1. Who is responsible

Kryssordet.no and the Kryssordet app are operated by Nordapp AS(Norwegian org. no. 935 633 680), the data controller for the personal data described here. Questions can be sent to kontakt@kryssordet.no.

2. In short

• You can solve crosswords and play without an account. We then store no name or email.
• If you have an account, we store your email address and whether you have a subscription.
• Payment is made with Vipps or card. Card and account details are handled by the payment provider and never reach us.
• We use Google Ads to measure our own advertising and Cloudflare for anonymous visitor statistics.

3. Using the site without an account

Locally in your browser

Progress and settings are stored in your browser (localStorage), such as solved words, sudoku and solitaire progress, streaks and best times. This is not sent to us, and you can delete it at any time in your browser settings.

Usage statistics

To understand how the service is used, we record events such as a crossword being opened or completed, how many words were solved and time on page. Events are linked to a randomly generated id stored in your browser, not to your name, email or IP address. They are deleted automatically after 90 days. The legal basis is our legitimate interest in improving the service (GDPR Art. 6(1)(f)).

Play with a friend

If you use “Play with a friend”, a temporary session containing your crossword answers is stored. It contains no personal data and is deleted automatically after 48 hours.

Prize draws and enquiries

If you enter a prize draw, your email address is sent to kontakt@kryssordet.no. It is only used to contact the winner and is deleted once the draw is settled. Schools requesting a licence provide contact details, which we use to answer and invoice the request.

4. Account and sign-in

You need an account to subscribe. The account is created when you sign in with Google or with a sign-in link sent by email, or automatically when you buy a subscription with Vipps. We store:

• Your email address
• With Google sign-in: your name and profile picture as provided by Google
• When buying with Vipps: your email address and name, which you agree to share from your Vipps profile
• When the account was created and when you last signed in

The legal basis is our contract with you (GDPR Art. 6(1)(b)). The data is kept for as long as you have an account. A technical cookie keeps you signed in; it is required for sign-in to work and is removed when you sign out.

5. Subscription and payment

You can pay with Vipps or card:

• Vipps: You approve a recurring payment agreement in the Vipps app. Vipps MobilePay handles the payment, and we never see your card or account details. We store an agreement id, the status of the agreement and its charges, the amount and which period is paid.
• Card: Payments are handled by RevenueCat, with Stripe as payment provider. Your card details go directly to Stripe and we never see them. We store a RevenueCat customer id.

We also store whether you have an active subscription, which plan you have and when it expires.

The legal basis is our contract with you (GDPR Art. 6(1)(b)). Purchase records are kept for 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act (GDPR Art. 6(1)(c)).

6. The Kryssordet app

The app has no accounts. Progress is stored on your device. In-app purchases are made through the App Store, and Apple handles the payment. To check whether you have a subscription, the app uses RevenueCat with a randomly generated id that is not linked to your name or email. A subscription bought in the app applies in the app, and a subscription bought on the website applies on the website.

7. Cookies

Users without a subscription on the Norwegian site see ads served by Google AdSense. Google may use cookies to show and measure ads, and personalised ads are only shown with your consent. We also use Google Ads to measure our own advertising, and Cloudflare Web Analytics for anonymous visitor statistics without cookies.

The legal basis for advertising and measurement cookies is your consent (GDPR Art. 6(1)(a)), which you can withdraw at any time. See how Google uses data at policies.google.com. We also use a technical cookie that keeps you signed in (see section 4).

8. Data processors

We use these providers to run the service:

• Amazon Web Services – website hosting, usage statistics and sending email (EU, Stockholm)
• Supabase – accounts, subscription status and “Play with a friend” (EU, Ireland)
• RevenueCat – subscription management on the website and in the app (USA)
• Vipps MobilePay – Vipps payments and recurring payment agreements (Norway/EU)
• Stripe – card payments on the website (EU/USA)
• Google – sign-in (if you choose “Sign in with Google”), ads (AdSense) and ad measurement (Google Ads)
• Cloudflare – anonymous visitor statistics without cookies (EU/USA)
• Apple – payment in the app via the App Store

Transfers to the USA are based on the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

9. Your rights and deleting your account

Under the General Data Protection Regulation (GDPR) you have the right to:

• Access the data we hold about you
• Have data corrected or deleted
• Receive your data (data portability)
• Object to processing based on legitimate interest
• Complain to the Norwegian Data Protection Authority at datatilsynet.no, or to the authority where you live

To delete your account, email kontakt@kryssordet.no from the address linked to the account. We delete the account within 30 days. Purchase records we are required to keep under bookkeeping law are retained until the deadline expires. Remember to cancel any active subscription first.

10. Changes

This policy may be updated when needed. The date of the last change is shown at the top of the page. Significant changes will be clearly announced on the website.