Less data.
Plain terms.

Effective date: October 17, 2026. This notice describes current practices for the public pages at bdse.com and the browser-based Squares and Crossword apps served from this site. If a separate BDSE service collects information under a separate sign-up or service flow, that service may provide additional terms or a separate privacy notice.

1. Scope and definitions

In this notice, “BDSE,” “we,” “us,” and “our” mean the operator of bdse.com. “Personal information” means information that identifies, relates to, describes, or could reasonably be linked to an individual or household, as that term is defined by applicable law. “Processing” includes collecting, recording, storing, consulting, using, disclosing, securing, and deleting information. This notice applies to information processed by BDSE through the covered website and its browser apps. It does not govern websites or services operated by others, even when a BDSE page links to them.

2. Information received when a page is requested

When a visitor requests a PHP page, BDSE’s site software writes a page-request record for basic operation, traffic review, troubleshooting, and security. Each record may contain the request time in Coordinated Universal Time (UTC), the source IP address, HTTP method, requested path without its query string, referring URL limited to its scheme, host, port, and path, browser user-agent string, and accepted language. A page request is not a verified person or unique visitor; one person or device can create many records, and multiple users may share an address or device.

The BDSE page-request log does not intentionally record request bodies, form contents, password values, authorization headers, URL query parameters, or URL fragments. The private administrative dashboard may record its own page request, but its login credential values are not fields in the BDSE page-view record. The web-hosting provider may separately generate technical access, error, or security logs under its service terms; those provider logs are not controlled by BDSE’s application-level retention setting.

3. Browser storage and app activity

The Squares and Crossword apps run in your browser. The Crossword app can save your selected difficulty and “don’t ask again” preference, plus a local play record consisting of puzzle starts, solves, and best elapsed time by difficulty. That play record does not contain your name, email address, IP address, puzzle answers, or a server account identifier. It is stored in this browser’s local storage and is not sent to BDSE’s server by the app.

Squares may store whether its opening notice was accepted in local storage. Board text is held in the browser while you create it. If you choose “Copy share link,” the board title and square text are encoded in the URL fragment so another person opening that link can see the board. The browser normally does not include a URL fragment in its HTTP request to the server; the app reads it locally to display the shared board. Anyone who receives the link can view its contents, so do not put confidential or identifying details in a board you intend to share.

Local storage remains on the browser profile until it is cleared, the browser removes it, or the app’s storage is otherwise reset. You can clear the Crossword record with “Clear my stats,” or remove site storage through your browser’s site-data controls. We do not receive a deletion signal when you clear local storage.

4. Accounts, cookies, and analytics

The covered browser apps do not require a user account and do not ask for a player name, email address, location, contacts, or payment details. BDSE’s application code does not set advertising or analytics cookies, use tracking pixels, sell behavioral profiles, or send Crossword scores to an analytics service. Your browser and the hosting infrastructure may use or create technical data needed to deliver a secure connection and serve the requested page. The browser may also retain credentials for the separately protected administrative page according to your own browser settings.

5. Purposes and limits on use

BDSE uses information under its control only as reasonably necessary to provide and maintain requested site functionality; count page requests and understand which site sections are used; diagnose errors and improve reliability; detect, investigate, prevent, or respond to abuse, fraud, unauthorized access, or other security incidents; administer the password-protected visit dashboard; comply with a legal obligation or valid legal process; and establish, exercise, or defend legal rights. Where applicable law requires a stated legal basis, processing is limited to delivering a feature you request, BDSE’s legitimate interest in operating and securing the site (balanced against applicable individual rights), compliance with law, or consent where that is required. We do not use the visitor log or the Crossword play record to advertise to you, make automated decisions about you, build a marketing profile, or determine eligibility for a service.

6. Disclosure and limited service-provider access

BDSE does not sell personal information, license it to data brokers, or disclose it to another business for that business’s own advertising or unrelated purposes. Our hosting and infrastructure provider, currently IONOS, necessarily processes connection and request information to transmit pages, operate the server, and provide network and security functions. Such processing is limited to service delivery and the provider’s applicable service terms. Personnel or contractors may receive access only when reasonably needed to administer, troubleshoot, secure, or support the site and should be subject to confidentiality and access restrictions.

BDSE may disclose information when reasonably necessary to comply with applicable law, court order, or valid legal process; protect the rights, property, safety, or security of BDSE, users, or others; investigate suspected unlawful conduct or a security incident; or support a merger, reorganization, or transfer of the covered service, subject to applicable privacy obligations. These limited operational or legally required disclosures are not a sale of personal information or permission for independent marketing use.

7. Retention and disposal

The BDSE application-level visitor log rotates when its active file reaches approximately one mebibyte (MiB) and retains up to five rotated archives in addition to the active file. The oldest archive is removed as later files rotate. This is a storage-size limit, not a fixed number of days; actual duration depends on traffic. The logs are stored in the site’s restricted data directory, which is denied direct web access, and the private dashboard requires administrator authentication over HTTPS. BDSE may delete retained log data sooner when it is no longer needed, subject to security, legal, and record-preservation needs.

Crossword preferences, play counts, solve counts, and best times are held locally by your browser until cleared as described above. Shared Squares content remains in a link only for as long as that link is retained or copied by you or someone with whom you share it; BDSE does not keep a server-side copy of the board through the share-link feature.

8. Safeguards and security limitations

BDSE uses reasonable administrative, technical, and organizational safeguards proportionate to the limited information collected. Current measures include HTTPS for the website and administrative dashboard, access controls for the visit dashboard, password verification using a one-way password hash, web-server rules that restrict direct access to log and configuration files, response security headers where supported by the hosting environment, limited collection, and size-based log rotation. We review and update these measures as the site and available security practices change.

No website, network, storage medium, or security measure can be represented as perfectly secure. Internet transmission and electronic storage involve residual risk, and an unauthorized actor may circumvent safeguards. BDSE does not warrant that an incident can never occur; we do undertake to maintain reasonable safeguards and to respond to suspected incidents as described below.

9. Security incidents and breach notification

BDSE maintains an incident-response process intended to identify and assess suspected compromise, contain ongoing access, preserve relevant evidence, determine the systems and categories of information affected, remediate the cause where feasible, and assess applicable notification duties. If a security incident compromises personal information under BDSE’s control, we will provide notices to affected individuals and authorities when and as required by applicable law, including the Michigan Identity Theft Protection Act, MCL 445.72, where applicable. We will provide required notice without unreasonable delay, subject to legally permitted delay for investigation, containment, or law-enforcement direction.

Where we hold a reliable contact channel for an affected person, we will use an appropriate channel to provide any required notice. The covered apps do not collect email addresses or create user accounts, so BDSE may not be able to identify or directly contact every person whose only information was present in an anonymous request log. Where direct notice is unavailable or not legally required, BDSE will use another notice method permitted or required by applicable law. A notice will describe the incident and affected information to the extent reasonably known, response steps, protective actions users may take, and a way to obtain further information.

10. Requests, choices, and browser controls

You may stop using the site at any time, clear local app data in your browser, or request that BDSE review a privacy concern. Where applicable law grants access, correction, deletion, or other rights, BDSE will assess and respond to a sufficiently specific request as required by that law. Because the site does not create user accounts and the visit log is not linked to a named profile, we may be unable to locate a particular person’s records without information that identifies the relevant request. We may retain information where required or permitted for security, legal compliance, or the establishment, exercise, or defense of claims.

11. Third-party websites and services

A link from BDSE to another website is provided for convenience and does not place that website under this notice. When you follow an external link, the other operator’s privacy terms and practices apply. The hosting provider’s own data practices are governed by its service agreement and privacy notice. BDSE does not control those separate systems.

12. Updates and contact

BDSE may amend this notice as the site, its data practices, or applicable law changes. The “effective date” above will be revised when a material update is posted. Continued use after an updated notice is posted constitutes notice of the revised terms; where consent is legally required for a new practice, BDSE will obtain that consent through an appropriate process.

For privacy questions or requests, contact BDSE at bdse@bdse.com. Please do not send passwords or sensitive personal information by ordinary email.

This notice is intended to describe BDSE’s current information practices and is not a representation that every privacy law applies uniformly to every visitor. Rights, remedies, and notification duties depend on the facts and governing law. The references to applicable law do not waive any rights or defenses available to BDSE.