Privacy notice

What Woords is

Woords (woords.io) is an infinite crossword puzzle for iOS, in alpha. This notice covers the alpha sign-up flow and the game service.

What we collect

• Email address — collected when you sign up for alpha access. Used only to send your verification code, your alpha invite, and essential service communications. We don't send marketing email without your consent.
• Referral code — the ?ref= token captured when you land via a friend's invite link. Used solely to attribute the referral so your friend gets credit.
• Gameplay events — anonymous or pseudonymous in-app events (puzzles started, tiles solved, sections completed, streaks) to operate the game and improve it. No advertising identifiers.
• Device / session metadata — iOS version, app version, session timestamps. Used for crash diagnosis and feature gating only.

We don't collect location data, contacts, microphone, camera, or payment information in the alpha.

How we use it

• To verify your identity and grant alpha access.
• To operate the game — syncing your progress, maintaining your streak.
• To attribute referrals and show you your invite link.
• To diagnose crashes and improve the product.

We don't sell your data. We don't share it with advertisers.

Sub-processors

We share limited data with trusted third parties solely to operate the service:

• Resend — email delivery (verification codes + alpha invite emails). Your email address is shared with Resend to send transactional mail. Resend is GDPR-compliant; data is processed only on our instructions.
• Cloudflare R2 — object storage for game assets and gameplay data. Hosted in Cloudflare's network under our account.
• Hetzner Cloud — server hosting for the API (EU/US region). Database and application data reside on Hetzner infrastructure.

We require each processor to handle your data only as directed and to maintain appropriate security measures.

Security

Verification codes are stored hashed — we can check a code but cannot read it back. Codes expire after 15 minutes. The API is served over HTTPS only. If a data breach affects your personal data, we will notify you at the address on your account within 48 hours of confirming it.

Your rights

You can ask us to export, correct, or delete your data at any time. To delete your account or be removed from the waitlist, email hello@woords.io with the subject "Delete my data." We'll confirm within 5 business days.

The iOS app includes an in-app account deletion flow (required by Apple).

Retention

Sign-up data (email + referral) is retained for the duration of the alpha and beta. If you don't proceed past sign-up, your email is deleted 12 months after the alpha closes. Gameplay data is retained while your account exists and deleted within 30 days of account deletion.

Children

Woords is not directed at children under 13 (or under 16 in the EU). If you believe a child has submitted data to us, contact hello@woords.io and we will delete it promptly.

Changes to this notice

We'll update this page as the product evolves. For material changes we'll notify you by email before they take effect.

Contact

Metatoy, the studio behind Woords.
hello@woords.io