Privacy Policy

Last updated: 7 September 2026

This policy explains what data World's Greatest Game (the "Game", "we", "us" or "our") collects when you play or buy access at worlds-greatest-game.com, why we collect it, who processes it, how long we keep it, and the rights you have. The Game is operated by its developer; you can reach us at support@worlds-greatest-game.com, and that address is the contact for everything in this policy.

1. What we collect and why

Account data

When you play as a guest, we create an anonymous account identifier. If you sign in or create an account (required after a purchase so it can be restored), we store your email address and which sign-in provider you used (Google, Apple, or email and password). We use this to run your account and to restore your purchases on a new device. Legal basis: performing our contract with you.

Purchases

On the website, payments are processed by Stripe. Stripe collects your email, billing address and payment method; we never see or store your full card details. On our side we store a reference to your Stripe customer record, your subscription status, and for lifetime purchases the payment reference we need to handle refunds. In the mobile apps, payments are processed by Apple's App Store or Google Play, and RevenueCat processes the purchase state on our behalf so your unlocks work and can be restored; we never see your payment details there either. Legal basis: performing our contract, and legal obligations such as tax and financial record keeping.

Crash reports (mobile apps only)

The iOS and Android apps send a crash report if the app crashes, via Firebase Crashlytics: what failed in the code, your device model and operating system version, and the account identifier, so we can reproduce and fix the crash. The website sends no crash reports. Legal basis: our legitimate interest in keeping the app working.

Free plays and devices

We count your free plays per word pack so the free allowance works. For paid accounts, a randomly generated device identifier is bound to your account to prevent account sharing. Declaring this on the app stores: "Device or other IDs". Legal basis: performing our contract, and our legitimate interest in preventing fraud and abuse.

The words you type

Custom words you enter are used to run your game. When players join a shared room to add words from their own phones, the words every participant enters are saved with the host's game. For signed-in players, words used in your games can be saved to your account, and words you block or report are stored so they stay blocked and so we can review them. Legal basis: performing our contract, and our legitimate interest in content curation.

Usage statistics (first party only)

We keep aggregate daily counters (for example: games started, paywall views, language used) and a small per-account record of how far you got in the product (played, saw the paywall, purchased). These are collected by our own backend. We do not use Google Analytics or any other third-party analytics, there are no advertising trackers, and we set no analytics cookies, which is why the Game shows no cookie banner. Legal basis: our legitimate interest in understanding aggregate product usage.

Diagnostics

Technical logs (errors, security events, and some sign-in events) are kept in Google Cloud Logging for about 30 days and then deleted automatically. These logs can include your account identifier and, in some sign-in events, your email address. Legal basis: our legitimate interest in keeping the Game working and secure.

Anti-abuse (reCAPTCHA v3)

The Game uses Firebase App Check with Google reCAPTCHA v3, which runs when the app loads and shares device and usage signals with Google to tell humans from bots. We consider this strictly necessary: the Game exposes payment and content endpoints that would otherwise be open to automated abuse, and reCAPTCHA is the mechanism that protects them. It is used only for security, not for advertising or profiling by us. Legal basis: our legitimate interest in securing the service. Google's own privacy policy applies to its processing.

Closed testing programmes

During closed test rounds, and only for accounts we have individually enrolled as testers, we record a detailed activity trail: the screens visited, game actions, the words typed into word pots, and any errors encountered. We use it solely to find and fix problems and to improve the Game. Testers are told about this recording when they join a test round, it never applies to ordinary players, and the trail is deleted automatically after about 60 days or when the account is deleted, whichever comes first. Legal basis: our legitimate interest in testing the service with informed participants.

2. Cookies and local storage

We use your browser's local storage for strictly necessary purposes only: keeping you signed in, saving game state so the Game works offline, and remembering settings and free play counts. We set no advertising or analytics cookies. reCAPTCHA may set its own cookies for security purposes as described above.

3. Who processes your data

• Google Ireland Ltd / Google LLC: Firebase (authentication, database, functions, hosting, logging, and crash reporting in the mobile apps) and reCAPTCHA. Transfers to the United States are covered by the EU-US Data Privacy Framework and standard contractual clauses.
• RevenueCat, Inc.: purchase state for the mobile apps (which products an account has bought on the App Store or Google Play), so unlocks work and can be restored.
• Stripe Payments Europe Ltd / Stripe Inc: payment processing, billing and the customer portal.
• Apple and Google as optional sign-in providers, when you choose them.

We do not sell personal data and we share it with no one else.

4. How long we keep it

• Account data: until you delete your account.
• Purchase records: as long as financial and tax law requires.
• Diagnostic logs: about 30 days.
• Closed-testing activity trails (enrolled testers only): about 60 days.
• Shared word rooms: deleted automatically about 3 hours after they are created.
• Aggregate usage counters: kept indefinitely (they contain no account data).

5. Your rights

Under the GDPR and similar laws you can ask for access to your data, correction, deletion, a portable copy, restriction of processing, and you can object to processing based on legitimate interest. You can also complain to your local supervisory authority. The fastest route for deletion is the "Close account" option in the Game's account screen; for everything else, email support@worlds-greatest-game.com.

6. Account deletion and its current limits

Closing your account deletes your account and its game data. Some records are retained afterwards, and we want to be straightforward about which:

• Purchase records at Stripe are kept as long as financial law requires.
• Aggregate usage counters are unaffected (they are not tied to your account).
• A small per-account funnel record and any word reports you submitted are currently retained after deletion; we are working on removing these automatically, and will delete them on request in the meantime.
• Diagnostic logs expire on their own after about 30 days.
• An active subscription must be cancelled before the account can be closed, so that you are not billed for something you can no longer access.

7. Children

The Game is not directed at children under 13, and you must be at least 13 (or the higher minimum age that applies in your country, for example 16 in some EU member states) to create an account or make a purchase.

8. What we do not do

• No sale of personal data.
• No advertising and no advertising SDKs.
• No cross-site or cross-app tracking.
• No profiling that produces legal or similarly significant effects.

9. Changes to this policy

We may update this policy as the Game evolves. When we do, we will change the "last updated" date above, and for significant changes we will say so in the Game.

10. Contact

Questions about this policy or your data? Email support@worlds-greatest-game.com.