Word!

1. Information We Collect

1.1 Account Information

When you create an account, we collect:

• Email address: Used solely for authentication and verification. This information is immediately hashed using a modern, industry-standard secure algorithm and only the hash digest is stored. We never store your email address itself and cannot retrieve it from our database.
• Nickname: Your chosen display name visible to other players in groups you join. This is stored in our database in plain text and we encourage you to use an anonymous Nickname.
• Password: Hashed using a modern, secure, brute force resistant algorithm. We cannot see or recover your password.

1.2 Game Data

To provide gameplay features and track your progress, we only store the following anonymous data:

• Game statistics (games played, wins, streaks, points)
• Daily word game state and guesses
• Group memberships and roles
• Words submitted for group challenges
• Guess distribution and scoring data

1.3 Automatically Collected Information

We collect minimal technical information:

• Authentication tokens: tokens stored locally on your device for session management (30-day expiration)
• Timezone information: Used to ensure daily challenges reset at the correct time for your location

2. How We Use Your Information

We use the collected information exclusively for:

• Authentication: Verifying your identity when you log in
• Account verification: Sending verification codes during registration and password resets
• Game functionality: Providing daily word challenges, tracking progress, managing groups, and calculating statistics
• Leaderboards: Displaying rankings within your groups using your nickname
• Group invitations: Allowing group admins to invite members using email or phone
• Service notifications: Password reset confirmations and verification codes

We do not use your information for:

• Marketing or promotional communications
• Advertising or tracking
• Selling or sharing with third parties
• Analytics beyond basic game statistics

3. Data Storage and Security

3.1 Encryption and Hashing

• Contact information: All email addresses are hashed with HMAC-SHA256 before storage. The original values are never saved.
• Passwords: Secured using brute-force resistant hashing. We cannot view or recover your password.
• Authentication: JWT tokens with 30-day expiration, signed with secure secret keys stored on Azure Infrastructure.

3.2 Data Location

• Backend database: Stored securely and encrypted on Azure Infrastructure
• Local storage: Game state and cached data stored on your device using platform-secure storage (SharedPreferences on mobile, secure cookies on web)

3.3 Access Controls

• All API endpoints require token authentication
• Role-based access controls for group management
• Parameterized database queries to prevent SQL injection
• Data entry fields sanitized before submission
• No public access to user data

4. Data Sharing

4.1 What We Share

We only share minimal information in these contexts:

• Within groups: Your nickname, game statistics, and scores are visible to other members of groups you join
• Leaderboards: Your nickname and points are shown on group leaderboards

4.2 Third-Party Services

We use the following services to operate Word!:

• Azure Communication Services: Sends verification codes via email. As such, we share your email with Azure (third party) for the purposes of sending you verification emails.
• Microsoft Azure: Cloud infrastructure for hosting and storage

These services only receive the minimum information necessary (e.g., your email to send verification codes) and are bound by their own privacy policies. In GDPR terms, we are a Data Controller / Processor and Azure is a Data Processor in that we process and pass your email address on to Azure for the purpose of sending mail. We do not store your email. Every time an email service is required, you need to supply it (what you supply is hashed and verified against the stored hash digest).

4.3 What We Never Share

• Your contact information (it's hashed and we cannot recover it)
• Your password (as above)
• Your data with any third parties or affiliates

5. Your Rights and Choices

5.1 Account Management

• Change nickname: Update your display name anytime in the Profile screen
• Change password: Reset your password through the app
• Delete account: Request account deletion through the Profile screen (this will remove all your data)

5.2 Group Privacy

• You can leave groups at any time
• You can decline group invitations
• Your statistics are only visible to members of groups you've joined

5.3 Data Retention

• Active accounts: Data retained while your account is active
• Deleted accounts: All associated data is permanently removed
• Temporary data: Verification codes expire after 30 minutes and registration state after 30 minutes
• Local cache: Word lists and game state stored on your device until you clear app data

6. Child protection

Word! is intended for general audiences and is suitable for minors. Word lists do not include profanity. Parents are encouraged to use parental controls on their child's devices as per the article here.

7. International Users

Word! is hosted on Microsoft Azure servers. By using the app, you consent to the transfer of your information to these servers, which may be located in different countries. We ensure all data is protected with the same security standards regardless of location.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes through the app or via email/SMS. Your continued use of Word! after changes constitutes acceptance of the updated policy.

9. Cookie Policy

Word! uses minimal cookies/local storage:

• Authentication token: Keeps you logged in
• User preferences: Stores your user ID and nickname locally
• Game cache: Stores word lists and game state for offline functionality

These are essential for the app to function. We do not use tracking cookies or advertising cookies.

10. Data Breach Notification

In the unlikely event of a data breach that affects your account, we will notify you within 72 hours via your registered contact method and provide guidance on protective measures.