Word! Privacy Policy

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address: Used solely for authentication and verification. This information is immediately hashed using a modern, industry-standard secure algorithm and only the hash digest is stored. We never store your email address itself and cannot retrieve it from our database.
• Nickname: Your chosen display name. It is visible to other players in groups you join, and by default it is also shown to all players on the global Daily Word leaderboard - see section 5.2, where you can turn that off. This is stored in our database in plain text and we encourage you to use an anonymous Nickname.
• Password: Hashed using a modern, secure, brute force resistant algorithm. We cannot see or recover your password.

Group invitations work the same way. When a group admin invites someone, the email address they typed is used to send that one invitation and is then discarded - it is not stored against the invitation or anywhere else. What we keep is the same one-way hash, which is how the invitation is matched to the right person when they respond. Group admins see only the nicknames of the people they have invited.

1.2 Game Data

To provide gameplay features and track your progress, we only store the following anonymous data:

• Game statistics (games played, wins, streaks, points)
• Daily word game state and guesses
• Group memberships and roles
• Words submitted for group challenges
• Guess distribution and scoring data

1.3 Automatically Collected Information

We collect minimal technical information:

• Authentication tokens: tokens stored locally on your device for session management (30-day expiration)
• Timezone information: Used to ensure daily challenges reset at the correct time for your location

2. How We Use Your Information

We use the collected information exclusively for:

• Authentication: Verifying your identity when you log in
• Account verification: Sending verification codes during registration and password resets
• Game functionality: Providing daily word challenges, tracking progress, managing groups, and calculating statistics
• Leaderboards: Displaying rankings within your groups, and on the global Daily Word leaderboard, using your nickname
• Group invitations: Allowing group admins to invite members by email address
• Service notifications: Password reset confirmations and verification codes

We do not use your information for:

• Marketing or promotional communications
• Advertising or tracking
• Selling or sharing with third parties
• Analytics beyond basic game statistics

3. Data Storage and Security

3.1 Encryption and Hashing

• Contact information: All email addresses are hashed with HMAC-SHA256 before storage. The original values are never saved.
• Passwords: Secured using brute-force resistant hashing. We cannot view or recover your password.
• Authentication: JWT tokens with 30-day expiration, signed with secure secret keys stored on Azure Infrastructure.

3.2 Data Location

• Backend database: Stored securely and encrypted on Azure Infrastructure
• Local storage: Game state and cached data stored on your device using platform-secure storage (SharedPreferences on mobile, secure cookies on web)

3.3 Access Controls

• All API endpoints require token authentication
• Role-based access controls for group management
• Parameterized database queries to prevent SQL injection
• Data entry fields sanitized before submission
• No access to user data without signing in - nothing is readable by the public internet

4. Data Sharing

4.1 What We Share

We only share minimal information in these contexts:

• Within groups: Your nickname, game statistics, and scores are visible to other members of groups you join
• Group leaderboards: Your nickname and points are shown on the leaderboards of your groups
• The global Daily Word leaderboard: If you play the Daily Word, your rank, the number of guesses you took and your completion time are visible to all other signed-in players for that day. Your nickname is shown alongside them by default; if you switch that off, players outside your groups see a shortened form such as "J***" instead - see section 5.2

4.2 Third-Party Services

We use the following services to operate Word!:

• Azure Communication Services: Sends verification codes via email. As such, we share your email with Azure (third party) for the purposes of sending you verification emails.
• Microsoft Azure: Cloud infrastructure for hosting and storage

These services only receive the minimum information necessary (e.g., your email to send verification codes) and are bound by their own privacy policies. In GDPR terms, we are a Data Controller / Processor and Azure is a Data Processor in that we process and pass your email address on to Azure for the purpose of sending mail. We do not store your email. Every time an email service is required, you need to supply it (what you supply is hashed and verified against the stored hash digest).

4.3 What We Never Share

• Your contact information (it's hashed and we cannot recover it)
• Your password (as above)
• Your data with any third parties or affiliates

5. Your Rights and Choices

5.1 Account Management

• Change nickname: Update your display name anytime in the Profile screen
• Control who sees your nickname: Turn the global leaderboard display of your nickname on or off in the Profile screen at any time
• Change password: Reset your password through the app
• Delete account: Request account deletion through the Profile screen (this will remove all your data)

5.2 Group and Leaderboard Privacy

• You can leave groups at any time
• You can decline group invitations
• Your group statistics are visible only to members of groups you've joined
• Your nickname on the global leaderboard is your choice. When you play the Daily Word you appear on a leaderboard alongside everyone else who played that day's word. Your nickname is shown there to all players by default. You can switch this off in the Profile screen, and from then on your nickname is shortened - "Jordan" becomes "J***" - for everyone except you and players who share a group with you. Your rank and score still appear either way, as that is what the leaderboard is for. You can change this setting as often as you like, and it takes effect immediately.

5.3 Data Retention

• Active accounts: Data retained while your account is active
• Deleted accounts: All associated data is permanently removed
• Temporary data: Verification codes expire after 30 minutes and registration state after 30 minutes
• Local cache: Word lists and game state stored on your device until you clear app data

6. Child protection

Word! is for adults. You must be 18 or older to create an account, and the app is not directed at children. We do not knowingly collect personal information from anyone under 18.

The word lists contain no profanity, but that is a choice about the game itself and not an invitation for children to sign up. Parents who want to prevent under-age sign-ups can use the parental controls built into their child's device — Apple's guidance is here.

7. International Users

Word! is hosted on Microsoft Azure servers. By using the app, you consent to the transfer of your information to these servers, which may be located in different countries. We ensure all data is protected with the same security standards regardless of location.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the app or via email/SMS. Your continued use of Word! after changes constitutes acceptance of the updated policy.

9. Cookie Policy

Word! uses minimal cookies/local storage:

• Authentication token: Keeps you logged in
• User preferences: Stores your user ID and nickname locally
• Game cache: Stores word lists and game state for offline functionality

These are essential for the app to function. We do not use tracking cookies or advertising cookies.

10. Data Breach Notification

In the unlikely event of a data breach that affects your account, we will notify you within 72 hours via your registered contact method and provide guidance on protective measures.