Word Puzzles Privacy Policy

Word Puzzles is a word game developed by HDFoundry. This policy describes exactly what the app collects, why, and what it never does. It is written to match the app as it actually behaves, and it is updated when the app changes.

The short version

You can play without an account and without giving us anything. If you choose to create one, we store your email address so you can sign back in, and it is never shown to anyone else. Your nickname is public, because it appears on the leaderboard. We do not sell or trade your information. The app uses Google Firebase to count what people do in it, to receive crash reports, to measure how fast screens and requests are, and to send notifications if you allow them. It may also show advertising served by Google AdMob, and may offer a one-time purchase that removes banner and interstitial ads; the version available today has neither, and both are covered below so this policy already applies when they arrive. All of it is described below. We also record which platform and app version you are on and the language and region set on your device, so that we can fix problems in the right version and support the right languages.

Playing without an account

The app works fully without an account, and one is never required to play. To download puzzles and appear on a leaderboard, the app registers a random identifier for your device with our server. It is generated on the device, it contains nothing about you or your hardware, and it is not linked to any identity.

If you create an account

An account exists for one reason: so your progress survives a reinstall or follows you to a new device. When you create one we store:

Your email address, used to sign you in and to send a six-digit code if you need to reset your password. The code is emailed through our mail provider, MailerSend, which receives your address for that purpose only; it expires after 30 minutes, and we keep only a hash of it, never the code itself. Your address is never displayed to other players and never used for marketing.
Your password, stored only as a hash. We cannot read it, and neither can anyone who obtains the database.

Your nickname is public

Every player has a nickname. The app gives you one to begin with, and you can change it. It appears on the leaderboard next to your results, which is the whole point of it. Treat it as public, and do not put anything private in it.

Nicknames are screened for offensive content when you set them, and any player can report one they think breaks the rules. A reported nickname is reviewed and reset to a generated one if it does. You can report a name by tapping it on the leaderboard, or by writing to the address at the bottom of this page.

Game results

When you finish a puzzle the app sends the solution to our server, which scores it and stores the result: which puzzle, whether you solved it, the points, and the counts the mode uses, such as mistakes or words found. This is what the leaderboards are built from and what restores your progress on a new device.

The server scores every result itself by replaying your solution. The app never reports its own score, so a modified copy of the app cannot claim points it did not earn.

About your device and your copy of the app

So that we can fix a problem in the version of the app you are actually running, and know which languages the app should support, we record four things alongside your player record, plus the date you were last active:

Your platform: Android or iOS, and nothing more specific. Our own server does not record your device model; Firebase does, and that is covered in the next section.
The version of the app you are running.
Your device's language, such as English or Vietnamese.
The region set on your device, such as VN or US. This comes from your device's own language settings. It is not a location lookup: our own server does not use your IP address, GPS, Wi-Fi or any location service to work out where you are, and the region is no finer than a country.
When you were last active, so we know whether an account is still in use.

These are sent when the app registers your device and when it renews your session. They are not shown to other players, and they are never used to build a profile of you or shared with anyone.

Analytics, crash reports and performance

The app uses Google Firebase services, three of which are described here; the fourth, Cloud Messaging, is described under Notifications. They exist so we can fix what breaks and build what people actually use, and nothing they collect is sold, traded, or used to advertise to you.

Firebase Analytics records what happens in the app: which mode you opened, that a puzzle was started, finished or abandoned, how long it took, which screens you visited. It does not record the words you type or the puzzles you solve. Alongside these it collects your device model, operating system version, and an approximate location, which Google derives from a masked version of your IP address. It is never GPS or precise location.
Firebase Crashlytics sends us a crash report when the app fails: where in the code it happened and what the device was doing at the time. This is the only way we learn about a crash that nobody writes to us about.
Firebase Performance measures how long screens take to draw and requests take to answer, so a slow build is visible to us before it is only visible to you.

These run in the released app only. Builds we run while developing report nothing to them.

Google processes this data on our behalf as our service provider. Their handling of it is governed by Firebase's own privacy documentation.

Notifications

The app can send notifications: a reminder that the day's puzzle is waiting, a note when a streak is about to lapse, word of a new pack, and the occasional announcement. It never asks for permission when you first open the app; it asks once, after you have finished your first puzzle, and if you say no it does not ask again.

If you allow them, your device is issued a notification token by Google and the app sends that token to our server, along with your platform, app version, language and your time zone offset. The time zone is there for one reason: so a reminder arrives in your evening rather than at three in the morning. The token identifies a device, not you.

You can switch each kind of notification off individually in Settings, or all of them in your device's system settings. Nothing in the app requires notifications to be on, and turning them off costs you nothing in the game. When a device stops accepting notifications, we disable its token on our side.

What is stored only on your device

Downloaded puzzle packs, which puzzles you have opened, your settings, and the state of a puzzle you left half-finished are all held locally so the app works with no connection. Deleting the app removes them.

What we do not collect

No advertising identifier used for tracking. In the current version, Firebase Analytics on Android reads the Android advertising ID for analytics only; it is not used for advertising and not shared with ad networks. You can reset or delete it in your Android settings. On iOS no advertising identifier (IDFA) is collected. How advertising would change this is described under Advertising below.
No reading of what you write. The analytics described above count actions, such as a puzzle started or a hint used, never the letters or words you enter.
No precise location. No GPS, no Wi-Fi lookup, no location permission of any kind. The only location data is the approximate one Firebase Analytics derives from a masked IP address, described above. The region our own server records is the one set in your device's language settings.
No contacts, photos, microphone, or camera. The app does not ask for these permissions because it has no use for them.
No data shared with data brokers, and nothing sold. Ads, when shown, are described below.
No third-party AI service. Nothing you type or play is sent to one.

Who else sees your data

Our own server and the service providers that run it for us, acting on our behalf:

Google Firebase, for analytics, crash reports, performance and notifications, as described above.
MailerSend, which delivers the password-reset email to the address on your account.
Cloudflare, which sits in front of our server and passes your requests to it, so it handles the network traffic between the app and our server, including your IP address, in order to deliver and protect the service.
Our hosting provider, a virtual private server on which the server and its database run.
Google AdMob, only in a version that shows ads, as described below.

We do not sell, rent or trade personal information. Data travels to our server over an encrypted connection. The two things visible to other players are your nickname and your results, on the leaderboards.

Advertising

The app may show advertising served by Google AdMob: banner ads, interstitial ads shown between puzzles, and optional rewarded ads. The version available today shows none, and this section describes how ads work whenever they are present.

No ad interrupts a puzzle in progress. Interstitials appear only at natural breaks, such as after a puzzle ends, and are limited in frequency.
Rewarded ads are optional. You are never required to watch an ad in order to play, and a hint is granted only if the ad actually played.
What AdMob collects. When ads are shown, Google and its ad partners may collect your advertising ID, device and software information, an approximate location derived from your IP address, and how you interact with ads, in order to serve ads, limit how often you see them, measure them and prevent fraud. We do not give AdMob your email address, nickname or results.
Your choice. Where the law requires consent, the app shows a consent form from Google's User Messaging Platform before ads load, and you can choose non-personalised ads, which do not use your advertising ID to tailor what you see. You can change that choice later from the privacy options in Settings. On Android you can also reset or delete your advertising ID, or opt out of ads personalisation, in the Ads section of your device settings. On iOS, if the app asks to track you, you can decline, and you can change this at any time in Settings under Privacy & Security, Tracking.
More information. How Google uses data from sites and apps that use its services is explained at policies.google.com/technologies/partner-sites.

Before a version that shows ads is released, the store data disclosures are updated to match this section.

Purchases

A later version may offer a single one-time purchase, Remove banner & interstitial ads. It removes banner and interstitial ads only; rewarded ads, which you choose to watch, remain. The current version offers no purchases.

Payment is handled entirely by Apple or Google. We never see or store your card or payment details; we learn only that the purchase was made on your device or store account.
Refunds are decided and issued by Apple or Google under their own rules, not by us.
If you reinstall or change device, use Restore purchases in the app to get it back, signed in to the same store account.

Deleting your account and your data

You can ask us to delete your account from inside the app, at any time, in Settings. The request opens a seven-day window, during which your account keeps working normally and you can cancel it. Once the window has run, your account and its results are erased from our server for good; password-reset codes are kept only as hashes and expire after 30 minutes. Data held by Google Firebase follows Firebase's own retention settings. Puzzles you have solved on your own device stay on that device until you delete the app.

If you no longer have the app installed, you can ask for deletion by email instead. Write to [email protected] from the email address on the account and ask us to delete it. The same seven-day window applies, and once it has run your account and its results are erased from our server for good.

Children

Word Puzzles is suitable for all ages and is not directed at children under 13. We do not knowingly collect personal information from children under 13. An account requires an email address; if you believe a child has created one, write to us and we will delete it.

Changes to this policy

When the app changes in a way that affects this policy, the policy is updated first and the date at the top of this page changes with it.

Contact

Questions about this policy, a reported nickname, or a deletion request: [email protected].