Privacy Policy

Effective: September 29, 2026

Who we are

WordCracker is operated as an independent project. The game is hosted at wordcracker.net and runs in your browser and as apps for iOS and Android. Contact: privacy@wordcracker.net.

What we collect

Identifiers

When you first open the game we create a random identifier called a playerToken and a Firebase account ID. The account ID is anonymous unless you sign in. We use these identifiers to:

• Save your progress between visits without an account
• Run online matches, invites and challenges
• Link usage analytics and crash reports to the same player, so we can see how players move through the game

Our analytics provider also uses its own app-instance identifier. On iOS this is Apple's per-developer "identifier for vendor". On the web and Android it is a first-party Google Analytics cookie. If you turn on notifications, we store your device's push token so we can tell you when it's your move. We never collect advertising IDs.

Game state stored on your device

Most of your progress lives in your browser's or app's local storage:

• Quest progress, total stars, Word IQ, achievements, current rank
• Daily Puzzle progress and streak
• The state of any in-progress match (so you can resume after closing the game)
• Your settings (sound, music, notifications, etc.) and your list of blocked players

Some of it also goes to our servers: your Daily Puzzle results (with your display name) for the daily stats every player sees, your rating and leaderboard entry, and, if you sign in, your full Quest save and replays. Details are in the next section.

Game state stored on our servers

The following are stored in Firebase Realtime Database (operated by Google):

• Online matches: both players' display names, moves, the board, the timer, ready signals and emotes; your list of games; invites and challenges you send or receive; and, if you use Play the World, your posted challenge (display name and rating). Finished matches are deleted automatically about 90 days after their last move.
• Leaderboards and Daily Puzzle stats: your display name, total stars, Word IQ, rank, rating, sign-in provider and daily puzzle results. Other players can see these.
• Cross-device save: if you sign in with Google or Apple, your full Quest progress, achievements, stats and replays, so you can pick up on another device.
• Notifications: your push token(s) and your notification preferences.
• Reports: if you report a player, we store the report: both players' identifiers, the reported display name, the reason and the game code.

Your display name is public: other players see it in matches, on leaderboards and in invite links you share.

Optional Google or Apple sign-in

If you sign in with Google or Apple, we receive your name and email address through Firebase Authentication. Apple may give us a private relay address instead of your real one. We use your first name to suggest a display name, and your email address to identify your account. If you turn on Email me when it's my move in Settings, we also use your email to tell you when a match is waiting on you. Those emails are sent through Resend, an email-delivery service, and you can turn them off in Settings at any time. Sign-in is optional; every game mode works without an account.

Usage analytics

We use Google Analytics for Firebase to understand how the game is played. The events we record include:

• App opens, screen views and how you arrived (for example, through an invite link, or the domain of the website that linked you)
• Tutorial, mission, Daily Puzzle and match starts, completions and outcomes
• Achievements unlocked, emotes sent, and settings such as sound or music on/off
• Whether you opened a notification, and install-prompt outcomes
• A few summary stats: rank, stars, matches played and won
• Some gameplay moments, such as a challenge, a coaching tip or a tutorial step, along with the letters on the board at that moment, so we can study how games play out
• For online matches, the game code; and, when something goes wrong, a short error message and how long the app took to start

Events are linked to your account ID. Google Analytics also records your device type, operating system, language and approximate location (city or region, derived from your IP address). The letters on the board are gameplay data, not personal data. We never send your display name, your email address or anything you type into a report or bug report to analytics. Analytics is not used for advertising and is not shared with advertisers. There is no in-app switch to turn analytics off. You can ask us to delete your analytics data at any time (see Your rights).

If your device is set to a European time zone, analytics is switched off entirely.

Anonymous country counts

Separately from Google Analytics, the game sends a tiny anonymous signal when the app opens, when a match starts, when a round ends, and when an invite is opened or joined. It contains only the kind of event and the platform (iOS, Android or web). It carries no player ID or token, and nothing is stored on or read from your device for it. Our server adds the country your connection comes from, then increases a daily per-country total. Your IP address is not stored or logged. We keep only those totals, such as "40 rounds played in Brazil today", which can't be linked to you or to any individual. Because no identifier is involved, these counts are collected in every region, including Europe.

Crash and error reports

We use Sentry for crash reporting on the website and in the apps. When an error happens, Sentry receives:

• the error message and stack trace
• the page address
• recent in-app activity leading up to it (for example, which buttons were tapped and which of our servers were contacted)
• your browser or device and operating system
• your playerToken

Sentry does not receive form values, the contents of your local storage, or text you've typed. Crash reporting is switched off for devices set to a European time zone.

Bug reports you submit

If you submit a bug report or feedback through the in-game form, we receive what you wrote and the email address if you give one. We also receive a snapshot to help us reproduce the issue: app version, current screen and mode, screen size, time zone, browser or device, your playerToken and the last few errors. Reports are emailed to the operator through Resend.

Word definitions

When you look up a word that isn't in our built-in definitions, the word is sent to the free Dictionary API (dictionaryapi.dev). Like any website, it can see your IP address.

Hosting and app stores

The website is hosted by Vercel, which keeps standard server logs (including IP addresses) for security and reliability. On Android, the app reads Google Play's install referrer once, on first launch, only to tell whether you arrived through a friend's invite. Apple and Google also process data under their own policies when you download the app or sign in with them.

What we don't collect

• We do not show ads, and we don't include advertising SDKs.
• We do not collect advertising IDs.
• We do not sell, rent, or share your data with advertisers, data brokers, or any third party for marketing.
• We do not track you across other companies' apps or websites.
• We do not embed third-party tracking pixels, conversion tags, or behavioral profiling tools.
• We do not collect your precise location.
• We do not collect payment information; there is no in-app purchase.
• We do not record your voice, your camera, your contacts, or anything outside the game itself.

Where data is stored

These service providers process data for us:

• Game state, sign-in, notifications and analytics: Google's Firebase platform, in Google data centers (primarily in the United States)
• Sign in with Apple: Apple
• Crash reports: Sentry
• Bug reports and the optional turn emails: Resend
• The website: Vercel
• Word lookups: dictionaryapi.dev

By using WordCracker, you consent to your data being processed in the United States.

How long we keep data

• Online matches: deleted automatically about 90 days after the last move. Unfinished, abandoned matches are cleaned up sooner.
• Push tokens: removed when they stop working, or after about 120 days unused.
• Leaderboard entries, Daily Puzzle results and rating: kept until you delete your account or ask us to remove them.
• Cross-device save (signed-in users): kept until you delete your account.
• Analytics events: Google Analytics keeps user-level event data for up to 14 months. Aggregate reports can be kept longer.
• Crash reports: Sentry keeps errors for about 90 days.
• Player reports and bug reports: kept until we've dealt with them and no longer need them.
• Local-only data: kept on your device until you clear the game's data or uninstall the app.

Your rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Access: request a copy of what we have on you.
• Correction: ask us to fix inaccurate data.
• Deletion: in the app, open Settings → Delete account & data. This removes your cloud save, leaderboard and Daily Puzzle entries, rating, replays, games list, invites, challenges, Play the World posts and push tokens, then deletes your account. Matches you played stay visible to your opponent until they are deleted automatically (see above). Analytics and crash data expire on the schedule above. Email us to have them, or anything else, deleted sooner. You can also request deletion without the app by emailing privacy@wordcracker.net.
• Portability: receive a machine-readable export.
• Objection: object to certain kinds of processing.
• Withdraw consent: where processing is based on consent, withdraw it.

To exercise any of these, email privacy@wordcracker.net. We'll respond within 30 days. If you're in the EU/UK and we can't resolve a concern, you also have the right to file a complaint with your local data-protection authority.

California residents (CCPA / CPRA)

California residents have the rights listed above and additionally the right to know what personal information we collect and the right to opt out of the "sale" or "sharing" of personal information. WordCracker does not sell or share personal information for cross-context behavioral advertising. You may still email privacy@wordcracker.net to exercise any other right.

Children

WordCracker is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact privacy@wordcracker.net and we will delete it.

Cookies and tracking technologies

The website uses first-party cookies:

• Google Analytics cookies, which are not set for devices in a European time zone.
• On our own test devices only, a cookie that marks them as internal, so our statistics leave them out.

We also use localStorage and IndexedDB to store your game on your device. Sign-in providers (Google, Apple) may set their own cookies while you sign in. You can clear all of these by clearing your browser's site data for wordcracker.net, or by clearing the app's data.

Security

We use HTTPS for all traffic. Firebase data is access-controlled via security rules so users can only read their own private data. Despite this, no system is perfectly secure — please don't use WordCracker to store information you'd be devastated to lose.

Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of the page reflects the latest version. We don't currently have a way to notify users of changes; please check back occasionally if it matters to you.

Contact

Privacy questions, data requests, or concerns: privacy@wordcracker.net.