谜录物语

隐私政策

本站如何收集、使用与保护你的数据。

更新日期：2026 年 8 月 5 日 · Last updated: August 5, 2026 · 中文 / English

一、概述与适用范围

本站（puzzlehunt.edu.estate，下称「本站」）是一个免费、非商业的 PuzzleHunt 爱好者存档与工具网站，由个人维护。本隐私政策说明本站收集哪些信息、如何使用与存储，以及你享有的权利。使用本站即表示你已阅读并同意本政策。

二、我们收集哪些信息

未登录使用

浏览记录、做题进度、收藏、成就、主题偏好等数据仅保存在你的浏览器本地（IndexedDB / localStorage），不会上传到服务器。不登录也可以正常使用本站的全部浏览功能。

登录时

本站支持 Google 或 GitHub 账号登录（OAuth）。登录时，本站从登录提供方获取并保存：邮箱地址、昵称、头像 URL。本站不会获取你的密码，也不会请求基本资料之外的任何权限。登录凭证（JWT）仅保存在你的浏览器 localStorage 中，有效期 30 天。

登录后云同步

登录后，以下数据会同步到本站服务器（Cloudflare D1 数据库）以支持多设备合并：做题进度、收藏、成就；你发表的评论与建议；你设置的自定义用户名。

基础设施日志

本站托管于 Cloudflare，静态资源经阿里云 CDN 分发。上述服务商会按其标准做法记录访问日志（如 IP 地址、User-Agent），用于安全防护与故障排查。本站不将这些日志用于用户画像或广告。

三、Cookie

本站仅在登录流程中使用一个有效期 10 分钟的一次性 stateCookie（pzh_oauth），用于防范跨站请求伪造。本站没有广告 Cookie、跟踪Cookie，也没有接入任何第三方统计分析服务。

四、Google 用户数据使用声明

对于通过 Google 登录获得的信息，本站遵守 Google API 服务用户数据政策（Google API Services User Data Policy），包括其「有限使用（LimitedUse）」要求：

  • 仅获取你的 Google 账号邮箱、昵称与头像，仅用于账号识别与站内展示；
  • 不出售这些数据，不将其用于广告；
  • 除为运行本站所必需的基础设施服务商（见下节）外，不向任何第三方转移这些数据；
  • 除非获得你的同意、出于安全目的或法律要求，不会由人工读取这些数据。

五、数据存储与第三方服务

  • Cloudflare：网站托管与数据库（Pages / D1）——云同步数据、账号信息；
  • 阿里云：静态资源 CDN——访问日志；
  • Google / GitHub：第三方登录——仅在你选择用其登录时参与。

本站不与上述之外的任何第三方共享你的个人信息。

六、数据保留与你的权利

  • 云端数据在你的账号存续期间保留；
  • 你可以随时在「我的」页面退出登录、解绑某个登录方式；
  • 清除浏览器站点数据即可删除全部本地数据；
  • 如需删除云端账号及全部数据，或行使其他数据权利，请通过下方联系方式与本站联系，会在合理时间内处理。

七、未成年人

本站面向一般公众，不针对未成年人设计，也不会有意收集未成年人的个人信息。

八、联系方式

九、政策变更

本政策如有重大变更，会更新本页并调整页首的「更新日期」。变更后继续使用本站即视为接受更新后的政策。

1. Overview & Scope

This site (puzzlehunt.edu.estate, the "Site") is a free, non-commercial puzzle hunt archive and toolbox maintained by an individual. This Privacy Policy explains what information the Site collects, how it is used and stored, and the rights you have. By using the Site you agree to this policy.

2. What We Collect

Without signing in

Your progress, favorites, achievements and preferences are stored only in your browser (IndexedDB / localStorage) and are never uploaded. All browsing features work without an account.

When you sign in

The Site supports Google and GitHub OAuth sign-in. On sign-in we obtain and store your email address, display name and avatar URL from the provider. We never see your password and request no permissions beyond basic profile information. The sign-in credential (a JWT valid for 30 days) is stored only in your browser's localStorage.

Cloud sync after sign-in

After signing in, the following data is synced to the Site's server (a Cloudflare D1 database) to merge across devices: progress, favorites and achievements; comments and suggestions you post; your custom username.

Infrastructure logs

The Site is hosted on Cloudflare, with static assets served via Alibaba Cloud CDN. These providers keep standard access logs (such as IP address and User-Agent) for security and troubleshooting. The Site does not use these logs for profiling or advertising.

3. Cookies

The Site uses a single short-lived state cookie (pzh_oauth, 10 minutes) during the sign-in flow to prevent CSRF. There are no advertising or tracking cookies and no third-party analytics.

4. Google User Data & Limited Use

For information obtained via Google sign-in, the Site complies with the Google API Services User Data Policy, including its Limited Use requirements:

  • only your Google account email, name and avatar are obtained, used solely for account identification and display on the Site;
  • this data is never sold and never used for advertising;
  • it is not transferred to third parties other than the infrastructure providers listed below, as required to operate the Site;
  • no human reads this data except with your consent, for security purposes, or where required by law.

5. Storage & Third-Party Services

  • Cloudflare: hosting and database (Pages / D1) — synced data and account information;
  • Alibaba Cloud: static asset CDN — access logs;
  • Google / GitHub: OAuth sign-in — involved only when you choose to sign in with them.

Your personal information is not shared with anyone else.

6. Retention & Your Rights

  • Cloud data is retained for as long as your account exists;
  • you can sign out or unlink a sign-in provider at any time on the "Me" page;
  • clearing your browser's site data removes all local data;
  • to delete your cloud account and all associated data, or to exercise other data rights, contact us below and we will respond within a reasonable time.

7. Children

The Site is intended for a general audience and does not knowingly collect personal information from children.

8. Contact

9. Changes

Material changes to this policy will be reflected on this page with an updated "Last updated" date. Continued use of the Site after changes constitutes acceptance.