Privacy policy

01Who we are

This policy explains how WordGlimmer handles personal data in the game, its online services, and this website. The publisher and contact details appear at the top of this page. References to “we” and “us” mean that publisher.

WordGlimmer is a word puzzle game. You can start a journey without linking a personal account. Guest play can still use online synchronization: an automatically generated player and device identifier lets the service save progress without a Google or Apple login.

02Information we process

• Your journey: player and device identifiers, chosen language, completed levels, words found, scores, coins, hints, inventory, rewards, collection progress, and synchronization records.
• Your choices: sound, vibration, accessibility, cloud saving, notification, and analytics preferences.
• Account information, if you link an account: email, the identity identifier supplied by your sign-in provider, and a display name when supplied. If an email-and-password account is offered and you use it, the service stores a password hash, not a readable password.
• Community activity, if you use it: your profile or nickname, team membership, messages, help requests, leaderboard entries, reports, blocks, and the version and time of your acceptance of the community rules. Information you post in shared spaces is visible to the relevant players.
• Technical information: network information such as your IP address, request timestamps, app version, and security or service error records needed to deliver the service and protect it from abuse.
• Support correspondence: information you choose to send, such as a description of a problem, your contact address, and an optional screenshot. Please do not send passwords or payment credentials.

The game does not need access to your contacts, microphone, precise location, photo library, Gmail, Google Drive, or Google Calendar to play.

03How and why we use it

We use game and account data to deliver puzzles, save and restore your journey, reconcile rewards and coins, provide features you request, answer support requests, and enforce fair play. Security records help prevent fraud, abusive traffic, and unauthorized access.

Where data protection law requires a legal basis, processing necessary to provide the service you request is based on performing our agreement with you. Proportionate security and service administration rely on legitimate interests, subject to your rights. Optional analytics and notifications rely on your choice and, where required, consent. Some records may be processed to comply with legal obligations.

We do not sell personal data or use Google account data for personalized advertising. We do not use account data to make automated decisions with legal or similarly significant effects.

04Google and Apple sign-in

Where enabled, signing in with Google or Apple is optional. We use the provider’s verified identity identifier and the email or name it shares to link your journey, recognize your account, and restore your progress. We do not receive your Google or Apple password. Apple may supply a private relay email instead of your personal address.

For Sign in with Apple, the server exchanges a single-use authorization code and stores an encrypted refresh token so it can revoke Apple access when you delete the game account. These credentials are not included in player profiles or data exports.

Google access is limited to basic sign-in information; it does not grant us access to your mail, files, contacts, or calendar. Google's sign-in service may also process account contact information, including a phone number held by Google, approximate location derived from IP, device identifiers, and usage or technical data for authentication, security, and service analytics. WordGlimmer does not request or store your Google phone number. Google's processing is described in its own privacy policy.

We use and transfer information received from Google APIs in accordance with the Google API Services User Data Policy, including its Limited Use requirements where applicable.

You can manage provider access in your Google or Apple account settings. Revoking that access does not itself delete your WordGlimmer game data. To delete the game account, use the in-app deletion control described below.

05Cloud saves, analytics, and notifications

Cloud saving. Cloud synchronization is enabled by default in the current game configuration, including for guest journeys. You can manage it in Settings. Turning it off stops subsequent automatic synchronization; it does not erase data already saved online. Downloaded campaign content and local progress can be used offline, while online features require a connection.

Optional diagnostics. Analytics is off by default. When configured for a release and enabled by you, Firebase Analytics and Sentry can receive limited gameplay events or sanitized error information, such as a pseudonymous player/session identifier, language, level identifier, counts, timing, and technical stack information. The app filters this information and does not intentionally include account emails, passwords, chat messages, or the original error message. You can withdraw this choice in Settings.

Notifications. Optional local reminders require your permission. If remote messaging is available in your installed version and you opt in, the service uses an encrypted push token, language, time zone, and consent status to deliver messages through Expo and Apple’s notification service. Your registration stays active until you withdraw it, so we may send occasional messages, including reminders to return to the game after a period of inactivity. You can turn notifications off in the game or your device settings. Changes made offline reach our service when the app reconnects; device settings control notification display directly. A message already passed to the delivery provider may remain in transit until its expiry. Delivery records are retained for up to 30 days, and associated recipient records are removed when you delete your online account or sign out that installation.

06Service providers and sharing

Supabase provides the game’s server and database infrastructure. Vercel hosts this website and receives the network information necessary to deliver these pages. Apple and Google process information under their own policies when you use their sign-in services. Optional diagnostic providers operate only when configured and enabled as described above.

Providers may process data on our behalf to operate, secure, or support the service. Data may be processed outside your country; where applicable, transfers must use safeguards required by data protection law. We may also disclose information when legally required, to protect someone’s rights or safety, or as part of a business transfer subject to applicable privacy protections.

Shared team messages, rankings, and profile information may be visible to other players. Avoid posting information you want to keep private. Reports may be reviewed to investigate misconduct.

07Advertising and purchases

The current launch configuration has advertising and in-app purchases disabled. It does not run advertising SDKs or collect payments for coins. Coins earned through play are virtual game items.

Advertising and optional coin purchases are planned for a later release. Before activating them, we will update this policy to identify the services used, the data involved, and your choices. Any permission required for tracking will be requested separately. A future purchase will use the relevant app store’s payment flow; do not send payment details to support.

08Storage, retention, and security

Progress is stored on your device and, when synchronization is used, in the online service. We retain account and game records while they are needed to provide your journey. Support and security records are kept only for purposes such as resolving a request, protecting the service, and meeting legal obligations; they should not be kept indefinitely merely because they were collected.

Deleting your online account removes its associated active game records. If Apple access cannot be revoked immediately, an encrypted revocation job and a keyed identifier remain for up to seven days solely to retry that operation. They cannot restore the deleted game account and are removed after successful revocation or expiry. For older Apple accounts without a stored token, the app provides Apple’s instructions for removing access manually. Limited records may remain where the law requires retention or where necessary to establish or defend legal claims. Residual copies in infrastructure backups or logs may remain until their normal replacement or expiry; they are not used to recreate a deleted account during ordinary operation.

We use safeguards including encrypted network connections, access controls, and protected credentials. No storage or transmission method can be guaranteed to be completely secure.

09Your rights and deleting your data

Depending on your location, you may have rights to confirmation of processing, access, correction, deletion, portability, information about sharing, restriction or objection, and withdrawal of consent. These include rights under Brazil’s LGPD where applicable. You may also complain to your data protection authority, including Brazil’s ANPD.

1. Open Settings → Privacy in WordGlimmer.
2. Use Export my data to request an export through the app.
3. Use Delete my online account for the online journey, then confirm. A network connection is required, and the control appears when an online account is associated with the journey.
4. Delete only this device journey clears the local journey. This separate action does not delete an existing online account.

Uninstalling the app, disabling cloud saving, or removing Google/Apple access does not by itself erase server data. If you cannot access the app, contact us through the support page. We may ask for proportionate information to verify that the account is yours before acting on a request.

10Children

WordGlimmer is intended for a general audience and is not directed to children under 13. Do not create an account or use community features if you are below the age at which you may consent to the relevant processing in your country, unless a legally valid parental authorization applies. If you believe a child has provided personal information without appropriate authorization, contact us so we can investigate and remove it where required.

11This website

This website does not set advertising cookies, include third-party analytics, or collect newsletter signups. The small word puzzle demonstration runs in your browser’s memory; its answers are not sent to a server and are cleared when you reload the page. Fonts and artwork are served with the site.

The hosting service still processes ordinary network requests, which may include IP addresses and browser information. If you follow an external link or email us, the destination service’s privacy practices also apply.

12Changes and contact

We may update this policy as the game or legal requirements change. The date at the top identifies the latest version. Material changes will be communicated in the app or by another appropriate method, and we will request a new choice where required. For questions or privacy requests, use the contact listed on the support page.