Privacy notice

What Woords is

Woords (woords.io) is an infinite crossword puzzle for iOS. This notice covers the game app and the woords.io website (including the mailing-list sign-up).

What we collect

• Email address — collected when you sign up for alpha access. Used only to send your verification code, your alpha invite, and essential service communications. We don't send marketing email without your consent.
• Referral code — the ?ref= token captured when you land via a friend's invite link. Used solely to attribute the referral so your friend gets credit.
• Gameplay events — anonymous or pseudonymous in-app events (puzzles started, tiles solved, sections completed, streaks, session length and time spent in the app) to operate the game and improve it. Events are grouped by a random per-session identifier that is not used to track you across other apps or websites. No advertising identifiers. These events are processed by our own servers and by Google Analytics for Firebase (see Sub-processors); you can turn them off in the app at any time.
• Device / session metadata — iOS version, app version, session timestamps. Used for crash diagnosis, feature gating, and product analytics.
• Purchases — if you buy an in-app item (for example a hint pack), Apple processes the payment and we receive a record of the transaction — which product, the quantity, and the price — to deliver what you bought and for purchase analytics. We never receive your payment-card number or other financial-instrument details; Apple handles those.

The app doesn't collect location data, contacts, microphone, or camera data. In-app purchases are handled by Apple — we never see or store your payment details (see Purchases above).

Website analytics

On woords.io we count visits with Umami, an analytics tool we host ourselves, so this data stays on our servers. Umami sets no cookies and uses no cross-site identifiers. It records the page you viewed, the site that referred you, your browser, operating system and device type, screen size, language, and an approximate location (country, region and city) derived from your IP address. It does not store your IP address.

We also use Google Analytics 4 on the website, which sets cookies to count visits (see Sub-processors). Our web server logs each request (time, IP address, browser user agent and page) to operate and secure the site, and we have also used these logs to compute the same aggregate visit counts for past periods. None of this is linked to your account or your gameplay.

How we use it

• To verify your identity and grant alpha access.
• To operate the game — syncing your progress, maintaining your streak.
• To deliver in-app purchases and keep your hint balance.
• To attribute referrals and show you your invite link.
• To diagnose crashes and improve the product.

We don't sell your data. We don't share it with advertisers.

Sub-processors

We share limited data with trusted third parties solely to operate the service:

• Resend — email delivery (verification codes + alpha invite emails). Your email address is shared with Resend to send transactional mail. Resend is GDPR-compliant; data is processed only on our instructions.
• Cloudflare R2 — object storage for game assets and gameplay data. Hosted in Cloudflare's network under our account.
• Hetzner Cloud — server hosting for the API (EU/US region). Database and application data reside on Hetzner infrastructure.
• Google Analytics for Firebase — product analytics for the iOS app. Anonymous / pseudonymous gameplay and session events help us understand and improve the game. Configured with ad-personalization disabled and no advertising identifier (IDFA), so your data is not used to track you across other apps or websites and is not shared with a data broker. You can turn this off in the app (see Your rights).
• Google Analytics 4 — visit counts for the woords.io website, using cookies. Processed by Google under its privacy policy; you can block it with Google's opt-out add-on or any content blocker.
• Apple — App Store & in-app purchases — Apple processes any in-app purchase and provides us a transaction record (product, quantity, price). Your payment-card details stay with Apple; we never receive them.

We require each processor to handle your data only as directed and to maintain appropriate security measures.

Security

Verification codes are stored hashed — we can check a code but cannot read it back. Codes expire after 15 minutes. The API is served over HTTPS only. If a data breach affects your personal data, we will notify you at the address on your account within 48 hours of confirming it.

Your rights

You can ask us to export, correct, or delete your data at any time. To delete your account or be removed from the waitlist, email hello@woords.io with the subject "Delete my data." We'll confirm within 5 business days.

The iOS app includes an in-app account deletion flow (required by Apple).

You can turn off anonymous usage analytics at any time in the iOS app under Settings → “Share anonymous usage.” Turning it off stops all analytics events, including session and time-in-app data.

Retention

Sign-up data (email + referral) is retained for the duration of the alpha and beta. If you don't proceed past sign-up, your email is deleted 12 months after the alpha closes. Gameplay data is retained while your account exists and deleted within 30 days of account deletion.

Children

Woords is not directed at children under 13 (or under 16 in the EU). If you believe a child has submitted data to us, contact hello@woords.io and we will delete it promptly.

Changes to this notice

We'll update this page as the product evolves. For material changes we'll notify you by email before they take effect.

Contact

Metatoy LLC (a Minnesota limited liability company), the studio behind Woords.
hello@woords.io