Privacy Policy

CatholicWorld is operated by Paweł Szczabel, a sole proprietorship registered in Poland, tax identification number 9910361892, address Wygonowa 51/2A, 45-402 Opole, Poland. This makes Paweł Szczabel the controller of your personal data under the General Data Protection Regulation (GDPR).

For anything in this policy, write to pawelszczabel@gmail.com.

This policy covers catholicworld.eu and both products behind it, CatholicNews and CatholicGames, which share one account. It does not cover the pages our payment providers, Easytools and Stripe, show you during checkout — those run under their own privacy policies, linked from section 10.

Four kinds of information, depending on how you use CatholicWorld:

• What you give us: your email address, a password (we store only a salted hash of it, never the password itself), and a nickname if you play on the leaderboard.
• What using the product creates: puzzle attempts, results, completion times, how many hints you used, your streaks, badges, and any leaderboard entries.
• Technical data: a salted, daily-rotated hash of your IP address, used only to prevent abuse (see section 12), and your browser family.
• What our providers tell us: when you buy a subscription, Easytools passes us your name, postal address, and country, because we are the seller and the law requires that on an invoice — alongside payment status, plan, and invoice number, from Easytools and Stripe. Resend tells us delivery status, opens, and clicks.

We never collect your card details. Payment card numbers go directly to Stripe and never reach our servers.

We also deliberately do not collect some things most sites do, because CatholicWorld does not need them:

Every purpose below rests on one of four legal bases: your consent, the performance of a contract with you, a legal obligation we are under, or our legitimate interest, balanced against your rights.

We use cookies and browser local storage in three layers: necessary (cannot be switched off — the service does not work without it), analytics (off until you say yes), and marketing (off until you say yes, and switched off automatically if your browser sends a Global Privacy Control signal). No tracking script in the analytics or marketing layer loads before you make a choice.

You can change your choice any time from "Manage cookies" in the footer of every page. The full table — every cookie and local-storage item by name, what it does, and how long it lasts — is in our Cookie Policy.

You can play any of the four daily puzzles without creating an account and without giving us your email address. Your progress is stored in your browser.

A leaderboard identity (player_token) is created only the moment you ask a game to save your progress or submit a result — never just by visiting or opening a puzzle. It is not used to track you across other websites.

Because this data lives in your browser, clearing your browser's storage clears your progress too. We warn you about this the first time you save progress, not afterwards.

The BibCross Mini leaderboard needs no account and is anonymous: your identity there is a random player_token, never your email address or account. Your nickname and completion time are public once you choose to submit them; your account and email address are never shown.

We do not store your IP address, in any form, against a leaderboard entry. A hashed IP address is used elsewhere, solely to prevent abuse — see section 12 — and is deleted after 7 days. Every completion time on the leaderboard is measured by our server, not your device.

Subscribing to CatholicNews uses double opt-in: after you submit the form, we send a confirmation link, valid for 48 hours and usable once. You are only added to the list once you click it.

We measure whether you open each edition and which links you click, to keep the newsletter worth reading. You can unsubscribe with one click, from a link in every email, with no need to sign in. Ninety days without opening a single edition triggers a re-confirmation request rather than a silent removal.

We use PostHog for product analytics, hosted in the European Union. With your separate consent, we also use Meta Pixel (Facebook and Instagram), TikTok Pixel, and X Pixel to measure the performance of our advertising. None of these load before you consent to the relevant layer in the cookie banner.

You can withdraw consent at any time from "Manage cookies" in the footer. If your browser sends a Global Privacy Control signal, we treat it as an immediate withdrawal of marketing consent, without asking again.

We do not sell your data, and we never upload the CatholicNews mailing list to an advertising platform. We do share data with the following providers, to the extent each one needs to do its job for us:

Several of the providers above process data in the United States — most importantly Convex, which means the database behind the whole service, not just a part of it, is processed in the United States. Where a provider processes data outside the European Economic Area, we rely on the European Commission's standard contractual clauses, or on the provider's certification under the EU-US Data Privacy Framework.

To ask for a copy of the safeguards that apply to a particular transfer, write to pawelszczabel@gmail.com.

Retention periods for every purpose are listed in section 4. The figures people ask about most:

Under the GDPR, you have the right to:

• Access the data we hold about you.
• Rectify data that is wrong or incomplete.
• Erase your data, once we no longer need it for the purpose it was collected for.
• Restrict processing, in defined cases.
• Receive a copy of the data you gave us, in a machine-readable format (data portability).
• Object to processing based on our legitimate interest, or to marketing at any time, for any reason or none.
• Withdraw consent at any time, without affecting anything we did before the withdrawal.
• Complain to the Polish data protection authority, the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

Write to pawelszczabel@gmail.com. We acknowledge your request within 72 hours and resolve it within 30 days. We do not ask for a copy of your ID — a code sent to your account email, a confirmation link, or your browser's player_token is enough to verify who you are, depending on what your request is about.

Deleting your account removes your streak and statistics permanently — we warn you about this, with the exact number of days at risk, before you confirm. Deletion has a 7-day grace period during which you can still recover the account; after that it is permanent. Your past puzzle attempts are kept in anonymised form, disconnected from you, because we use them to judge how hard a puzzle turned out to be.

If you are a California resident, or a resident of another US state with its own privacy law, you have the right to know what personal information we collect, to delete it, to correct it, and to opt out of its "sale" or "sharing" — which, in our case, means the data our advertising pixels send when you have consented to the marketing layer of cookies.

Use the "Do Not Sell or Share My Personal Information" link in the footer of every page to opt out immediately. We also honour the Global Privacy Control signal automatically, without you having to visit that link at all. Opting out never changes the price or scope of the service you get from us — we have no paid tier that depends on tracking in the first place. We respond to a verified request within 45 days.

You must be 16 or older to create a CatholicWorld account. We ask you to confirm this with an unticked checkbox at signup; we do not collect your date of birth and do not verify your age with a document.

A child can still enjoy CatholicWorld safely: playing any daily puzzle needs no account and no email address, so a family or classroom scenario on a shared device involves no data about the child at all.

If we learn that an account belongs to someone under 16, we suspend it immediately, email the account to explain why and how to respond, and — unless we hear back with proof of age — delete the account and all related data within 30 days, refunding any unused part of a subscription. Report a suspected underage account to pawelszczabel@gmail.com.

Connections to CatholicWorld are encrypted. We store only a salted hash of your password, never the password itself. Access to production data is restricted to what each task needs. If a security incident affects your data, we notify the relevant authority within 72 hours, as the law requires, and tell you directly where the law requires that too.

Report a security issue to pawelszczabel@gmail.com.

We do not make decisions that have a legal or similarly significant effect on you in a fully automated way. If a result is flagged as suspicious — for example, an unusually fast leaderboard time — that flag never removes it by itself; a person always reviews it before anything happens to your entry or account.

Editions of CatholicNews and the daily puzzles are prepared with the help of AI agents. Every edition is reviewed, approved, and signed with a real name by a person before it is sent — no edition goes out without that human step.

We never generate photorealistic images of real people. Any image generated by a model is labelled "Image: CatholicNews / AI" wherever it appears.

We email you about a material change to this policy. A change to what the cookie banner covers shows the banner again, even if you already made a choice. Past versions of this policy stay available at a dated address, so we can always show which text was in effect on a given day.

Paweł Szczabel · pawelszczabel@gmail.com · Wygonowa 51/2A, 45-402 Opole, Poland. We respond within 30 days, with an acknowledgement within 72 hours.