Privacy policy
Who we are
WordPlanet is operated by [operator name — set OPERATOR_NAME], [postal address — set OPERATOR_ADDRESS]. Contact for privacy questions: [contact email — set OPERATOR_EMAIL].
What we collect when you play
Gameplay data: a random player identifier stored in a cookie, your guesses, results, statistics and streaks. This is necessary to provide the game (Art. 6(1)(b) GDPR) and is kept while you keep playing, and deleted after 730 days of inactivity for players without an account.
Account data (only if you register): email address, password hash (Argon2id — we never store your password), optional display name, nickname and settings.
We do not collect your precise location, contacts, or any data from your device beyond what your browser sends with every request.
Anonymous usage statistics (only with your consent)
If you allow it, your browser sends first-party events such as page views, game started/completed and share clicks, together with a random browser identifier, the page language, the type of device and browser, the referring website, and your country (derived from your IP address at the time of the request; the IP address itself is not stored). We use them only in aggregated form to improve the game (Art. 6(1)(a) GDPR).
Country statistics are shown to our staff only in aggregated form and only for groups of at least 5 people. Raw events are deleted after 395 days.
Country detection (only with your consent)
If you allow country detection, we derive your country — and nothing more precise — from your IP address at the moment of the request, using a local database or the country header of our hosting provider. The IP address itself is not stored. Your country is never used to choose your language.
Advertising
WordPlanet shows clearly labelled sponsored messages. We do not sell personal data and do not share it with advertisers; advertisers only receive aggregated reports (impressions, clicks, countries, device types).
To limit how often you see the same ad (frequency capping) we use your random player identifier only if you consent to advertising cookies. Without consent we use a short-lived hash that changes every day and is never stored.
Third-party ad networks are not active. If they are activated in the future, this policy will be updated and your consent asked for first.
Who receives data
Our hosting and email providers process data on our behalf under data processing agreements. We do not transfer data to other third parties unless required by law.
Your rights
You can download all data we hold about you and delete it at any time on your profile page. You also have the right to rectification, restriction, objection, and to lodge a complaint with a supervisory authority.
You can change or withdraw your consent at any time via “Cookie settings” in the footer; withdrawal does not affect processing before it.
Security
Connections are encrypted, passwords are hashed with Argon2id, staff access is role-based and logged, and access to administrative data is restricted to authorised staff.