic diagnostic hash (the damaged record remains in its original key until recovery)
Purpose: Resume the current game
Undo moves
Restore the requested variant and deal
Preserve the latest move when a page exits while another tab holds the save lock
Validate migrations and preserve rollback compatibility
Prevent damaged, newer or conflicting cross-tab records from overwriting a known-good compatible copy
Retention: Compatible save pairs remain until replaced by another save for that game or until you clear site data. The document owner identifier remains for the tab/session. Each page-exit snapshot is removed after that state is durably accepted or its conflict is resolved; an invalid or abandoned snapshot can remain until a later load cleans it up or until you clear site data. Automatic recovery normally clears a quarantine marker immediately; if browser storage rejects that update, the marker remains until a retry succeeds or you clear site data.
Deletion / control: Automatic recovery keeps a valid compatible copy when one exists; otherwise it removes the unusable slot and starts fresh. If browser storage rejects the repair, use Try again or clear site data in your browser.
Transfer: After account creation or sign-in, a validated board copy can be sent automatically to the first-party account API from a durably fenced import while the guest copy is still authoritative. A valid exact-predecessor page-exit snapshot may supply that board copy, but full undo history, onboarding state, the journal identifier and record, predecessor hashes, and quarantine metadata remain in the browser. The account namespace activates only after the final receipt and local activation state are durable, and a guest namespace already linked to another account is not sent again. (verified in source code)
Verification: All legacy keys, versioned sidecars, central dual writes, quarantine blocks and automatic recovery were traced. (verified in source code)
Legal-review status: The bounded account-transfer behavior is verified in code and the factual disclosure is owner-accepted for launch. This technical inventory is not legal advice or a claim of counsel approval.

Settings and interface preferences

Active

Technology / records: localStorage · solitaire:settings:v3 · solitaire:customThemeVars:v1 · sd-hint-1tap-seen · playsolitaire:hintDebug · solitaire:whatsNew:v1
Provider: Your browser (first-party storage)
When it activates: The main settings and theme cache are written when settings change, and the one-tap flag is written when its instructional hint is acknowledged. The hint-debug flag is only read when someone manually places the value 1 in browser storage. The what’s-new marker is written when the updates page is visited or its menu indicator is shown or expires.
Fields: theme and custom palette values
card and text size
sound, motion, contrast and control preferences
Klondike draw/winnable-deal settings and FreeCell settings
whether the one-tap hint was already shown
whether manually requested hint decisions should be logged to the browser console
which product-update announcement was last acknowledged and on which days its indicator appeared
Purpose: Restore the interface you selected
Avoid repeating an introductory hint
Enable local hint diagnostics when manually requested
Retention: The main settings record and theme cache remain until replaced or reset. The one-tap-seen and manually supplied hint-debug flags remain until individually removed or all site data is cleared; the in-game reset does not delete those auxiliary flags.
Deletion / control: The in-game reset restores the main settings and theme cache to defaults but does not delete the one-tap-seen or hint-debug flags. Clear site data in your browser to remove every record listed here.
Transfer: After account creation or sign-in, the documented gameplay and accessibility preference subset, including card size, can be uploaded automatically to the account API from the durably fenced guest import before the account browser namespace activates. The guest namespace remains authoritative until the final durable receipt and local activation state are stored. A guest namespace already linked to another account is not sent again. Consent, experiments, PWA state, hint state and shuffle history remain device-only. In the current bounded implementation, after a setting is successfully committed, a separate consent-gated GA4 event may report its name and a finite category; custom colours report only an edited-slot category. (verified in source code)
Verification: Settings, pre-paint restoration, and hint acknowledgement writes were traced. (verified in source code)
Legal-review status: The purpose statement is code-verified; the legal classification of each preference is pending counsel review.

Local progress and statistics

Active

Technology / records: localStorage · IndexedDB database: playsolitaire-progress · playsolitaire:stats:v1 · playsolitaire:daily:v1 · playsolitaire:daily:challenge:v1 · playsolitaire:recentlyPlayed:v1 · solitaire:timer:v1 and variant-scoped timer keys · sessionStorage: playsolitaire:timer-exit:v1:* · localStorage capability probe: playsolitaire:daily:probe
Provider: Your browser (first-party storage)
When it activates: On the first meaningful action, the legacy localStorage statistics and daily records are frozen as an immutable historical baseline in IndexedDB and a unique methodology-v2 start event is appended. One terminal event may then be appended for that attempt. Challenge links, clocks and recent games continue to use their listed localStorage records. When a game page exits, the clock writes one tab-scoped checkpoint for that save slot so same-tab navigation cannot add time spent on another page. The daily gate writes and removes its probe before using localStorage so it can detect whether durable local progress is available.
Fields: per-variant games played, wins, streaks, best time and fewest moves
historical localStorage aggregate snapshots, retained as a baseline and no longer mutated by methodology v2
pseudonymous attempt, deal and event identifiers derived from the game slot, rules, deal and start time
append-only start and terminal events with variant/mode, first-action category, outcome, move count and elapsed-time summary
daily date, streak, completion, time and moves
incoming daily challenge date, challenger target time and challenger move count
recent game identifiers and timestamps (maximum eight)
played-time snapshot keyed to the current game start
tab-scoped exit checkpoint containing the active browser namespace, game-save slot, attempt identifier, start identifier and elapsed time
temporary value used only to test whether localStorage can be written
Purpose: Show local records and daily progress
Restore the played-time clock
Show recently played games
Test localStorage availability before writing durable daily progress
Retention: The historical baseline and append-only progress events remain until you clear this site’s browser data; methodology-v2 events are not overwritten or calendar-expired. Other progress records remain until overwritten by newer records or site data is cleared. Each tab-scoped timer-exit checkpoint is overwritten by a later exit from the same game slot and disappears when that tab session ends. The daily storage-capability probe is written and synchronously removed during its check.
Deletion / control: Clear site data in your browser.
Transfer: After account creation or sign-in, the first-party account API can automatically receive a cumulative lifetime/daily projection of the verified local event ledger, up to eight recent game keys, and the elapsed-time value stored with each synchronized current or saved game. This durably fenced import may transfer before the account browser namespace activates; the guest copy remains authoritative until the final receipt and local activation state are stored. New automatic handoffs leave raw progress events in the guest browser namespace and retain only the bounded cumulative projection. A guest namespace already linked to another account is not sent again. Ongoing synchronization likewise retains only the latest cumulative rollup, event count and hash-chain checkpoint per browser namespace. A frozen legacy import that was already staged by an older release may retain up to 10,000 validated immutable raw progress events until the account is deleted. Daily challenge links and the browser timer records themselves remain device-only. New terminal result reports are also sent automatically for network daily rankings, as described separately. Consent-gated analytics are disclosed under GA4. (verified in source code)
Verification: Each local record shape and writer was traced. (verified in source code)
Legal-review status: The technical separation between local records and analytics is verified; legal-basis wording is pending counsel review.

Automatic network daily rankings

Active

Technology / records: IndexedDB: playsolitaire-progress / meta / rankings-outbox:* · Secure HttpOnly host-only cookie: __Host-ps-daily-guest · same-origin /api/rankings endpoints
Provider: Pasianssia network, Bunny CDN and the first-party application database
When it activates: New completed games automatically enter the shared daily activity rankings on every network publication. No registration or publication opt-in is required. Guests receive a stable generated nickname; accounts use a completed public nickname or a generated alias. The existing Daily guest cookie is reused. Account attachment requires both guest-cookie possession and an applied account-import receipt.
Fields: Public nickname, detected country flag, daily wins, win percentage, rank and source publication
Private opaque player, event, attempt and deal/rules identifiers, resolved outcome, time/move bounds and server acceptance day
Namespace-owned pending result reports and server acknowledgements
Purpose: Publish a shared daily activity ranking
Prevent duplicate wins and repeated-deal credit
Retry offline reports without mixing accounts
Retention: Public archive: 30 UTC days. Result receipts have one additional day of replay protection before cleanup. Expired reports cannot re-enter the board. Guest cookies renew for 30 days. Unacknowledged browser reports remain in the local queue until accepted, expired or site data is cleared. Existing private lifetime history is not backfilled.
Deletion / control: Clearing site data removes the browser identity and pending queue. Server account deletion removes its ranking history and attached guest rows. Guest server records expire with the archive and cleanup window.
Transfer: The browser sends results only to its current site. Each publication authenticates its own server requests to the shared ranking service. Only a country code verified from the originating edge is forwarded; no GPS location is requested. Public flags are served locally. This game function operates independently of analytics consent. (verified in source code)
Verification: Automatic queueing, publication-scoped authentication, country attestation, idempotent receipts and ownership checks are implemented in the rankings module. (verified in source code)
Legal-review status: This entry describes the requested automatic publication behavior and does not claim a separate legal review.

Tilin paikallinen synkronointijono

Active

Technology / records: IndexedDB database: playsolitaire-account-sync · stores: meta, queue, receipts, imports and snapshots · localStorage sentinel: playsolitaire:guest-import-fence:v1 · per-account localStorage namespace: playsolitaire:account-space:v1:* · sessionStorage: playsolitaire:account:modal-return:v1 (ten-minute exact-page OAuth popup return intent) · per-account progress stores in IndexedDB database: playsolitaire-progress
Provider: NM Median ylläpitämä sovellus ja yhteinen suojattu PostgreSQL-tietokanta; selaimen paikallinen tallennus.
When it activates: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa.
Fields: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa.
Purpose: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa.
Retention: Tilitiedot säilytetään tilin poistamiseen asti. Istuntoeväste on voimassa 30 päivää ja voi uusiutua käytön aikana. Poiston kuitti säilyy 30 päivää. Selaimen erilliset vierastiedot säilyvät, kunnes sivuston tiedot tyhjennetään.
Deletion / control: Tilivalikosta voit ladata tietosi tai poistaa yhteisen tilin. Poisto koskee koko verkoston tiliä, tallennuksia ja siihen liitettyjä tuloksia. Pelkän tämän sivuston selaintietojen tyhjentäminen ei poista palvelimella olevaa tiliä.
Transfer: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa. (verified in source code)
Verification: Tilien erottelu, synkronointi ja poistotoiminto on määritelty sovelluskoodissa. (verified in source code)
Legal-review status: Palveluntarjoajan säilytys- ja sopimusehdot sekä oikeudelliset arviot tarkistetaan erikseen.

PWA install offer state

Active

Technology / records: localStorage · playsolitaire:pwaInstallOffer:v2 · beforeinstallprompt and appinstalled browser events
Provider: Your browser (first-party storage)
When it activates: After EXP-3 settled on the install-chip treatment, the contextual offer is the shared product behavior on eligible free Klondike and Turn 3 pages. A valid browser install-prompt event is intercepted only after the prompt-state record can be written and read back; storage denial, failed readback, malformed events, installed display modes and excluded pages retain browser-default behavior. The state is updated for the bounded win-count fallback, first offer eligibility, explicit dismissal and a dismissed native prompt outcome. Daily games and other variants do not show the offer.
Fields: record version and product-state creation timestamp
install-offer snooze-until timestamp after explicit or native dismissal
at most two distinct pseudonymous credited-attempt identifiers when lifetime Klondike statistics cannot be read
first offer-eligible timestamp used to avoid reporting the eligibility stage twice
Purpose: Offer installation only after two credited Klondike wins
Honor the 14-day dismissal period without falling back to native promotion
Keep eligibility and dismissal behavior stable across page loads and tabs
Avoid duplicate install-offer eligibility reporting across page loads
Retention: The product record remains until you clear site data. An explicit or native dismissal suppresses the offer for 14 days. The record stores at most two fallback attempt identifiers and one first-eligible timestamp; later writes merge these bounded fields rather than growing an activity history.
Deletion / control: Clear this site’s browser data.
Transfer: The creation, snooze and eligibility timestamps and fallback attempt identifiers remain on-device. After analytics consent, separate bounded GA4 events can send the Klondike mode, install-offer stage and finite prompt outcome without an experiment arm; the local timestamps and attempt identifiers are never sent. (verified in source code)
Verification: Eligibility, fail-open prompt interception, EXP-3 state migration, two-win fallback, cross-tab convergence and snooze are registered to one browser-state writer. (verified in source code)
Legal-review status: The local/consent-gated technical separation is code-verified; product-state necessity, proportionality and analytics-consent wording remain pending counsel review.

First-game continuity record

Active

Technology / records: localStorage · playsolitaire:firstGame:v2 · sessionStorage: playsolitaire:firstGame:pagehide:v1 · localStorage capability probe: playsolitaire:firstGame:probe · sessionStorage capability probe: playsolitaire:firstGame:sessionProbe · first-party cookie: ps_first_game (fallback only)
Provider: Your browser and the Pasianssia origin for the fallback cookie
When it activates: The storage probes run before first-game assignment to test localStorage and sessionStorage availability. The continuity record is then created for first-game assignment, a short-lived session marker is written on pagehide when sessionStorage works, and the fallback cookie is used only when the localStorage probe fails.
Fields: random assignment identifier
variant and draw mode
golden-deal flag, optional seed, pool index and pool version
reserved/started/won/abandoned status
first-seen, start, end and return timestamps
analytics-sent flags
move and played-time summaries in localStorage only (omitted from the fallback cookie)
pagehide refresh marker containing the assignment identifier and pending-session end time in sessionStorage
temporary values used only to test whether localStorage and sessionStorage can be written
Purpose: Keep the first-game assignment and lifecycle idempotent across refreshes
Distinguish an immediate refresh from an abandoned session
Avoid duplicate first-session analytics
Test storage availability and decide whether the fallback cookie is required
Retention: The localStorage record has no calendar expiry. The sessionStorage refresh marker is cleared after a matching refresh or when the tab/session ends. Each storage-capability probe is written and synchronously removed during its check. The fallback cookie has a maximum age of 365 days. These records also disappear when you clear the relevant browser data.
Deletion / control: Clear this site’s local storage, session storage and cookies.
Transfer: The ps_first_game fallback cookie is sent in the Cookie header on same-site requests and therefore traverses Bunny CDN and the Hostinger origin as disclosed under site delivery. The localStorage record and sessionStorage refresh marker remain on-device. (verified in source code)
Verification: Record fields, sessionStorage refresh marker, cookie compaction and registry-fixed Secure/Lax 365-day maximum age were traced. (verified in source code)
Legal-review status: Whether the fallback cookie qualifies as strictly necessary in each jurisdiction is pending counsel review.

Analytics consent and opt-out choices

Active

Technology / records: localStorage: ps:consent:v1 · localStorage: ps:optout:v1 · sessionStorage: ps:analytics-denied:session:v1 · first-party cookie: ps_analytics_denied · BroadcastChannel: playsolitaire:privacy:v1
Provider: Your browser and the Pasianssia origin
When it activates: Read on every page. Written when you accept, reject, or use the analytics opt-out control.
Fields: analytics allowed/denied
decision timestamp
whether a non-GDPR geo result supplied an implied acceptance
opt-out/denial flags
Purpose: Enforce your analytics choice
Make rejection win across tabs and page reloads
Retention: The localStorage choice lasts until changed or cleared. The denial cookie has a maximum age of 365 days. The session flag ends with the browser tab/session.
Deletion / control: Change the choice through Cookie settings, or clear site data. Withdrawing consent also clears GA cookies that are visible to the site.
Transfer: The ps_analytics_denied cookie is sent in the Cookie header on same-site requests and therefore traverses Bunny CDN and the Hostinger origin as disclosed under site delivery. The consent script calls the first-party /api/geo endpoint without browser credentials when no choice exists. (verified in source code)
Verification: The denial-dominant state machine, registry-fixed cookie value/retention/security, storage and cross-tab paths were tested. (verified in source code)
Legal-review status: Regional consent requirements and any lawful basis for non-consented operational processing are pending counsel review.

Transient analytics-decision event queues

Active

Technology / records: in-memory JavaScript eventQueue · in-memory JavaScript pwaEventQueue
Provider: Your browser memory before an analytics decision; Google only after the state resolves to granted
When it activates: An attempted GA4 or PWA event is held in memory when the analytics decision is still unknown or the consented Google tag has not finished loading.
Fields: queued event name
queued event parameters from the gameplay, settings, first-game, CTA, sharing, video and PWA fields disclosed under Google Analytics
temporary PWA session-tracked flag
Purpose: Wait for the privacy decision before sending
Preserve event order while the consented Google tag loads
Prevent duplicate PWA session reporting
Retention: Memory only until the decision/navigation ends: denial clears both queues immediately; grant flushes queued events to GA4 and removes them from the arrays; a page unload discards remaining memory.
Deletion / control: Reject or withdraw analytics to clear the queues immediately, or leave/reload the page to discard page memory.
Transfer: No queued event is transferred while the decision remains unknown. If the decision becomes granted, queued fields are sent to Google under the GA4 entry; denial discards them without that transfer. (verified in source code)
Verification: Unknown, denied, granted, flush and page-lifetime queue paths were traced. (verified in source code)
Legal-review status: The pre-decision memory behavior is code-verified; any legal classification of transient in-memory processing remains pending counsel review.

Temporary content-to-game attribution

Active

Technology / records: sessionStorage: playsolitaire:content-origin:v1 · Web Crypto getRandomValues
Provider: Your browser (first-party session storage)
When it activates: Written only after analytics consent is currently granted and you use a trusted, unmodified, same-tab play link whose source, destination and analytics labels exactly match the English content registry on the production site. Staging, automated browsers, unknown consent, downloads, new-tab links and links with a query or fragment never create the record.
Fields: record version v (fixed at 1)
content_origin_id (the bounded source content identifier)
origin_cta_id (the bounded source link identifier)
content_origin_locale
target_game (the canonical intended playable-content identifier)
origin_click_id (ps_o_ plus 16 lowercase hexadecimal characters generated with Web Crypto)
clicked_at_ms (the local click time in milliseconds)
Purpose: Attribute one consented game start to the exact guide or research play link that led to it
Reconcile the generic click, dedicated content click and resulting game start without storing a browsing history
Retention: The record has a strict 30-minute lifetime. A later eligible click replaces it. A valid game_start consumes and removes it before analytics dispatch. Expired, future-dated, malformed, incompatible, denied-consent and non-production records are ignored and removed; sessionStorage also ends with the tab/session.
Deletion / control: Start the linked game, reject or withdraw analytics, wait 30 minutes, close the tab/session, or clear this site’s session data. Each of those paths removes or invalidates the record.
Transfer: The sessionStorage record itself remains on-device. When a valid record is consumed with analytics still granted, its bounded identifiers are copied into the consent-gated GA4 click and game_start fields disclosed below; clicked_at_ms is never sent. (verified in source code)
Verification: The exact CTA match, consent/production/trusted-navigation gates, cryptographic click identifier, 30-minute replacement/consumption rules and fail-closed game_start enrichment were traced and tested. (verified in source code)
Legal-review status: The bounded technical behavior and consent gate are code-verified; purpose, proportionality and any jurisdiction-specific classification remain pending counsel review.

Legacy compatibility records

Active

Technology / records: localStorage · solitaire:settings:v2 · solitaire:settings:v1 · playsolitaire:firstGame:v1 · solitaire:stats:v2 · solitaire:stats:v1 · solitaire:results:v1 · solitaire:recordedWins:v1 · solitaire:installPrompt:v1 · playsolitaire:consecutiveLosses:v1 · playsolitaire:ab:stats:v1 · playsolitaire:ab:pwaInstall:v1 · playsolitaire:pwaInstallPrompt:v1 · playsolitaire:ab:postWinOverlay:v1 · playsolitaire:ab:gameShell:v1 · playsolitaire:ab:gameShell:v2 · playsolitaire:ab:gameShell:v3 · playsolitaire:ab:gameShell:v4
Provider: Your browser (first-party storage)
When it activates: Older settings/statistics/first-game keys are read only when migrating settings or deciding whether a visitor has prior play history. The settled PWA install experiment arm is never read and the current install-offer module attempts to remove it during initialization. The settled post-win overlay and game-shell v1, v2, v3 and v4 records have no current reader or writer. The registered older install-prompt and consecutive-loss keys also have no current reader or writer.
Fields: older settings
older statistics/results/win markers
first-game-used flag
legacy install-prompt and consecutive-loss records if an older release wrote them
settled personal-best experiment arm (stats or control) if a 2026-07 release assigned one
settled PWA install experiment arm (install or control) and v1 prompt state until migration cleanup succeeds
settled post-win overlay arm (clear or shade) if an August or September 2026 release assigned one
settled game-shell v1, v2, v3 or v4 assignment data, including its version, arm, timestamps, cohort or exclusion reason when an earlier release wrote those fields
Purpose: Preserve rollback compatibility
Avoid treating an existing player as a first-time player
Disclose registered legacy keys even when the current release has no reader or writer for them
Retention: The settled PWA install assignment and v1 prompt state are removed best-effort after the prompt state migrates to the separate v2 product key. Inert post-win overlay assignment records remain until browser data is cleared. Inert game-shell assignment records and other existing values do too.
Deletion / control: Clear site data in your browser.
Transfer: The compatibility reads do not upload the legacy record contents. (verified in source code)
Verification: Only migration and prior-play reads remain for these keys. (verified in source code)
The older install-prompt, consecutive-loss, settled personal-best and post-win overlay experiment keys remain registered without current writers; the retired PWA experiment key has a removal-only owner, and game-shell v1/v2/v3/v4 remain registered without current readers or writers. (verified in source code)
Legal-review status: Retention proportionality for legacy values is pending counsel/product review.

Share sheet and clipboard actions

Active only after your interaction

Technology / records: Web Share API (navigator.share) · Clipboard API (navigator.clipboard.writeText) · legacy document.execCommand copy fallback
Provider: Your browser for clipboard operations; the application or person you choose in the operating-system share sheet for native sharing
When it activates: Only after you press a share or copy control. Touch-device result sharing can open the native share sheet; desktop result sharing and deal/guide citation controls copy to the clipboard.
Fields: result or challenge text, including applicable game/variant, time, moves, streak or daily result
Pasianssia page, challenge or numbered-deal URL
FreeCell deal number embedded in a copied URL
guide/citation text selected by the copy control
Purpose: Let you share a result or challenge through a destination you choose
Copy a deal URL, result, guide snippet or citation for reuse
Retention: Pasianssia does not retain a separate copy of the shared or copied payload. Clipboard history and a chosen share target may retain it under browser, operating-system or destination controls.
Deletion / control: Replace or clear your clipboard using browser/operating-system controls. For native sharing, use the chosen destination’s controls; Pasianssia cannot delete a payload after you send it there.
Transfer: Clipboard-only actions remain within browser/operating-system clipboard handling. Native sharing transfers the displayed payload only to the application or person you select; Pasianssia does not choose or receive that destination. (vendor or contract verification pending)
Verification: Every native-share and clipboard payload construction path was traced. (verified in source code)
Clipboard history and selected native-share destination retention depend on the browser, operating system and destination. (vendor or contract verification pending)
Any required legal wording for user-directed native sharing remains pending counsel review. (counsel review pending)
Legal-review status: The code-level user interaction and payload fields are verified; legal characterization of a user-selected destination remains pending counsel review.

Offline and performance caches

Active

Technology / records: Cache Storage · playsolitaire-precache-<service-worker-content-hash> · playsolitaire-runtime-<service-worker-content-hash>
Provider: Your browser (service worker)
When it activates: Created when the service worker installs and as same-origin pages or static assets are requested. Before a production guest import can freeze browser state, the active controlling worker must answer the version-1 guest-state protocol and there must be no waiting replacement worker.
Fields: site HTML
offline page
card images, fonts, icons and other static assets
request URL/path needed as the cache key
fixed guest-state protocol version and an ephemeral request identifier used only for the page/worker readiness exchange
Purpose: Provide offline recovery
Make repeat navigation and static assets faster
Prevent a guest import from starting under an older or overlapping service-worker protocol generation
Retention: Old Pasianssia cache versions are deleted when a new service worker activates. The current caches remain until replaced, evicted by the browser, or site data is cleared.
Deletion / control: Clear this site’s cached data/service worker storage in your browser.
Transfer: Cache Storage remains on-device. API responses and local game-save payloads are not cached by this service worker. (verified in source code)
Verification: Cache prefixes, allowlist, API bypass, old-version deletion and the guest-state protocol response were traced. (verified in source code)
Legal-review status: Any jurisdiction-specific storage disclosure classification is pending counsel review.

Optional account and synchronization

Vapaaehtoinen PlaySolitaire-verkoston tili

Active

Technology / records: Better Auth 1.6.25 · dedicated managed PostgreSQL over TLS · secure HttpOnly first-party session cookie
Provider: NM Median ylläpitämä sovellus ja yhteinen suojattu PostgreSQL-tietokanta; selaimen paikallinen tallennus.
When it activates: Sama sähköpostiosoite, salasana ja nimimerkki toimivat verkoston mukana olevilla sivustoilla. Jokaiselle sivustolle kirjaudutaan erikseen. Pelaaminen onnistuu edelleen ilman tiliä. Google-kirjautuminen ei ole käytössä.
Fields: Tilille tallennetaan sähköpostiosoite, salasanan suojattu tiiviste, nimimerkki, pelit, asetukset ja tulokset. Nimimerkki, maamerkintä ja tulokset näkyvät julkisessa sijoituslistassa; sähköpostiosoite ei näy.
Purpose: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa.
Retention: Tilitiedot säilytetään tilin poistamiseen asti. Istuntoeväste on voimassa 30 päivää ja voi uusiutua käytön aikana. Poiston kuitti säilyy 30 päivää. Selaimen erilliset vierastiedot säilyvät, kunnes sivuston tiedot tyhjennetään.
Deletion / control: Tilivalikosta voit ladata tietosi tai poistaa yhteisen tilin. Poisto koskee koko verkoston tiliä, tallennuksia ja siihen liitettyjä tuloksia. Pelkän tämän sivuston selaintietojen tyhjentäminen ei poista palvelimella olevaa tiliä.
Transfer: Selain säilyttää vieraan ja kunkin tilin tiedot erillään sekä jonottaa lähettämättömät muutokset. Kirjautuessa tämän selaimen aiempi vierasedistyminen voidaan liittää tilille. Synkronointi käyttää sivuston omaa rajapintaa ja verkoston yhteistä suojattua tietokantaa. (verified in source code)
Verification: Tilien erottelu, synkronointi ja poistotoiminto on määritelty sovelluskoodissa. (verified in source code)
Palveluntarjoajan säilytys- ja sopimusehdot sekä oikeudelliset arviot tarkistetaan erikseen. (operator verification pending)
Legal-review status: Palveluntarjoajan säilytys- ja sopimusehdot sekä oikeudelliset arviot tarkistetaan erikseen.

Site delivery and security

CDN, origin hosting and request handling

Active

Technology / records: Bunny CDN · Hostinger VPS · Caddy · Astro Node server · first-party POST /api/csp-report report-only collector · Docker journald driver with exact application tags; bounded systemd journal; legacy local syslog archives
Provider: Bunny.net and Hostinger; NM Media-operated application runtime
When it activates: Every request to the site and its first-party API routes.
Fields: IP address and connection metadata
requested URL, method and request headers including browser user agent and referrer when supplied
daily-share URL query fields when a recipient opens a result link: t (elapsed seconds), m (move count), and optional s (streak length)
response status and timing metadata
Cookie request headers when attached by the browser, including the compact ps_first_game record, ps_analytics_denied state, and consented _ga / _ga_* identifiers
edge-derived two-letter country code for /api/geo
Bunny ordinary request-log fields: IP address subject to the enabled API anonymisation setting, URL/path, country, user agent, referrer and status; this setting does not prove when the original IP address is erased
normalized Content Security Policy report fields: release/environment, policy version, document origin/path without query or fragment, effective and violated directive, disposition, response status, blocked target category/origin/path, source origin/path, and line/column numbers
Purpose: Deliver the site
Route and secure requests
Return a fail-closed regional consent verdict
Observe required-origin violations before deciding whether the report-only Content Security Policy can be enforced
Retention: The 2026-09-08 administrative check confirmed ordinary Bunny logging is enabled for Pasianssia, Pasianssia, Patienshuset and Pasianssia.jp, with IP anonymisation enabled (type 0), no forwarding, no permanent log storage and no extended logging. Bunny documentation describes raw-log retention of 3 days; API anonymisation does not establish original-IP erasure or retention of separate origin-error and security records. All seven publications use the journald driver on both origins. Production journald is configured for at most 7 days, 1 GB total and 1-day files. An early rsyslog rule excludes their exact application tags from new local syslog copies. Older syslog archives can remain until weekly rotation with four archives, potentially about 35 days. The checked Caddy configuration has no access-log or file writer. Hostinger platform/network-level retention remains externally unverified.
Deletion / control: New normalized CSP reports and container output follow the configured journal retention instead of an unbounded Docker JSON file. On 2026-09-08 all 28 current production containers had empty Docker LogPath values, and no Docker JSON log files were found in the standard container directory on either origin. This does not establish deletion of unknown historical copies outside that directory. Older syslog copies expire through the existing weekly rotation. Original-IP erasure and separate provider-record deletion remain unverified. The general contact and signed-in self-service paths do not establish a verified operator privacy-request register or response workflow; available deletion depends on the record and applicable law.
Transfer: Requests pass through Bunny CDN and the Hostinger-hosted origin. This includes daily-share t, m and optional s query fields when a recipient requests a shared result URL. Exact processing locations and transfer mechanisms are pending contract and provider-console verification. (operator verification pending)
Verification: The /api/geo data minimisation and no-store response were traced. (verified in source code)
The CSP collector accepts only bounded CSP media types, strips queries, fragments, samples, referrers and original policies, emits normalized one-line journal records, rate limits requests and returns no-store responses. (verified in source code)
Read-only Bunny GETs confirmed ordinary logging is enabled for Pasianssia, Pasianssia, Patienshuset and Pasianssia.jp, with IP anonymisation enabled (type 0); forwarding, permanent storage and extended logging are disabled. Spanish, German and Polish publication zones separately have ordinary logging disabled and anonymisation type 1. These settings do not prove original-IP erasure or separate provider-log retention. (verified through an administrative API)
Read-only checks found all 28 PS-family production containers using journald with exact application tags and empty Docker LogPath values. Both origins retain 7day/1G/1day journal limits and an early rsyslog exclusion for all 14 application tags. Caddy has no access-log or file writer. No Docker JSON log files were found in the standard container directory; older syslog archives remain under existing rotation. No synthetic log write or deletion of historical files was performed. (verified in the current deployment)
Hostinger platform/network logging and retention still require provider-console or contract verification. (operator verification pending)
Processor roles and international-transfer wording require contract and counsel review. (counsel review pending)
Legal-review status: Controller/processor roles, lawful basis, and transfer mechanism are not approved in this inventory and remain pending counsel review.

Analytics and error monitoring

Google Analytics 4

Technology / records: Google tag G-FBLH06X22S · www.googletagmanager.com/gtag/js · www.google-analytics.com/g/collect and region1.google-analytics.com/g/collect · cookies such as _ga and _ga_*
Provider: Google
When it activates: Loads only when the site’s denial-dominant privacy state machine resolves to granted on the production hostname. With no saved choice, a verified edge country outside the code’s GDPR-region set creates an implied grant; a configured-region or unknown result shows the banner. Staging, automated browsers and explicit rejection remain silent. Withdrawal prevents later events and clears queued events.
Fields: page URL, referrer, session and device/browser information collected by the Google tag
network-derived approximate location and request metadata processed by Google
Google user/session pseudonymous identifiers and consented GA cookies
game variant and mode, deal and attempt identifiers, move counts, elapsed-time summaries, outcome and resume events where emitted
bounded gameplay, first-game, settings, daily/share, navigation, feedback-success and PWA event parameters; feedback text and email are excluded from analytics events
bounded performance and diagnostic event parameters where the corresponding measurement is eligible
exact custom event parameter names permitted by the shared gateway: abandoned, action_path, action_type, actual_game_id, already_won, asset_id, asset_type, assigned_cell, assignment_id, attempt_id, beat, board_actions, board_actions_target_other, board_interactions, board_interactions_with_action_path, cache_duration_ms, connection_duration_ms, content_attribution_version, content_id, content_locale, content_origin_id, content_origin_locale, content_type, control_location, coverage_complete, cta_id, cta_location, dataset_version, day_key, deal_difficulty, deal_id, deal_mode, deal_number, deal_pool, destination_url, device_category, dns_duration_ms, draw_mode, effective_cell, element_render_delay_ms, error_kind, event_id, experiment_cell, experiment_version, feedback_type, file_format, first_game_move_count, first_game_played_ms, first_game_status, first_session_duration_ms, freshness, game, game_variant, goal, golden_deal, has_result, ineligible_reason, input_delay_ms, interaction_latency_ms, interaction_target, interaction_type, kind, lcp_target, length, link_placement, loading_latency_ms, loaf_count, loaf_support, loaf_total_paint_ms, loaf_total_script_ms, loaf_total_style_layout_ms, loaf_total_unattributed_ms, locale, longest_script_source_owner, longest_script_subpart, max_loaf_blocking_ms, message, method, methodology_id, methodology_version, metric_id, metric_name, metric_scope, mode, move_count, navigation_type, new_best, new_level, observed_interactions, orientation, origin_click_id, origin_cta_id, outcome, page_type, played_ms, played_time_basis, pool_index, pool_version, presentation_delay_ms, previous_level, processing_duration_ms, promo_id, pwa_display_mode, pwa_is_standalone, pwa_precached, pwa_service_worker_supported, rating, reason, release_sha, render_scope, renderer_outcome, reply, request_duration_ms, research_id, resource_load_delay_ms, resource_load_duration_ms, resource_page, resume_scope, resume_version, rollout_arm, scenario_id, seconds_to_goal, service_worker_status, setting_key, setting_value, shown_count, social_platform, start_seconds, streak_length, suit_mode, surface, target_content_id, target_game, target_url, their_t, time_to_first_byte_ms, trigger, ui_source, updated_pile_bucket, variant, video_id, viewport_class, viewport_range, waiting_duration_ms, win_streak, won
Purpose: Measure pages and game usage
Understand gameplay, settings and navigation interactions
Detect aggregate gameplay and performance problems
Retention: Retention, cookie lifetime and reset-on-new-activity settings for this Google Analytics property have not been verified. Google and the browser control retention of the records and cookies they receive or create.
Deletion / control: Reject or withdraw through Cookie settings to stop later events and clear visible GA cookies. Clearing site data also removes the saved browser choice. Requests concerning data already received by Google depend on the operator’s available records and the applicable Google controls.
Transfer: Consented analytics is sent to Google. Exact processing locations, Google entity/roles and international-transfer mechanism are pending contract and counsel review. (counsel review pending)
Verification: The publication uses its own measurement ID through the existing consent-gated event gateway. (verified in source code)
Property and stream identifiers, Enhanced Measurement, Google Signals, custom dimensions, retention and export settings for this measurement ID have not been checked in the Google Analytics Admin API. (operator verification pending)
Live cookie expiry and Google processing/subprocessor facts require browser and contract verification. (vendor or contract verification pending)
Legal-review status: Consent scope, lawful basis, Google configuration and transfer terms require operator and counsel review.

Contact delivery and abuse controls

SMTP feedback delivery

Active only after your interaction

Technology / records: in-game feedback form · POST /api/contact · SMTP_HOST · SMTP_PORT · SMTP_USER · SMTP_PASS · CONTACT_TO · Nodemailer
Provider: The operator-configured SMTP mailbox provider that receives messages for the site mailbox
When it activates: Data leaves the browser only after you open the in-game feedback form and press send. The endpoint processes a request only when every required SMTP runtime entry is configured, the PS_FEEDBACK_ENABLED runtime gate is active and, on deployed hosts, the edge attestation headers match.
Fields: message
optional email address
locale
page path
feedback type and entry point
game variant
for bug reports only: game mode, draw mode, seed or deal number, status, move count, deal pool/difficulty, viewport, browser user agent and release
mail transport metadata
Purpose: Deliver bug reports and suggestions to the site mailbox
Reply by email when an address is provided
Reproduce and diagnose reported game problems
Retention: The delivered email remains in the receiving mailbox until the operator deletes it; the application server stores no copy.
Deletion / control: Ask for deletion in the message itself or in a reply when you provide an email address; the operator deletes the mailbox copy. Anonymous feedback cannot later be linked back to you by the application.
Transfer: Submitting the form sends your message from the application server to the operator-configured SMTP provider over an authenticated connection for delivery to the site mailbox. (operator verification pending)
Verification: The contact and in-game feedback forms post to /api/contact through the first-party request gateway. The endpoint validates, rate-limits and forwards messages through SMTP without storing an application copy; feedback drafts remain only in page memory. (verified in source code)
Production release acceptance must confirm the required SMTP and destination variables are present in the protected production profile and that a monitored end-to-end submission is delivered to the configured mailbox. (operator verification pending)
Legal-review status: The contact reply purpose and feedback diagnostic disclosure are stated beside their forms. Provider, retention, DPA and transfer documentation must be kept current with the configured SMTP provider; formal privacy-request workflow wording remains pending counsel review.

User-initiated third-party content

External publisher and metadata links

Active only after your interaction

Technology / records: ordinary browser links to registered HTTPS destinations · non-fetching HTML and JSON-LD references to registered metadata destinations · https://pasianssia.fi/ · https://patience777.nl/ · https://patienshuset.se/ · https://playsolitaire.jp/ · https://solitario777.com/ · https://xn--solitr777-z2a.de/ · https://solitario777.it/ · https://pasjans777.pl/ · https://arxiv.org/abs/1906.12314 · https://nmmedia.lt/ · mailto:info@pasianssia.fi · https://pasianssia.fi/ · https://patience777.nl/ · https://patienshuset.se/ · https://playsolitaire.jp/ · https://solitario777.com/ · https://xn--solitr777-z2a.de/ · https://solitario777.it/ · https://pasjans777.pl/ · https://nmmedia.lt/ · https://schema.org/
Provider: NM Media when you choose its publisher link; Schema.org is referenced only as the structured-data vocabulary
When it activates: The publisher and schema URLs can appear as inert HTML or JSON-LD metadata, which does not itself contact the named destination in the browser. A browser navigation to NM Media opens only after you activate its link.
Fields: publisher and schema URLs embedded in page metadata without an automatic browser request
destination URL selected by you
IP address and browser/request headers, including a referrer when the browser supplies one, after HTTPS navigation
Purpose: Declare the publisher and structured-data vocabulary without automatically loading those destinations
Open NM Media publisher information after you choose its link
Retention: Pasianssia retains only a consented GA4 social-link click event as disclosed under Google Analytics; it does not retain a separate operational record of ordinary outbound navigation. Any destination request is controlled and retained by the selected browser and destination under their own terms.
Deletion / control: Use the selected destination controls. Pasianssia cannot delete a request held by a destination you chose.
Transfer: Metadata references remain values in the delivered page and do not themselves make a browser request. Only your activation navigates to a registered HTTPS destination, which then receives normal request metadata. (vendor or contract verification pending)
Verification: Every shipped external navigation and metadata destination is parsed from built output and matched to its typed registry. (verified in source code)
Destination logging, retention, account linking and deletion behavior are controlled by each selected destination. (vendor or contract verification pending)
Any jurisdiction-specific notice or lawful-basis wording for user-directed external navigation remains pending counsel review. (counsel review pending)
Legal-review status: The interaction gate and destination set are code-verified; destination processing and legal characterization are not presented as counsel-approved.

Analytics choice and withdrawal

Google Analytics loads only when the site’s current privacy state resolves to granted. An explicit rejection or opt-out wins over an earlier acceptance or a regional result. With no saved choice, a verified country outside the regional set currently configured in /api/geo creates an implied grant; a configured-region or unknown result shows the banner. The legal accuracy and legal basis of that regional behavior remain pending counsel review. You can reopen at any time. Withdrawal denies later GA collection, clears queued GA/PWA events and visible GA cookies, and saves the current game before any necessary reload.

Local data and browser controls

Clearing cookies alone does not remove localStorage, IndexedDB or Cache Storage. Use your browser’s “site data” control to remove the separate guest and per-account save namespaces, settings, local statistics, the account synchronization queue, privacy choices, service-worker caches and first-party cookies together. Account deletion removes the server copy but deliberately does not erase independent guest data in this browser.

Requests and applicable rights

Tilivalikosta voit ladata tietosi tai poistaa yhteisen tilin. Poisto koskee koko verkoston tiliä, tallennuksia ja siihen liitettyjä tuloksia. Pelkän tämän sivuston selaintietojen tyhjentäminen ei poista palvelimella olevaa tiliä.

No verified monitored channel for access, correction, deletion, restriction, objection, portability or other privacy requests is currently configured. Establishing that workflow and response process is an open operator/counsel item, not a service this notice claims is available today. Some on-device data can only be controlled through your browser because we do not receive the complete local record. Exact statutory rights, exemptions and response deadlines are pending counsel verification and are not expanded or limited by this technical notice.

Advertising, accounts and sale of data

The current application offers optional accounts as described in the inventory above. It has no active advertising, subscription or data-sale integration. Those separate features remain behind their own launch gates and require another notice update before activation.

Changes

A material data-practice change must update the typed inventory, its regression tests, this notice version and effective date before release. Historical Git versions provide the change record.