Privacy Policy

Effective: May 9, 2026

Who we are

WordCracker is operated as an independent project. The game is hosted at wordcracker.net and runs in your browser as a Progressive Web App. Contact: privacy@wordcracker.net.

What we collect

Anonymous identifiers

When you first load the game, your browser stores a randomly-generated identifier called a playerToken in localStorage. This token is not tied to your name, email, or any real-world identity. It lets us:

• Save your progress between visits without an account
• Match you with the same online opponent across rounds of the same match
• Group anonymous usage data so we can see how players move through the game

We also create an anonymous Firebase user ID in the background so cloud-saved progress and online play work. You can clear both by clearing your browser's site data for wordcracker.net.

Game state stored on your device

The following are stored in your browser's localStorage only — they never leave your device unless you sign in to sync them:

• Quest progress, total stars, Word IQ, achievements, current rank
• Daily Crack puzzle progress and streak
• The state of any in-progress match (so you can resume after closing the tab)
• Your settings (sound preferences, audio volume, etc.)
• A list of any active online matches you have open

Game state stored on our servers

The following are stored in Firebase Realtime Database (operated by Google):

• Online match state — for any 2-player online match, both players' moves, the current board, the timer, ready signals, and any emotes sent. Match state is transient and is removed automatically after the match ends.
• Leaderboard entry — your chosen display name, total stars, Word IQ, and rank, so other players can see leaderboards.
• Cross-device save — if you sign in with Google, your full Quest progress, achievements, and stats are mirrored to the cloud so you can pick up on another device.

Optional Google sign-in

If you tap "Sign in with Google" we receive your Google account name and email address through Firebase Authentication. We use these only to sync your progress across devices. You can sign out at any time. Sign-in is optional — every game mode works without an account.

Usage analytics

We use Firebase Analytics (a Google service) to understand how the game is played. The events we record include:

• App opens and screen views
• Mission and tutorial starts, completions, and failures
• Achievements unlocked
• Emotes sent and emote-mute toggles
• Install prompt outcomes (accepted, dismissed)
• Aggregate match outcomes (won, lost, timed out)

Each event is tagged with your anonymous playerToken so we can compute things like retention and funnel completion. We do not record what letters you placed, what words you typed when defending a challenge, or what words you considered and didn't play. Firebase Analytics, by default, also records your approximate region (derived from IP address) and your browser/device type.

There is no opt-out for analytics in the current version of WordCracker. If you don't want analytics collected, please don't use the game. We plan to add an opt-out before submitting the game to mobile app stores.

Crash and error reports

We use Sentry for automatic crash reporting. When the app encounters an unexpected error, Sentry receives the error message, a stack trace, the page URL, and your anonymous playerToken. Sentry does not receive form values, the contents of your localStorage, or any text you've typed.

Bug reports you submit

If you submit a bug report through the in-game form, we receive whatever you wrote, plus a small snapshot of the game state at the time (current screen, app version) so we can reproduce the issue. Reports are sent through Resend (an email-delivery service) to the operator's inbox.

What we don't collect

• We do not show ads.
• We do not sell, rent, or share your data with advertisers, data brokers, or any third party for marketing.
• We do not embed third-party tracking pixels, conversion tags, or behavioral profiling tools.
• We do not collect your precise location.
• We do not collect payment information — there is no in-app purchase.
• We do not record your voice, your camera, or anything outside the game itself.

Where data is stored

Game state and analytics are processed by Google's Firebase platform, which stores data in Google data centers (primarily in the United States). Crash reports are processed by Sentry. Bug reports are delivered through Resend. By using WordCracker, you consent to your data being processed in the United States.

How long we keep data

• Online match state — automatically deleted shortly after the match ends.
• Leaderboard entries — kept until you delete your account or contact us to remove them.
• Cross-device save (Google sign-in users) — kept until you delete your account.
• Analytics events — Firebase Analytics retains user-level event data for a configurable period (default 14 months); aggregate reports can be retained longer.
• Crash reports — Sentry retains errors for ~90 days.
• Bug reports — kept indefinitely by the operator until manually deleted, since they're useful for tracking recurring issues.
• Local-only data (anything in your browser's localStorage) — kept until you clear your browser data or stop using the game.

Your rights

Depending on where you live, you may have some or all of the following rights regarding your personal data:

• Access — request a copy of what we have on you.
• Correction — ask us to fix inaccurate data.
• Deletion — ask us to delete your account and associated data.
• Portability — receive a machine-readable export.
• Objection — object to certain kinds of processing.
• Withdraw consent — where processing is based on consent, withdraw it.

To exercise any of these, email privacy@wordcracker.net. We'll respond within 30 days. If you're in the EU/UK and we can't resolve a concern, you also have the right to file a complaint with your local data-protection authority.

California residents (CCPA / CPRA)

California residents have the rights listed above and additionally the right to know what personal information we collect and the right to opt out of the "sale" or "sharing" of personal information. WordCracker does not sell or share personal information for cross-context behavioral advertising. You may still email privacy@wordcracker.net to exercise any other right.

Children

WordCracker is intended for users 13 years of age and older. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact privacy@wordcracker.net and we will delete it.

Cookies and tracking technologies

WordCracker does not set traditional HTTP cookies. We do use localStorage and IndexedDB, which are similar in that they store data in your browser. Firebase services may set their own cookies during sign-in flows. You can clear all of these by clearing your browser's site data for wordcracker.net.

Security

We use HTTPS for all traffic. Firebase data is access-controlled via security rules so users can only read their own private data. Despite this, no system is perfectly secure — please don't use WordCracker to store information you'd be devastated to lose.

Changes to this policy

We may update this policy from time to time. The "Effective" date at the top of the page reflects the latest version. We don't currently have a way to notify users of changes; please check back occasionally if it matters to you.

Contact

Privacy questions, data requests, or concerns: privacy@wordcracker.net.