Privacy Policy

Last updated: September 25, 2026

This policy explains what information WordSwifts (https://wordswifts.com), run by Nate ("we", "us"), collects, why, and the choices you have. We collect as little as we can: you can play without an account, and we never sell your data.

1. What we collect

When you play as a guest

What	Why	How long
A random guest ID stored in a cookie called `quiz_user`	Links your high scores and word reports to your device without needing an account	1 year from your last visit (renewed while you keep playing)
Leaderboard entries: the name you type, your streak, the game mode and the date	Showing the public leaderboard	Current month, then archived in monthly history (see section 5)
Word reports: the word, the reason you chose and any note you add	Finding and fixing unfair words	Until reviewed and no longer needed
Answer history: each word you were asked, the song you picked, whether it was right, and how long you took	Your stats page and badges, and spotting automated cheating	90 days for guests; for accounts, until you delete the account
Share links you create: the score, mode and the leaderboard name you chose	Showing the result when you share it	180 days
Daily Challenge results: your answers, score, time taken and the name you choose	The public daily leaderboard and your day streak	Kept as a record of past days; anonymised if you delete your account

The name you enter for a high score is public. Please don't use your full name or other personal details.

When you create an account

Your name and email address
Your password, which is stored only as a secure one-way hash
If you turn on two-factor authentication, your 2FA secret and recovery codes, stored encrypted

When you sign up or log in, the scores, reports, answer history and share links recorded under your device's guest ID are moved to your account, so they follow you across devices. Signed-in players also earn badges, which are stored with the account, and can create or join groups. A group's name, its members' names and their scores are visible to everyone in that group.

Account holders also get a public profile page, linked from their name on leaderboards. It shows your account name, when you joined, your badges, your best scores and your Daily Challenge record (streaks, 10/10 days and the last 30 days). You can hide it at any time with "Show my public profile" on your profile page; your leaderboard names then stop linking to it.

Automatically, when you use the site

Session data. A session cookie and a security token (XSRF-TOKEN) keep you logged in and protect forms. The server-side session record includes your IP address and browser type and holds your current game (the question and your streak). Sessions expire after 2 hours of inactivity.
"Remember me": if you tick it when logging in, a cookie keeps you signed in on that device until you log out.
IP address for abuse prevention. We use your IP address, briefly, to limit how fast answers, reports and login attempts can be sent. These counters are kept for minutes, not stored with your scores.
Preferences saved in your browser (local storage, not sent to us): your light/dark mode setting and your cookie choice.

Analytics, only if you agree

If you click Accept on the cookie banner, we load Google Analytics 4. It sets cookies (_ga, _ga_*, lasting up to 2 years) and sends Google information about how the site is used, such as the pages viewed, your approximate location, device and browser. We use this only to understand how many people play and which features they use. If you decline, or never choose, Google Analytics is not loaded at all. You can change your choice any time with Cookie settings in the footer.

2. How we use it

to run the game, keep score, and show leaderboards;
to let you sign in and keep your scores across devices;
to prevent cheating, spam and abuse, and keep the site secure;
to review word reports and improve the game;
to send account emails you ask for (such as password resets);
with your consent, to measure site usage with Google Analytics.

We don't use your information for advertising, and we don't make automated decisions about you with legal or similarly significant effects.

3. Legal bases (EEA/UK visitors)

Contract: providing your account and the game you've chosen to use.
Legitimate interests: running leaderboards, preventing cheating and abuse, security, and improving the game.
Consent: Google Analytics cookies. You can withdraw consent at any time.

4. Who we share it with

We do not sell or share your personal information for cross-context behavioral advertising (as defined by California law), and we don't sell it to anyone for any purpose. We only share it with:

Service providers who help us run the site, such as our hosting and email providers, under instructions to protect it;
Google, only if you accept analytics cookies;
Everyone: your leaderboard name and streak are public;
Authorities, if required by law or to protect the rights and safety of our players or others.

5. How long we keep it

Current leaderboard entries are archived into monthly history at the start of each month. History is kept as a record of past leaderboards.
Accounts are kept until you delete them. When you delete your account, we delete your current scores, answer history, badges and share links, and remove your name and account link from archived leaderboards and reports. Archived rows then show "Deleted player".
Guest answer history is deleted after 90 days, and share links after 180 days.
Groups last until their owner deletes them (or deletes their account); leaving a group removes you from it straight away.
Sessions expire after 2 hours of inactivity. Rate-limit counters last a few minutes.
Word reports are kept until they're resolved and no longer useful.
Backups may keep copies for a limited time before they are overwritten.

6. Your rights and choices

Depending on where you live (including under the GDPR, UK GDPR and California law), you may have the right to access, correct, delete, or receive a copy of your personal information, and to object to or restrict certain processing. You also have the right not to be discriminated against for exercising these rights.

Account holders can update their details or delete their account at any time from the profile page.
Guests can clear their browser cookies to stop being recognized. To have guest leaderboard entries removed, email hello@wordswifts.com with the name you used and roughly when you played.
Analytics: use Cookie settings in the footer to accept or decline at any time.

For any other request, email hello@wordswifts.com. We may need to verify your identity before acting on it. If you're in the EEA or UK, you can also complain to your local data protection authority.

7. Children

WordSwifts is not directed at children under 13, and we don't knowingly collect personal information from them. Children under 13 must not create an account. If you believe a child under 13 has given us personal information, contact hello@wordswifts.com and we will delete it.

8. Security

We use HTTPS, hashed passwords, encrypted sessions and optional two-factor authentication. No method of storage or transmission is perfectly secure, but we work to protect your information.

9. International transfers

We and our service providers may process information in the United States and other countries where data protection laws may differ from yours. Where required, we rely on appropriate safeguards for these transfers.

10. Changes to this policy

We may update this policy from time to time. We'll change the date at the top, and for significant changes we'll let signed-in players know.

11. Contact

Questions or requests about your privacy? Email hello@wordswifts.com.