Privacy Policy

Who we are (Data Controller)

The data controller for Wordy Bunch is:

Wordy Bunch is a trade mark of Brainy Bunch Games Limited (UK trade mark application UK00004382983, classes 9 and 41). For studio-wide privacy questions, see our studio privacy policy.

What we collect, and why

On the app server (Supabase)

These are stored against an anonymous identifier generated automatically when you first open the app. It contains no information about you, your device, or your real-world identity — unless you choose to link a sign-in method (see "Email address" below).

• Email address (optional) — only collected if you choose to Sign in with Apple, Sign in with Google, or link an email address from Settings. We store the email address against your anonymous identifier so the same profile is restored if you reinstall the app or sign in on another device. Used only for account recovery and cross-device sign-in — never for marketing, drip emails, or sharing with third parties. You can skip sign-in entirely and keep playing fully anonymously.
• Display name — you type this so other players can see who they're playing.
• Avatar emoji + colour — visual identification only.
• Region — UK or US, used to seed the Daily Challenge and segment ranked leaderboards.
• Friend code — a 6-character code you can share with friends to add each other.
• Friends list — IDs of your accepted friend connections.
• Game stats — best score, total games played, daily streak, skill ratings per region, campaign stars. Used to populate leaderboards and your profile.
• Presence — when you last opened the app and a coarse activity tag ("in a multiplayer game") so friends can see if you're online.
• Match data — during an active multiplayer round: room state, words found, quick-chat messages. This is transient and cleaned up automatically after the round ends.
• Notification token — only if you turn on notifications: your device's push token, stored so we can deliver friend game-invite notifications. It is a delivery address for notifications, not an advertising identifier. It is removed when you turn notifications off or delete your profile.
• Game invites — when a friend invites you to a multiplayer lobby (or you invite a friend), we record who invited whom and the room code so the invite can be delivered and opened. An invite can only be accepted for 15 minutes after it's sent; the record itself is then swept within a day.
• Word reports & suggestions — if you long-press a word and tap "⚑ Report", or use Settings → Word List → Suggest a missing word, the word string and your anonymous identifier are saved so we can review the list periodically. Word reports never include any other context about you.
• Player-name reports — if you tap the ⚑ flag on another player's card (or "Report" on an iMessage duel) and submit, we store the reported display name, your chosen reason, any optional note, your anonymous identifier, and — when known — the reported player's anonymous identifier and the screen you reported from. This is used solely for moderating offensive display names, and is the one report type that records limited data about another player.

Anonymous interaction counts (no identifier)

We count how often certain actions happen — for example, "demo round started on the website" or "demo round completed" — to understand which features are working. Each count is a single row in our database with the event name and a timestamp. Specifically:

• There is no identifier of any kind attached to the count.
• There is no IP address, no device information, and no user agent stored.
• We cannot tell who took an action — only that one happened.
• Counts go to our own Supabase backend; no third-party analytics service is involved.

On-device name safety (AI second opinion)

On phones that support on-device AI, Wordy Bunch adds a private second opinion to its display-name filter. When you choose or change your display name, a small AI model running entirely on your own device takes a quick look to help catch offensive names that slip past our word list. It is purely a safety check, and:

• Your name is checked on your device only — it is never sent to us, or to anyone else, for this check.
• If the on-device check thinks a name looks suspect, we add a single anonymous +1 to a counter (one of the anonymous interaction counts above) — with no name and no identifier attached. It only tells us how often the filter might be missing something.
• This check never blocks you and never changes your name on its own — our ordinary word-list filter remains what decides whether a name is allowed.
• Phones that don't support on-device AI simply skip this; nothing changes for them.

Aggregate gameplay analytics (in-house only)

To understand how the game is being used and to guide design decisions (e.g. whether a feature is reached, whether multiplayer rounds complete, whether the campaign is too hard), we aggregate gameplay data we already store — words found per round, scores, daily challenge completion, multiplayer-match outcomes, purchase history — into anonymised summary tables inside our own Supabase backend. These summaries are linked to your anonymous identifier so we can compute things like "what percentage of players reach campaign level 10". They are never shared with third-party analytics services, advertising networks, or data brokers, and they are not used to profile you individually or to personalise the experience.

Launch-notification list (opt-in, only if you submit your email)

The marketing site at wordybunch.co.uk includes a "Be the first to know" form. If you submit your email address there:

• We store the email and the date you submitted it on our own Supabase backend. Nothing else — no name, no IP, no marketing tracking pixels.
• The lawful basis is your consent (UK GDPR Article 6(1)(a)) — by submitting the form you consent to a single launch-day email.
• We will email you once, when the app launches on the App Store and Google Play. We do not run drip campaigns, sell the list, or share it with anyone.
• You can unsubscribe at any time by emailing [email protected]; we will mark your row as unsubscribed and remove it on request.
• If the launch is cancelled or postponed indefinitely, we will delete the list without sending anything.
• The form is purely optional — Wordy Bunch the app does not require an email and does not include this form.

On your device (never sent off-device)

• All of the above, cached for offline use.
• Achievement and badge progress.
• Sound, music, haptics, theme, and motion preferences.
• Tutorial and first-time-tip flags.
• Dictionary lookup cache for word definitions.
• Optional notification preferences — if you opt in to a daily reminder, your chosen time-of-day is stored on your device. See "Notifications" below for what enabling notifications involves.

iMessage word duels

Wordy Bunch includes an optional iMessage extension that lets you play a turn-based word duel directly inside a Messages conversation. The extension itself has no network access. For one-to-one duels it sends nothing to our servers — the whole game state rides inside the iMessage itself, delivered peer-to-peer by Apple's Messages service to the person you're playing. Specifically:

• Duel messages carry the full game state in the message link's ?d= token (capped at 5000 characters). That token contains your chosen display name, friend code, cosmetic IDs (avatar, colour, finish, and card-background), your equipped title and badges, the game board, per-turn scores, and the list of words each player found — so both players can replay the round on their own device.
• Friend-code invites carry only your 6-character friend code and chosen name in the link's ?fc= and ?n= fields — nothing else.
• None of this passes through Wordy Bunch servers. The data travels inside the iMessage as part of the message URL; only you and the person in the conversation receive it. Two actions hand off to the main Wordy Bunch app (not the extension itself): adding a friend from a received invite, and — if you tap "Report" on a received duel — filing a player-name report, which passes only the opponent's display name — no identifier — to the main app's moderation backend (see "Player-name reports" above).
• Group Word Duels (3+ players) are the one exception — they use our server for the shared scoreboard. A group duel needs everyone's turns compared in one place, so when you create or play a group duel the main Wordy Bunch app (not the Messages extension) stores the challenge and your entry on our Supabase backend: your anonymous identifier, your display name, your score, the words you found, and when you submitted. This is the same kind of match data we already store for in-app multiplayer. It is used only to build that duel's standings, revealed to the other players in the conversation when the duel ends, and your entries are deleted when you delete your profile.

League results posting to chat apps (your opt-in)

Leagues are an optional private monthly competition over the Daily. A league admin can connect their league to an external Slack, Discord, or Telegram channel so each day's results can be posted there automatically. This is the one feature that can send your display name and score to a third-party chat service outside Wordy Bunch, so your own results are sent only if you switch posting on yourself:

• You choose, with an off-by-default switch. The league screen shows you a notice naming the connected service ("…each day's results, including your name and score, are sent there"). Your results are not posted unless you turn on the "Post my results" switch yourself. It starts off. You can turn it back off at any time, which stops your results being posted straight away.
• What is posted — for each member who has turned posting on and played that day, their display name, score, and league ranking. No identifier, email address, or word list is sent to the channel.
• Where it goes — the post is delivered to the channel the admin linked, on Slack, Discord, or Telegram. Once it reaches that service it is governed by that service's own privacy policy and by your league admin, not by us. The connection secret the admin provides (a webhook URL or bot token) is stored encrypted in our backend and is never shown back to anyone.
• Off by default. Nothing is posted unless a league admin has linked a channel and you have turned on posting of your own results. Turning it off, leaving the league, or deleting your profile all stop your results being included.

Notifications (opt-in)

Notifications are off until you turn them on — either from the prompt after your first Daily round, or from Settings → Reminders. Enabling them covers two things:

• Daily Challenge reminder — a once-a-day reminder scheduled entirely by your device's operating system at the time you chose. Nothing about this reminder is sent over the network; your phone schedules the alert locally.
• Friend game invites — enabling notifications also registers your device's push token with our Supabase backend so a friend can send you a "join my game" notification from inside the app. The notification is delivered through Expo's push service and your platform's notification service (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android), used only as a delivery pipe — see "Third-party services" below.

You can turn notifications off any time in Settings → Reminders, or by revoking the notification permission in your device's system settings — either one stops both the daily reminder and friend-invite notifications. Deleting your profile also removes your stored push token. We count opt-in / opt-out as an identifier-free interaction count (see above) — it only tells us "someone enabled notifications," not who.

What we do not collect

• Phone number, real name, postal address, or government ID.
• Location data (GPS, IP-based, or otherwise).
• Device advertising identifiers (IDFA / GAID).
• Contacts, calendar, photos, or microphone.
• Third-party analytics SDK data — we have not integrated Firebase Analytics, Amplitude, Mixpanel, AppsFlyer, or any third-party behavioural-analytics service. We use Sentry for crash and performance diagnostics only (see "Third-party services"). We use Firebase Cloud Messaging solely to deliver notifications on Android — Google Analytics for Firebase is disabled; see "Notifications" and "Third-party services". Aggregate gameplay metrics (rounds played, words found, feature use) are computed inside our own Supabase backend; nothing is forwarded to third-party trackers.
• Payment information — purchases (cosmetic items only — see "In-app purchases" below) are processed by Apple App Store or Google Play directly. We never see your card number, billing address, or any payment credential.

In-app purchases

The app is free to download and play. We offer optional in-app purchases for cosmetic items only — avatars, themes, card backgrounds, and visual finishes. These purchases:

• Do not affect gameplay. Every game mode, ranked tier, daily challenge, and campaign level is fully accessible without paying. Cosmetics are visual only.
• Are processed by Apple or Google directly. We never see your card details, billing address, or any payment credential.
• Restore across devices when you re-install the app. Restoration is tied to your anonymous identifier on our server, not to a personal account.

Third-party services

• Supabase — hosts the database and authentication. Anonymous auth means no personal credentials are passed.
• RevenueCat — handles in-app purchase receipt validation and entitlement restoration. RevenueCat receives an anonymous customer identifier (linked to your Supabase auth.uid, no personal data) plus the purchase receipt from the App Store or Play Store. It does not receive your name, email, payment details, or device advertising identifier.
• Sentry — crash and performance diagnostics. If the app crashes, hangs, or runs into an unexpected error, Sentry records the technical context (stack trace, breadcrumbs of recent in-app actions, device model, OS version, app version) tagged with your anonymous identifier so we can match a crash to a single user without identifying you personally. Sentry does not receive your email, display name, game content, or any advertising identifier. We use it strictly to fix bugs and improve stability.
• Word definition lookups (dictionaryapi.dev, Datamuse, Wikimedia REST) — when you long-press a word to see its definition, the app sends only the word string itself to one of these services. No user identifier or device information is included.
• Notification delivery (Expo push service; Apple Push Notification service on iOS; Firebase Cloud Messaging on Android) — if you enable notifications, these services relay friend game-invite notifications to your device. They receive your device's push token and the notification text purely to deliver it; no analytics or advertising data is involved.

We do not embed advertising SDKs, tracking pixels, or third-party analytics.

Children

Wordy Bunch is rated suitable for ages 4 and up and is designed for a general audience. You can play entirely anonymously — we collect no personal information by default. The only personal data we ever collect is an optional email, and only if you choose to sign in with Apple or Google or link an email yourself (those sign-in providers have their own minimum-age requirements). We do not ask for your age or date of birth, show behavioural advertising, or use third-party analytics. On this minimal-data basis the app is built to comply with the Children's Online Privacy Protection Act (COPPA) and equivalent EU/UK regulations.

Data retention

• Local data — kept on your device until you uninstall the app or clear its storage. Removing the app removes everything cached locally.
• Server-side anonymous profile — persists indefinitely so your stats, friends, and ranked rating survive app reinstalls. Deleted on request (see "Your rights").
• Inactive multiplayer rooms — swept automatically within an hour of going stale, including any chat or word data that was tied to them.
• Group Word Duel turns — a group duel stops accepting turns 6 hours after the first player joins. The stored standings (display names, scores, words found) are kept briefly after that so players in the conversation can still open the final result, then deleted automatically about a week after the duel ends — and sooner if you delete your profile.
• Notification token and game invites — your push token is kept while notifications are enabled and removed when you turn them off or delete your profile; game-invite records expire after 15 minutes and are swept within a day.
• Word reports and suggestions — retained for moderation review; periodically processed in batches and removed once acted on.
• Player-name reports — retained for moderation review; removed once acted on, or when either the reporter or the reported player deletes their profile.

Your rights

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to access, correct, erase, restrict or object to processing of your personal data, and to data portability. In Wordy Bunch you can exercise these directly:

• Hide your presence. Settings → Friends → "Appear offline to friends" hides your online status and current activity from your friends list. You still see your friends' status normally; they see you as offline regardless of whether you're using the app.
• Edit your profile at any time — display name, avatar, colour, and region are all editable from the home screen and Settings.
• Remove a friend at any time from their profile card; this deletes the friendship row on both sides.
• Clear local data by uninstalling the app from your device — this removes everything cached locally, including the link to your server-side profile. The next install starts fresh as a brand-new anonymous user.
• Delete your server-side profile. See our dedicated Account & data deletion page for the full step-by-step process — both the in-app route (Settings → 🗑 Delete my data, instant) and the by-email route to [email protected] (honoured within 7 days). We remove your player_profiles row, friendships, push token, game invites, group-duel turns, word reports, name reports (whether you filed them or were the player named in one), and suggestions. Because the profile is fully anonymous we may ask you to send the request from inside the app so we can identify the right row.

Right to complain. If you're unhappy with how we've handled your information you can complain to the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. We'd appreciate the chance to address your concern first.

Changes to this policy

If we change this policy, we'll update the "Last updated" date at the top. Material changes — new categories of data collected or new third-party services — will be announced in-app before they take effect.

Contact

For game-specific support: [email protected]

For data-rights requests, complaints, or anything addressed to the data controller: [email protected]