Privacy Policy

01Information we collect

Game and room information. We collect your chosen avatar, player and room identifiers, guesses, scores, game history, chat messages and timestamps, and activity needed to run the game. Private rooms also use admission names, invitation records, membership and approval status, and session identifiers. A name entered when requesting admission is a label supplied by the guest; it is not verified identity. You do not need an email address or account password to play.

Network and device information. Our systems and hosting providers process IP addresses, request times, requested paths, response information, and browser information such as the User-Agent sent by your browser. Public games associate IP addresses with players for network-based lobby discovery and abuse prevention. Reconnecting requires the saved player credential; sharing an IP address does not grant control of another player. Private rooms use network information for abuse prevention. A request that wakes the game server can produce an operational log containing network addresses and browser information.

Age eligibility. The age check receives your age in whole years to determine whether you may participate in multiplayer and chat. We do not retain the submitted numeric age. We store the eligibility result and check time in a signed browser cookie for up to one year. We do not request a birth date or identity document for this check.

Support correspondence. If you email us, we receive your email address, the content of your message, attachments you choose to send, and related correspondence.

Donations. If you contribute through Venmo, we receive payment confirmations that may contain your name or username, amount, date, transaction reference, and any message included in the confirmation. Venmo handles your payment credentials. We do not collect your card or bank credentials through the WordSquad website. Our public server-fund counter displays aggregate amounts, not donor names or messages.

Pen pal games. A pen pal game is played by two people over hours or days. We store its board, turn order and timers, both players' avatars, scores and chat, and whether each player chose to play without turn alerts. Your browser is identified by a pen pal session identifier; we store only a one-way hash of it. If you turn on turn alerts, your browser gives us a push subscription (an address at your browser's push service and encryption keys) and your device's time zone, which we use to avoid sending reminders at night. When an iPhone guest installs WordSquad to their Home Screen, a short join code holds their seat for 30 minutes.

02How we use information

We use information to operate multiplayer games and chat; admit players to private rooms; send pen pal turn alerts and reminders; maintain scores, membership and reconnecting; remember your preferences; enforce age eligibility and host controls; prevent abuse; troubleshoot errors; manage server availability; respond to support and privacy requests; and verify donations and update the server-fund total. We may also use records to comply with applicable legal obligations and address disputes or security incidents.

We do not sell or rent personal information, share it for cross-context behavioral advertising, or use it for targeted advertising. WordSquad has no third-party advertising and does not use Google Analytics or any other third-party analytics or tracking tools.

To understand how the game is used, learn how players find WordSquad, and plan server capacity, our server counts requests it already receives. The daily totals cover lobbies created and joined; rounds started and completed in public, private and pen pal games; how many guesses a round took and how many players guessed in it; which words were solved or missed; round length; the number of chat messages and hints used (never their content); age checks shown, passed and blocked; refused guesses and joins, grouped by a fixed reason such as "not a word" or "room full"; open game connections; and server restarts and errors, grouped by the part of the server and the type of error. If the WordSquad link you open contains campaign labels, such as utm_source, utm_campaign or utm_content in an ad link, we count those labels when they match a campaign we set up; any other value is counted only as "other". When you pass the age check, we count your country and whether you use a phone, an iPhone or an Android device, as determined by our content delivery network, Amazon CloudFront, from your connection. Each total is counted separately and stored only as a daily number. The totals contain no player, room, or network identifiers and cannot be combined to describe an individual visitor. Nothing extra is collected from your browser or stored in it for these totals, and play is the same either way. We do this based on our legitimate interest in running, improving and promoting the game.

03What other players can see

Your avatar, scores, guesses, game activity, chat messages, and typing indicators are shared with other players in your room. A private-room host can see admission requests, including the name a guest supplies. Open lobbies can appear in lobby discovery, including discovery of lobbies on the same network. Someone with an open lobby's code or link can join it, subject to the age check.

Private rooms require an invitation and host approval and do not appear in public lobby discovery. Private chat is available to approved participants and is processed and stored on our server; it is not end-to-end encrypted. Other participants can copy, record, or share what they see. Avoid posting contact details, sensitive information, or anything you do not want other participants to retain.

Pen pal games require the invite link, which works once, and do not appear in lobby discovery. Your pen pal can see your avatar, guesses, scores, chat, whose turn it is, when you last played, and whether you have turn alerts on.

04Service providers and other disclosures

We use Amazon Web Services (AWS) for hosting, delivery, storage, operational logs, and donation processing. Zoho Mail hosts our support email. Google's Gmail receives Venmo payment confirmations and forwards selected confirmations to AWS for the donation counter. These providers process information needed to deliver those services.

Venmo processes donations under its own privacy practices. Payment confirmations in email and records held by Venmo are separate from the public donation counter. Following a payment link takes you to a third-party service whose privacy policy applies there.

Pen pal turn alerts are delivered by your browser's push service (Apple, Google, Mozilla or Microsoft, depending on your browser and device). Each alert is encrypted so that only your browser can read it, and contains only avatars and turn status, never guesses, secret words or chat. The push service receives the subscription address, the time and size of each alert, and connection information, and handles it under its own privacy practices.

For public-game definitions, our server may request a word definition from dictionaryapi.dev. The request sends the word and our server's connection information; it does not include your player identifier, chat, or browser's IP address. Private-room definitions use our bundled dictionary.

We may disclose information when required by law or legal process, or when reasonably necessary to investigate abuse, protect people, secure the service, or establish or defend legal claims. If ownership or operation of WordSquad changes, information may be transferred as part of that change, subject to applicable law and notice requirements.

05Cookies and browser storage

We use cookies and browser storage to provide the game and remember settings:

• An age-eligibility cookie remembers the eligibility result and check time for up to one year.
• A private-room session cookie identifies your browser session. Private membership is subject to the room and session limits described below; browser session restoration may preserve a session cookie.
• A pen pal session cookie identifies your browser's pen pal games. It expires 30 days after its last use. If you turn on turn alerts, your browser installs a service worker for this site that shows the alerts; it does not cache pages or see other websites.
• Local storage remembers public-game identifiers, reconnecting and host information, your avatar, theme, sound, haptics, layout, room preferences, and some server-wake and donation-display preferences. These entries generally have no automatic expiry.
• Tab session storage remembers which private room a tab is using, admission progress, and some game interface state. It does not replace server-side membership checks.

You can clear cookies and site storage or restrict them in your browser. Doing so may require a new age check, reset preferences, or remove your ability to reconnect or control a room. Clearing browser storage does not itself delete information already stored on our server or copied by other players.

We do not track your activity across unrelated websites, and WordSquad uses no analytics or advertising cookies. Until October 2026, WordSquad offered optional Google Analytics to people who allowed it. If you allowed it, WordSquad removes the Google Analytics cookies and the related local records from your browser the next time you open the site. That removal does not delete information Google already received; our Google Analytics property was configured for two-month user-level and event-level data retention, with deletion processed monthly. That setting does not apply to standard aggregated reports. Google handles retained information under its own privacy practices (https://policies.google.com/privacy). We do not sell personal information or share it for cross-context behavioral advertising, so there is currently no such activity for a Global Privacy Control signal to opt out of. External services you visit have their own practices and browser-signal responses.

06How long information remains

Public games. Public games, including the default shared game, expire after 30 minutes of inactivity or 24 hours from creation, whichever comes first. Expired records cannot be restored for play. Redis records expire automatically; saved JSON records and in-memory games are cleared when cleanup next runs during server activity. A sleeping server may retain expired disk records until it wakes and cleanup runs. Public history is limited to the latest 100 chat messages and 20 completed games.

Private rooms. Membership lasts up to 12 hours and cannot extend beyond the host's session. Rooms become unavailable after 30 minutes of inactivity or the host's session expiry, and the host leaving closes the room. Expired room records are removed when the private-room system next processes its stored records; expiration is not a guarantee that every disk copy is immediately erased. Private-room history is limited to the latest 100 chat messages and 20 completed games. Invitations expire after one hour, and pending admission requests expire after at most 10 minutes or when their invitation expires, whichever comes first.

Pen pal games. A pen pal game ends when either player leaves, or after 14 days with no move. An ended game stays readable to both players for 3 days and is then deleted automatically; automatic deletion can take a few more days to complete. Pen pal sessions, with their push subscriptions and time zone, are deleted 30 days after their last use. A session's push subscriptions are removed earlier when it has no games left, when you revoke notification permission and next open WordSquad, or when the push service reports them invalid. Join codes expire after 30 minutes. Daily pen pal totals, such as the number of games started, contain counts only and are kept for about 13 months.

Aggregate statistics. The daily totals described above contain counts only, with no player, room, or network identifiers, and are deleted two years after the day they cover.

Operational logs. Server-wake logs are configured for seven-day retention, pen pal reminder logs for 14-day retention, and donation-processing logs for 30-day retention. Provider deletion may follow its retention processing cycle. Other server records and older operational logs do not all have a fixed automatic deletion period and may remain until removed.

Donation records. Successfully processed email copies in our automated AWS inbox are deleted after counting. Unprocessed copies are configured to expire after seven days, subject to AWS lifecycle processing. Duplicate-prevention markers are configured to expire after 90 days. Aggregate monthly donation totals remain. Original email confirmations and records held by email or payment providers are separate and do not inherit these automated inbox deadlines.

Correspondence and other retained copies. Support emails and original payment confirmations have no fixed automatic deletion period. We retain correspondence to handle the matter and for related recordkeeping, disputes, security, or legal needs. Residual records on retained disks, in storage journals, or in any backup copies may outlast their availability in the live game. Contact us to request deletion of information we can identify, subject to applicable legal requirements and exceptions.

07Your choices and privacy requests

You may choose what to put in chat, leave a room, clear browser storage, and contact support@wordsquad.io to request access, correction, or deletion of information relating to you. Leaving or being removed from a room does not automatically erase past chat or game history.

You can turn off pen pal turn alerts at any time in your browser or device notification settings. Leaving a pen pal game ends it for both players.

To help us locate the relevant records, describe the request and include the approximate date, room code if known, and avatar or admission name you used. Do not email passwords, private invitation links, or session credentials. We may ask for additional information reasonably needed to verify that records relate to you or to protect another person's information. When appropriate after verification, we can erase a room's live game record, including its chat, history, and player information. This closes or resets the shared room for all participants. Because players do not have verified accounts, we may be unable to link every record to a particular person.

Depending on the laws that apply to you, you may also have rights to receive a copy of your information, object to or restrict processing, withdraw consent where processing relies on consent, use an authorized agent, appeal a decision, or complain to a privacy regulator. To make a request or appeal, email the address above. We will respond as required by applicable law and will not discriminate against you for exercising applicable privacy rights. We may retain information where the law permits or requires it, and we cannot erase copies independently retained by other players or third parties.

08Children and age eligibility

WordSquad multiplayer and chat are intended for people aged 13 and older. The age check blocks participation when a person reports being under 13. Public introductory pages remain available. The check is based on the submitted answer and does not verify identity.

Pen pal games and turn alerts are offered only after the age check.

If you believe a child under 13 has provided information through multiplayer or chat, contact support@wordsquad.io with enough detail to help us locate it. We will investigate and take appropriate steps to stop further collection and delete information as required by applicable law.

09Security and processing location

Our game servers are hosted in the United States. Our providers may process information in other countries where they operate. Those countries may have different privacy laws from the country where you live.

We use safeguards including HTTPS, access controls, and protections for private-room sessions and stored data. No system can guarantee complete security. Private rooms control who can join; they do not prevent an authorized participant from copying or sharing content.

10Changes and contact

We will post policy updates with a revised effective date. If a change materially affects how we handle personal information, we will provide a prominent website notice and any additional notice or consent required by applicable law before applying the change.

For questions or privacy requests, contact Jacob DeVeydt, operator of WordSquad, at support@wordsquad.io. Website: https://wordsquad.io.