Privacy

Browser play

A random anonymous player token is stored in an HttpOnly cookie so this browser can recover attempts, bests, and streaks. The database stores your safe generated display name, private move history, scores, attempt branches, and coarse server-side action timing. The beta does not collect cursor trails, advertising IDs, contacts, or a broad browser fingerprint.

For daily and archived ranked play, the server reconstructs every move, validates its path and word, applies gravity, and calculates the score. It also keeps coarse action timing, rejected-move categories, restarts, and rewinds so obvious automation can be investigated. Speed alone is not treated as proof of cheating. We may exclude players from public rankings after fair-play review and retain a private record of the decision and any reversal. Periodic fair-play review may compare saved runs with revealed solutions and related anonymous players’ action timing. Private review records can include generated names, anonymous player references, board references, timing summaries and review notes; they are not public analytics.

When you play inside another website, a separate anonymous cookie keeps your progress on that hosting site. It does not share your player, runs, bests, or streaks with other sites or with direct visits to Wordchute. Use the deletion control here while playing on that site to remove that player’s data.

Dismissing the floating app-download banner saves a timestamp in this browser to hide it for seven days. This preference stays on your device and is not sent to Wordchute.

Local preferences limit repeated gameplay tips about word history and undo. These preferences stay in this browser and are not uploaded.

The word list is versioned and filters profanity, slurs, and sexual terms. The filter will evolve during beta; a rejected word is not made public.

Website analytics

We also record game loads, modal choices, share-button outcomes, and a broad first-visit source category against this anonymous identity. Source categories are limited to options such as search, social, directories, referrals, shared links, and direct or unknown visits. We may keep a short allowlisted campaign label, but we do not store referrer URLs, search queries, or arbitrary campaign text. Shared links include a simple share marker so we can measure game visits and play from shared links, without identifying which person shared them. Copying a link or opening a share sheet does not tell us who receives it, and we do not access your contacts or messages.

Outside the European Economic Area, the United Kingdom, and Switzerland, the website uses Google Analytics to understand page visits, referring sites, device categories, engagement, and feature use. Google assigns a random browser identifier for these reports; we send page paths and referring-site origins without query strings, fragments, or referrer paths, and we do not send it your Wordchute player token, played words, tile paths, or link codes. Uncaught script errors are reported with the error type and script location only. Google signals and ad personalization are disabled.

We count app-promotion views, clicks and dismissals using fixed placement labels, and App Store and Google Play download-link clicks where website analytics is enabled. A browser-tab preference limits the post-game app invitation to once per session. These measurements do not tell us whether you installed the app or identify you across devices.

App analytics and offline practice

The iOS and Android apps use Google Analytics for Firebase, Firebase Performance Monitoring, and Firebase Crashlytics to understand feature use, responsiveness, errors, and crashes. Reports can include a random player identifier, app version, platform, device and operating-system details, screen or action names, timing measurements, and diagnostic logs. Reports can also include fixed product outcomes and reasons, such as which Premium entry point was used, why a move was refused, or the coarse age of a locked past board. In app builds offering offline practice, they can include which practice board size and difficulty were played, how a practice run ended (tiles cleared, word count, whether a hint or solution was used), and the identifier of a shared bundled or downloaded practice board, never its letters, your words, or boards generated on your device. Our custom reporting excludes played words, tile paths, authentication tokens, link codes, contacts, and messages; advertising identifier collection and ad personalization are disabled. Google processes website and app usage and diagnostic data as our service provider; Wordchute does not use it for advertising.

Newer app builds save local preferences to avoid repeating gameplay tips about word history and undo. These preferences contain no played words or tile paths and are not uploaded.

In app builds offering offline practice, downloaded practice boards, word checks, saved runs, and local stats stay on that device. Offline results are not uploaded to the global board, daily streaks, or online player stats. Linking devices does not transfer offline history. You can clear it from the offline library; deleting your player from that install also clears its local library. Deletion from another device cannot erase local files on this one.

In app builds that sell Wordchute Premium (offline play and older past boards), purchases go through Apple’s App Store or Google Play, and RevenueCat processes purchase records for us as our service provider. Wordchute gives RevenueCat a random purchase identifier that our server creates for each app installation; it is not your player identifier, display name, or authentication token. The app’s RevenueCat library also sends basic app, device, and store-transaction details needed to process and verify purchases. We store verified purchase references, the store and product, and which installations may use the purchase so Premium can work on multiple devices using the same store account. Linking gameplay does not share Premium between installations or stores. We never receive your payment details, and we do not share played words, tile paths, or offline history with RevenueCat. Purchase discovery does not merge gameplay identities or restore offline history. Deleting your player removes its device associations and queues eligible RevenueCat records for cleanup. Purchase references still needed by another authorized device are retained until no remaining device needs them. Deletion does not refund or cancel a store purchase.

Newer app builds may keep completed daily dates, review-request cooldowns, and a fixed Premium experiment group on your installation. We count eligible and visible Premium invitations and their clicks, along with attempts to request a native store review. We also count visible reminder invitations, their first/second offer, setup selections and dismissals, opening reminder setup, and successful reminder enablement, with fixed labels for the entry point. Newer builds keep up to two reminder-offer timestamps and a suppression preference on the installation to limit repeated invitations. This record has no player identifier or play history and remains after player deletion so deleting or linking a player does not restart those invitations. These reports use fixed labels; they do not tell us whether the store displayed a review prompt or which rating you gave. Linking preserves these installation preferences, and deleting your player through the app removes its player-linked review and Premium prompt record.

Optional native ad measurement

Android releases configured for advertising measurement ask before enabling it. If you choose Allow measurement, Meta receives its app-specific anonymous identifier, app/device/network information, and coarse app-open, play, finish, return and Premium-offer events to measure our Facebook and Instagram ads. RevenueCat may send verified purchases, currency and value to Meta using that matching identifier. This release does not enable Meta event or purchase sharing on iPhone. We do not collect Apple or Google advertising IDs or send words, tile paths, puzzle answers, game-player identifiers or billing-customer identifiers in gameplay events.

Turn Ad measurement off in app Settings to stop collecting new measurement events and clear the matching attribute from RevenueCat. Previously authorized events already queued or in flight may still be delivered. Deleting your Wordchute player through the app also withdraws measurement. Data already sent remains subject to Meta’s and RevenueCat’s policies. Unconfigured builds do not initialize Meta or show this choice. This does not add browser advertising tracking.

Separately, iPhone builds configured for aggregate install attribution may use Apple’s SKAdNetwork to register an app install. Apple can provide delayed, privacy-limited attribution reports to the advertising network without individual tracking permission. This Apple-only path does not initialize Meta’s SDK, read an advertising identifier, or include your words, puzzle answers or game-account identifier. The optional Ad measurement choice controls Meta event and purchase sharing; it does not control Apple’s aggregate attribution.

Browser reminders

If you enable browser reminders, we store that browser’s push subscription address and encryption keys, your chosen time and time zone, and the board date of the last delivery attempt. Your browser’s push provider processes the encrypted notification. Reminders contain no played words, scores, or player identifiers. With your player we also record whether the reminder prompt was shown, the notification permission result, and when a reminder notification opens the game, with that board’s date. You can turn them off on the Reminders page or revoke notifications in browser settings. Deleting your player also removes its subscriptions. Clearing cookies alone does not stop reminders; revoke browser notifications if you lose access to the original player.

Linked phones

You can link the Wordchute app to this player with a one-time code from the Link a phone page.

If a phone is linked to this player, it shares the same name, runs, bests, and streak. Each linked phone signs in with its own token; the database stores only a hash of it, with the phone’s platform, app build, and when it was last used. To limit abuse of phone sign-in, we keep a keyed hash of the network address used to sign in or link a phone for about two days, never the address itself.

Deleting your data

Clearing browser cookies starts a new anonymous identity but does not delete the old database record. Use the control below to permanently delete this player and its play data; deleting also signs out every linked phone for good. Formal account recovery is not part of this beta.

Uninstalled the app or need help deleting data? Request deletion of your Wordchute player and associated data without reinstalling the app.

You can optionally save a private deletion code from the app’s Account menu or the deletion page while signed in. Anyone holding that code can delete the shared player, so keep it private. We store only its hash; replacement, revocation, or merging two different players invalidates old codes. Deletion queues associated provider cleanup using internal player identifiers, including former merged players, and a support reference. These task records are removed about 30 days after cleanup is completed; pending tasks remain until handled. Analytics and diagnostic reports are not instantly erased by the game-data button.

Contact

For privacy questions, email feedback@wordchute.com.

About Wordchute and how to play