Home → Privacy Policy
Privacy Policy
CubingHQ is a speedcubing practice site. This page explains what happens to your data when you use it — what we keep, what never leaves your device, which third parties are involved, and what you can ask us to do about it. It describes what the site actually does today, not what it might do later.
Who is responsible
CubingHQ is operated by an individual based in Portugal, not by a company. Throughout this policy, "we" and "us" mean that person, who is the data controller for the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679) and Portuguese Law no. 58/2019.
Contact: martimcubing@gmail.com. A postal address for formal correspondence is available on request by email. Full operator details are on the About page.
The short version
- Your solve times, sessions and settings are stored in your browser. They are not uploaded, and we cannot see them.
- You can use almost all of the site with no account at all.
- If you create an account, we store your email address, a display name, and a hash of your password — never the password itself.
- Battle rooms are public spaces. Your display name, messages and times there are visible to everyone in the room.
- An online Cube Fight shows your display name, WCA ID and times to your opponent. Fights on one shared device stay on that device.
- The AI Coach sends your solve statistics to an AI provider. If you upload a video, the video goes to Google to be analysed, and is deleted afterwards.
- We use Google Analytics and Google AdSense. Both set cookies, and neither runs until you agree.
- We do not sell your data, and we do not share it with anyone except the processors listed below.
What stays on your device
Most of what CubingHQ remembers never reaches us. The following live in your
browser's localStorage, on the device you are using:
- Your solve times, sessions, personal bests and simulation history
- Cube Fights played on one shared device, and their results — the players' names are whatever was typed in
- Your theme, accent colour and language choice
- Timer preferences — inspection, ambient volume, mute state
- The Sum of Ranks board you have built, as a list of WCA IDs
- Your cookie choice
- Your sign-in token, if you are signed in
We cannot read any of this. Clearing your browser's site data for CubingHQ erases all of it permanently, and because there is no server-side copy we cannot restore it for you. If a session matters to you, export it before you clear anything.
A change from earlier versions of this policy. Until September 2026 the timer also uploaded a copy of every session to our database each time it saved. Nothing in the site ever read that copy back — it was a duplicate of your practice history kept for no feature. The upload has been removed. This policy previously said solve data was never transmitted; for that period it was, and we would rather say so than quietly correct the sentence. If you want the copy that was made of your sessions deleted, email us and we will remove it.
What we store, and why
| Data | Why | Legal basis | How long |
|---|---|---|---|
| Account: email address, display name, scrypt hash of your password, sign-up and last sign-in dates | To let you sign in and to keep your account yours | Performance of a contract — you asked for an account | Until you delete the account |
| Profile picture, if you upload one | To show on your profile and to friends | Contract | Until you replace or delete it |
| Linked WCA ID and WCA name, if you link them | To show your official results in your profile | Consent — you chose to link it, and can unlink at any time | Until you unlink or delete the account |
| Friend connections and friend requests, each holding your uid, display name and WCA ID | So the friends list and comparison table can work | Contract | Until either person removes the friendship |
| Battle room messages, room names, display names and posted times | So other people in the room can see them — that is the feature | Contract | Until the room is cleared; rooms are pruned periodically |
| Online Cube Fights: your display name, WCA ID, times, penalties and when your device last checked in; a keyed hash of your account id marks your seat | To run the fight between you and your opponent, who sees your name and times — that is the feature | Contract | The fight itself is deleted within 24 hours |
| Your Cube Fights history and record (opponent, score, round times, wins and losses), and same-device fights you played while signed in | So you can see your past fights and your record on any device | Contract | Until you delete the account |
| AI Coach: your solve statistics, chosen event and goals, plus the conversation | To produce a plan and answer your questions about it | Contract | Until you delete the coaching session |
| Anything you send through the contact form or by email: your name, email address and message | To reply to you | Legitimate interest in answering people who write to us | Deleted once the exchange is finished, and in any case within 24 months |
| Password reset tokens | To let you set a new password without opening an account to anyone who asks | Contract | They expire within the hour |
This data is held in Google Firebase Realtime Database. Account records — including password hashes — are written only by our server-side functions and are not readable by the browser.
Please treat a Battle room as a public space: pick a display name you are comfortable with strangers seeing, and do not type anything into a chat room that you would not want kept.
The AI Coach
The Coach is optional, and at the time of writing it is still being built — the page says so. This section describes what it does when you use it, and is published in advance rather than after the fact. Nothing below happens unless you open the Coach and ask it for something.
What it sends about your solving
When you ask for an assessment or a plan, we send an AI provider a summary of your practice: solve times and the statistics computed from them, which event you are working on, your stated goal, and — if you use a Bluetooth smart cube — move-level data from the solves you recorded. We do not send your email address, your name or your WCA ID with it.
Video, if you upload one
The Coach can take a clip of you solving and comment on things statistics cannot show: pauses, rotations, regrips, grip and turning quality. Before the first upload it asks you to agree to the following, in as many words, and will not open the file picker until you do:
- The video is uploaded to Google and analysed by the Gemini model. It is not analysed on our own servers.
- A video of you solving usually shows your hands, your surroundings, and often your face or voice. That is personal data, and it may be more identifying than anything else on this site.
- We delete the file from Google as soon as the analysis finishes. Google also expires uploaded files automatically after about two days.
- We keep the written observations the model produced. We do not keep the video.
- Because this is optional and involves footage of you, we ask for your explicit consent before the first upload, and you can withdraw it at any time by not uploading again.
If you would rather not do this, do not upload a video. Every other part of the Coach works without one.
Which provider
Depending on deployment configuration, coaching text is processed by Anthropic, Google, or OpenRouter (which routes to a model provider). Video is always processed by Google. These providers act as our processors for this purpose. We do not permit your data to be used to train their models.
Signing in with your WCA account
CubingHQ offers sign-in through the World Cube Association. If you use it, the WCA asks you to authorise us, and we then read your public WCA profile: your WCA ID, name, country, avatar, competition results and personal records. All of that is already published on the WCA's own website.
We use it to pre-fill your personal bests in the simulator, to show your profile in the Stats view, and to compute Sum of Ranks. The access we request is read-only — we cannot enter you into competitions, change your profile, or post anything as you. Revoking access in your WCA account settings disconnects it immediately.
Looking up someone else's WCA ID — in Sum of Ranks, the competition search or the friends comparison — reads the same public profile from the WCA's public API. It does not tell that person you looked, and it does not create a record on our side.
CubingHQ is an independent fan project. It is not affiliated with, endorsed by, or operated by the World Cube Association.
Advertising and analytics
No advertising is being shown on CubingHQ at the moment. The site is not part of an advertising programme, nothing is being paid for by ads, and no ad is being chosen for you. We intend to carry advertising in future to cover the running costs, and Google's verification code is on the page so that can be reviewed — which is why advertising still appears as a category in the cookie banner, and why the Cookie Policy describes the cookies it would set.
If and when advertising is switched on, it will be Google AdSense, it will set cookies, and it will not run until you have agreed to it in the banner. So that you can decide once rather than being asked again later, here is what it involves:
- Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this and other websites.
- You can opt out of personalised advertising at any time at Google Ads Settings, or for many vendors at once at Your Online Choices.
- Google's own explanation of how it uses data from sites that use its services is at policies.google.com/technologies/ads.
Opting out of personalised ads would not remove ads. It means the ones you see are chosen without using your browsing history.
Usage is measured with Google Analytics 4, which does set cookies, and which likewise does not run until you have made a choice in the banner.
We also use Vercel Web Analytics, which is cookieless, does not track visitors across sites, and does not build a profile of you.
Where we rely on consent — advertising and analytics cookies, linking a WCA account, uploading a video — the legal basis is your consent, and you may withdraw it at any time without affecting what happened before. Where we do not, the basis is named in the table above.
Who processes your data
Using CubingHQ causes requests to the services below. Each necessarily sees your IP address, as any web request does.
| Service | What for | Where |
|---|---|---|
| Vercel | Hosting, serverless functions, cookieless analytics | US / EU |
| Google Firebase | Accounts, friends, Battle rooms, Cube Fights, contact messages, algorithm data | US |
| Google AdSense & Google Analytics | Advertising and usage measurement | US |
| Google Gemini | AI coaching and video analysis | US |
| Anthropic / OpenRouter | AI coaching text, depending on configuration | US |
| Resend | Sending account emails — verification, password resets | US / EU |
| World Cube Association | Public competition, ranking and profile data | EU |
| Google Fonts, jsDelivr, cdn.cubing.net | Fonts, charting, 3D puzzle rendering | Global CDN |
| flagcdn.com | Country flag images | Global CDN |
Sending data outside the EEA
Several of the processors above are in the United States. Where that is the case we rely on the EU–US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses, which form part of those providers' standard terms. You can ask us which applies to a particular provider.
Security
Passwords are hashed with scrypt and a per-account random salt; we never store or log the password itself, and we cannot recover it for you. Account records are written only by server-side functions. Traffic is encrypted in transit.
We are one person, not a security team. If you find a problem, please tell us at martimcubing@gmail.com before telling anyone else, and we will fix it and credit you if you want to be credited.
Children
Speedcubing has a lot of young competitors, and we are conscious of that.
In Portugal the age at which a child can consent to online services on their own is 13. CubingHQ is not directed at children under 13, and we do not knowingly collect personal data from them. If you are under 13, please do not create an account, post in a Battle room, or upload a video; ask a parent to contact us if you want to use those parts of the site.
If you are between 13 and 18, please think twice before uploading a video of yourself or using your real name as a display name in a public Battle room. Nothing on this site requires either.
If you believe a child has given us personal information, email us and we will delete it. We do not need you to explain why.
Your rights
If you are in the EEA or the UK you have the right to access, correct, erase, restrict, port and object to our processing of your personal data, and to withdraw any consent you have given. Because most CubingHQ data lives on your own device, you can exercise a lot of this yourself by clearing your site data or deleting your account.
For anything we hold — an account, a Battle message, a coaching session, an email — write to martimcubing@gmail.com and we will action it within 30 days. You do not need to explain why, and it costs nothing.
If you think we have got this wrong, you can complain to the Portuguese data protection authority, the CNPD (cnpd.pt), or to the supervisory authority in the country where you live.
Automated decisions
The AI Coach produces suggestions, not decisions. Nothing on this site makes an automated decision that produces a legal effect for you or similarly significantly affects you, within the meaning of Article 22 GDPR.
Changes to this policy
If this policy changes in a way that affects you, we will update the date at the top of the page, and for a material change we will say so in the site itself rather than relying on you to re-read this page.
Contact
Questions about anything above: martimcubing@gmail.com, or use the contact page.