Updated 16th September 2026
HeadScratcher is committed to protecting and respecting your privacy. This policy explains how personal data is collected, used, stored and protected when you use the HeadScratcher website, mobile applications and related services ("the Services"). Please read the following carefully to understand how your personal data is handled.
For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, Andrew Retmanski ("HeadScratcher", "we", "us" or "our") is the data controller.
1. Collection and Processing of Personal Data
1.1 We collect and process personal data from users of the HeadScratcher website, mobile applications and related services.
2. Information processed about individuals
We may collect and process the following information:
2.1 Information you provide when creating or managing an account, including your email address and account credentials;
2.2 Puzzle progress, preferences, settings and other information required to provide and synchronise your experience across supported devices;
2.3 If you contact us, a record may be kept of that correspondence;
2.4 You may be asked to complete surveys used for research purposes, although you do not have to respond to them;
2.5 Details of purchases, subscriptions or other transactions carried out through the Services;
2.6 Details of your use of the Services including, but not limited to, traffic data, navigation, usage logs, diagnostic information and the resources you access; and
2.7 Any information reasonably incidental to that listed above.
3. Retention & Deletion
HeadScratcher retains your information while you remain an active user, unless you ask us to delete your information. If you stop being an active user, your information may be retained where reasonably necessary for legal, security, operational or legitimate business purposes.
Account information and puzzle progress are normally retained until your account is deleted, unless a longer retention period is required for legal, security or legitimate business purposes.
If you have requested information from us, your information may be retained until you request that it is removed or deleted. Subject to the exceptions described below, your information will be deleted or anonymised upon request.
Subject to applicable law, we may retain information after account deletion:
3.1 If there is an unresolved issue relating to your account;
3.2 If necessary for legitimate business interests, such as fraud prevention or maintaining the security and integrity of the Services;
3.3 If required by applicable law; and/or
3.4 In aggregated and/or anonymised form.
4. Cookies and similar technologies
4.1 The HeadScratcher website uses technologies such as cookies and localStorage. The mobile applications may use secure on-device storage and similar platform technologies. These technologies help the Services function correctly, remember preferences, maintain sign-in sessions, synchronise progress where applicable, and measure usage as described in Section 8.
4.2 To find out more about cookies, including how to control and disable them, please visit https://www.allaboutcookies.org.
4.3 You may refuse to accept cookies by activating settings on your browser. If you refuse all cookies, you may be unable to access certain features of the website. Similar storage used within the mobile applications may be cleared through your device or application settings where supported.
4.4 HeadScratcher does not use third-party advertising or analytics services that set tracking cookies or similar tracking technologies.
5. Where individuals’ personal data is stored
Personal data may be transferred to, stored or processed outside the United Kingdom (UK) or the European Economic Area (EEA). It may also be processed by carefully selected cloud service providers or suppliers acting on our behalf. Whenever personal data is transferred internationally, appropriate safeguards will be used to help ensure it remains protected in accordance with applicable data protection law.
6. Security and Control of Data
6.1 Information you provide to us through the Services is stored using appropriate technical and organisational safeguards.
6.2 Please note that transmission of information via the internet is not completely secure. Although we endeavour to protect your personal data, the security of data transmitted to or from the Services cannot be guaranteed. Once we have received your information, we use appropriate procedures and security features designed to reduce the risk of unauthorised access, loss, misuse or disclosure.
7. How your information is used
7.1 We use information held about you in the following ways:
7.1.1 To ensure that content from the Services is presented effectively for you and your device;
7.1.2 To provide you with information, products or services that you request or which may interest you, where you have consented to be contacted for such purposes;
7.1.3 To carry out obligations arising from any contracts entered into between you and us;
7.1.4 To allow you to participate in interactive features of the Services, when you choose to do so;
7.1.5 To notify you about changes to the Services;
7.1.6 To tailor aspects of the Services and interactions with you according to your preferences and usage;
7.1.7 To synchronise puzzle progress, subscriptions and account information across supported devices where applicable; and
7.1.8 To maintain the security, integrity and reliability of the Services.
7.2 If you are an existing customer, you will only be contacted with information about goods and services similar to those which were the subject of a previous sale to you, where permitted by law.
7.3 We do not disclose personal information about individuals to advertisers or sell your information to any other organisation for marketing purposes.
8. Analytics and Usage Data
The Services use first-party analytics to understand how users interact with HeadScratcher and to improve content, features, reliability and performance. Analytics information is associated with pseudonymous identifiers stored using first-party technologies appropriate to the platform. No external analytics providers or third-party tracking scripts are used.
8.1 Data collected may include a pseudonymous visitor or device identifier, pages or screens viewed, navigation paths, referring information, UTM parameters, timestamps, approximate location derived from IP address where applicable, and technical information about the browser, device, application version or operating system.
8.2 This processing is carried out for legitimate interests, specifically monitoring performance, understanding usage patterns, improving the Services and maintaining security. Consent will be requested where required by law.
8.3 First-party analytics technologies are used only by HeadScratcher. They help distinguish repeat use without directly identifying you. Where possible, you may disable these technologies through your browser or device settings, although parts of the Services may not function as intended.
8.4 Visit and event information is retained for a limited period, typically up to 13 months, before being deleted or anonymised. See Section 3 (Retention & Deletion) for general data-retention principles.
9. Purchases and Subscriptions
9.1 Purchases made through the iOS application are processed by Apple using its App Store payment system. We do not receive or store your full payment card details.
9.2 Information relating to purchases and subscription status may be received from Apple where necessary to provide access to subscription features, restore purchases, manage entitlements or provide customer support.
9.3 Purchases made through other supported platforms or payment providers may be processed by those providers in accordance with their own privacy policies and terms.
10. Sharing your information
10.1 We may disclose your personal information to third parties if:
10.1.1 We sell or buy any business or assets, in which case your personal data may be disclosed to the prospective seller or buyer of such business or assets;
10.1.2 HeadScratcher or substantially all of its assets are acquired by a third party, in which case personal data held about users may be one of the transferred assets;
10.1.3 We are under a duty to disclose or share your personal data in order to comply with any legal obligation, enforce or apply our terms and conditions or other agreements, or protect the rights, property or safety of users or others; or
10.1.4 It is necessary to supply the Services to you.
Analytics data collected through first-party technologies remains within systems controlled by or operated on behalf of HeadScratcher and is not shared with external analytics vendors.
10.2 You have the right to ask for your personal data not to be processed for marketing purposes. We will usually inform you before collecting your data if it is intended to be used for such purposes or disclosed to a third party for such purposes. You can also exercise this right at any time by contacting [email protected].
11. Links to other sites and services
The Services may, from time to time, contain links to and from websites or services operated by partners, advertisers, affiliates or other third parties. If you follow one of these links, please note that those services have their own privacy policies and that we do not accept responsibility or liability for those policies. Please check the relevant privacy policy before submitting personal data to a third-party service.
12. Accessing your information
Data protection law gives you the right to access information held about you. You can find out whether personal information is held about you by making a data subject access request under the UK GDPR. If information is held about you, we will:
12.1 Give you a description of it;
12.2 Tell you why it is being held;
12.3 Tell you who it could be disclosed to; and
12.4 Provide you with a copy.
Any formal subject access request should be made in writing using the contact details below. This will normally be provided free of charge. However, we may charge a reasonable fee for repetitive, unfounded or excessive requests, or for additional copies where permitted by law.
13. How can you update, change or delete your information?
13.1 If at any time you wish to change or correct your information, you can contact us and provide the updated information.
13.2 If you wish to opt out of marketing email notifications and communications, you can contact us and you will not receive further marketing communications.
13.3 If you have an account, you may request that your account and associated personal data be deleted. Requests can be made by contacting [email protected]. Some information may be retained where required by law or for legitimate business purposes as described in Section 3.
14. Data subject rights
14.1 Right to rectification — the right to request that inaccurate personal data is corrected.
14.2 Right to object — the right to object to processing based on legitimate interests or public interests. Processing must stop unless compelling legitimate grounds for continuing the processing can be demonstrated or the processing is necessary in connection with legal rights.
14.3 Right to object to direct marketing.
14.4 Right to erasure — the right to request deletion of personal data without undue delay where one of the following applies:
14.4.1 The data is no longer necessary for the purpose for which it was collected;
14.4.2 You withdraw consent where consent is the legal basis for processing;
14.4.3 There are no overriding legitimate grounds for continuing processing following a valid objection;
14.4.4 Processing was unlawful; or
14.4.5 Erasure is necessary to comply with applicable law.
14.5 Right to restrict processing — the right to request restriction of processing where:
14.5.1 The accuracy of the data is contested;
14.5.2 Processing is unlawful and you request restriction instead of erasure;
14.5.3 We no longer need the data for its original purpose, but you require it for legal claims; or
14.5.4 An objection to processing is pending.
14.6 Right to data portability — where applicable, the right to receive a copy of personal data you have provided in a structured, commonly used and machine-readable format and to transmit that data to another controller.
15. App permissions and device features
15.1 The mobile applications may request access to device features, such as notifications, only where this is required to provide a feature you choose to use.
15.2 Where permission is requested by your device operating system, you can grant or refuse that permission and may later change your choice through your device settings.
16. Changes to this privacy policy
Any changes made to this privacy policy in the future will be posted on this page. Where appropriate, significant changes may also be communicated through the Services.
17. Contact
Questions, comments and requests regarding this privacy policy are welcomed and should be addressed to [email protected].