Privacy Policy

Word Search VS (the "App") is published by Not Just a Puzzle, based in California, United States. This Privacy Policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have.

Last updated: [will be replaced automatically at build time by postbuild.sh] Effective date: [same]

If you have questions, email support@notjustapuzzle.com.

---

1. Summary — the short version

We built Word Search VS to work with the least amount of personal data possible. Concretely:

If that summary answers what you needed, you can stop reading. If you want the specifics, they follow.

---

2. Data we collect

2.1 Data you provide directly

| Data | Purpose | Where it lives | |---|---|---| | Display name (1–30 characters) | Show other players your name in multiplayer rooms | Firebase Realtime Database (see §3) while your room is active. Cached in your device's local storage so you don't have to re-enter it. | | Custom puzzle word lists (Custom mode only) | Generate the puzzle you asked for | Only on your device (or, if you host a multiplayer custom room, in Firebase for the duration of that room only). | | Profile info (optional — only if you tap "Sign In") | Cross-device stats sync | Firebase Authentication + Firebase Realtime Database. Your email is stored by Firebase Auth; we never see the password. | | Anonymous player id (only when you use online play, leaderboards or the daily challenge) | Lets the database check that you only change your own seat, chat messages and scores | Firebase Authentication issues a random anonymous id (no email, name or password). It is stored on your device and attached to your room seat, chat messages, leaderboard and daily-challenge entries. | | Chat messages & reports | Room chat; player safety | Firebase Realtime Database. Any player can tap ⚑ on a message to report and block the sender. A report stores the reporter's and sender's anonymous ids, the sender's display name, the message text and room code so we can review abuse. Blocking hides that player's messages on your device only. |

2.2 Data collected automatically (only with your consent)

| Data | Purpose | Who receives it | Consent required | |---|---|---|---| | Anonymized usage events (screen views, mode played, round completion times — no personal identifiers) | Understand which features are used so we can improve them | Google Analytics 4 (Google LLC) | Yes — banner on first launch | | Crash + error diagnostics (stack traces, device model, OS version — no personal identifiers, IP address scrubbed) | Diagnose bugs | Sentry (Functional Software, Inc.) | Yes — banner on first launch |

If you decline consent OR your OS has "Do Not Track" / "Limit Ad Tracking" enabled, none of the above is collected or transmitted. The game works fully without it.

2.3 Data we do NOT collect

---

3. Third parties who process your data

We only work with third parties whose privacy standards meet or exceed our own. This list is complete — if we add anyone in the future, we will update this document AND notify you in-app before it takes effect.

| Third party | What they process | Why | Their privacy policy | |---|---|---|---| | Google LLC (Firebase Realtime Database, Firebase Authentication, Firebase Hosting) | Display name, room codes, custom puzzle words during multiplayer, email (only if you sign in) | Real-time multiplayer sync, optional sign-in | https://firebase.google.com/support/privacy | | Google LLC (Google Analytics 4) | Anonymized usage events with IP truncation enabled — only after you consent | Product analytics | https://policies.google.com/privacy | | Functional Software, Inc. (Sentry) | Crash diagnostics with user identifier scrubbed — only after you consent | Bug diagnosis | https://sentry.io/privacy/ | | Apple, Inc. (iOS App Store, StoreKit, iCloud sign-in if used) | Purchase receipts, subscription state | In-app purchases (Pro tier), account restore | https://www.apple.com/legal/privacy/ | | Google LLC (Google Play Store, Play Billing) | Purchase receipts, subscription state | In-app purchases (Pro tier) on Android | https://policies.google.com/privacy | | Automattic, Inc. / WordPress + WooCommerce hosting for notjustapuzzle.com | Order information if you buy a printed book | Book fulfillment | https://automattic.com/privacy/ |

3.1 Third-party artificial intelligence — full disclosure

We use third-party AI tools for marketing content generation only. Specifically:

AI is NOT used to:

If we ever start using AI to process user data (for example, an AI-assisted profanity filter for room chat), we will update this section AND require your explicit opt-in before any of your data is sent to an AI service.

---

4. Data retention

| Data | Retention period | |---|---| | Multiplayer room data (display names, custom words, scores) | Automatically deleted from Firebase within 24 hours of the room becoming inactive | | Chat messages | Deleted when the room is deleted | | Abuse reports | [OWNER ACTION REQUIRED: choose a retention period, e.g. 12 months after review] | | Analytics events (Google Analytics 4) | 14 months, then automatically purged by Google | | Crash diagnostics (Sentry) | 90 days, then automatically purged by Sentry | | Optional signed-in profile (email, cross-device stats) | Kept until you delete your account (see §6) | | Purchase receipts | Kept for 7 years per U.S. tax law requirements |

---

5. In-app purchases (Word Search VS Pro)

Payment processing is handled entirely by Apple (App Store, iOS) or Google (Play Store, Android). We never see your card number, CVV, billing address, or full name. We only receive:

We use this data only to grant you the Pro entitlement you purchased. You can manage or cancel subscriptions any time via iOS Settings → [your name] → Subscriptions or Google Play → Payments & subscriptions → Subscriptions.

---

6. Your rights

You have the following rights, regardless of where you live. If you're in the EU, UK, or California, these rights are backed by law (GDPR / UK GDPR / CCPA) — we honor them for everyone.

How to exercise your rights

---

7. Children's privacy

Word Search VS is rated 4+ in the App Store and is family-friendly. However, we are not directed to children under 13, and we do not knowingly collect data from children under 13 without verifiable parental consent.

On first launch we ask "Are you 13 or older?". If you answer No, we:

If we learn that we have collected data from a child under 13 without parental consent, we will delete that data promptly. Parents may contact support@notjustapuzzle.com with proof of guardianship to review or delete a child's data.

For readers in California and Delaware, additional protections under the California Age-Appropriate Design Code Act and the Delaware Personal Data Privacy Act apply — we apply the strictest interpretation of these rules globally.

---

8. International users

The Firebase servers your data touches are in the United States. If you're in the European Economic Area, United Kingdom, or Switzerland, transferring data to the U.S. is done under Google's Standard Contractual Clauses. Google is certified under the EU-U.S. Data Privacy Framework, the UK Extension, and the Swiss-U.S. Data Privacy Framework.

For California residents: this policy also serves as our CCPA / CPRA Notice at Collection. We do not "sell" or "share" personal information as those terms are defined by California law. You have the right to request the categories of personal information we collect (listed in §2) and to opt out of any future sale or share (we do not currently engage in either).

---

9. Security

We use the following technical safeguards:

No system is perfectly secure. If a breach affects your personal data, we will notify you within 72 hours per GDPR Article 33.

---

10. Changes to this policy

If we make material changes, we will:

  1. Update the "Last updated" date at the top
  2. Show an in-app notice on next launch
  3. If the change expands data collection, require explicit re-consent before that new collection starts

Non-material updates (typo fixes, clarifications) may be made without notice, but we will keep a history in our git repository at https://notjustapuzzle.com/play/ for review.

---

11. Contact

Data controller: Not Just a Puzzle Email: support@notjustapuzzle.com Postal: available on request via the email above (we operate remotely and do not publish a physical address publicly for security reasons; we will provide it to any user or regulator upon request)

For EU / UK residents: you have the right to lodge a complaint with your local data protection authority. A directory is available at https://edpb.europa.eu/about-edpb/board/members_en.

⚡ Play Word Search VS