Privacy Policy

Who we are (Data Controller)

The data controller for Wordy Bunch is:

Wordy Bunch is a registered trade mark of Brainy Bunch Games Limited (UK registered trade mark UK00004382983, classes 9 and 41). For studio-wide privacy questions, see our studio privacy policy.

What we collect, and why

On the app server (Supabase)

These are stored against an anonymous identifier generated automatically when you first open the app. The identifier itself is random and says nothing about you or your device, but it and the data stored against it are pseudonymous personal data. An email is added only if you choose to link a sign-in method (see “Email address” below).

• Email address (optional) — only collected if you choose to Sign in with Apple, Sign in with Google, or link an email address from Settings. Our sign-in service (Supabase) stores the email address and the provider’s account ID. With Google it also stores the name and profile picture link on your Google account; the game does not use or show them. Apple can share your name with the app, but the app does not send it to us. We store the email address against your anonymous identifier so the same profile is restored if you reinstall the app or sign in on another device. Used only for account recovery and cross-device sign-in — never for marketing, drip emails, or sharing with third parties. You can skip sign-in entirely and keep playing without giving us an email.
• Display name — you type this so other players can see who they're playing.
• Profile look: your avatar, ring colour, finish, card background, title and featured badges. Shown to other players.
• Region — UK or US, used to seed the Daily Challenge and to group leaderboards.
• Friend code — a 6-character code you can share with friends to add each other.
• Friends list — your friends, pending friend requests and the players you have blocked.
• Game stats — best score, total games played, daily streak, your skill rating and rank, Forever Board and Speed Trace scores, campaign stars, the badges and titles you have earned, and how many words you have found at each word length. Used to populate leaderboards and your profile, and to restore your progress on another device.
• Reddit totals (only if you add them) — if you played Wordy Bunch on Reddit and add your Reddit totals with a one off code, we add them to your stats (days played, words found, words found at each length, best score and best streak if higher) and keep a record that the code was used: its random tag, the totals it carried and your player ID, so each code works only once. The code holds no Reddit username or Reddit account identifier.
• Presence — when you were last active in the app and a coarse activity tag (“in a multiplayer game”) so friends can see if you're online.
• Match data — during an active multiplayer round: room state, words found, quick-chat messages. This is short-lived: it is removed with the room (see “Data retention”).
• Duels and the Weekly Arena: your score, the words you found and how you traced them, and the result. For Duels we also store your rating before and after. Players in the same Duel see your name, score and words when it settles. While an Open Duel is running, any player can see who has entered it. If a finished Open Duel is featured in the weekly Duel roundup, any signed-in player can open it and see every entrant’s name, score, words and traced paths. In the Weekly Arena, any signed-in player can open a match report, including from other brackets, with both players’ names, scores and words: earlier-round reports as soon as the match is settled, and finals and sudden-death matches once the week’s results are revealed on Friday. Friends, players near your rank and players on today’s Daily leaderboard can find you as someone to challenge, unless you turn on “Hide me from leaderboards”, which takes you out of those lists for anyone who is not already your friend or past opponent. Your friends can still find and challenge you, and so can players you have already finished a Duel with (they see you among their rivals); blocking a player stops that.
• Daily Challenge and Archive: each day’s score and the words you found. The main Daily record is deleted after about 60 days; the copies in your leagues and your Archive replays are kept with your account.
• Leagues: the leagues you create or join, the league name, and a copy of your Daily score and words for each league day, plus its monthly table and a record of who joined, left or was removed. Members of a league see each other’s names and scores and, once a day is revealed, each other’s words. If you created a league and delete your profile, the league carries on under the next member.
• Notification token: only if you turn on Friend invites, League activity, Weekly Arena or Duels notifications. Your device's push token is stored so we can deliver those notifications. It is a delivery address for notifications, not an advertising identifier. It is removed when you turn those notifications off, once the change reaches our server, or when you delete your profile.
• Game invites — when a friend invites you to a multiplayer lobby (or you invite a friend), we record who invited whom and the room code so the invite can be delivered and opened. An invite can only be accepted for 15 minutes after it's sent; the record itself is normally removed within two days.
• Word reports & suggestions — if you long-press a word and tap “⚑ Report”, or use Settings → Help & About → Suggest a word, we save the word and your anonymous identifier so we can review the list. A word report also stores the reason you chose, any note you add, the game mode, your region, the room code if you were in a multiplayer room, and the time. A suggestion also stores your region and the time.
• Player-name reports — if you tap the ⚑ flag on another player's card (or “Report name” in an iMessage duel) and submit, we store the reported display name, your chosen reason, any optional note, your anonymous identifier, your region, and — when known — the reported player's anonymous identifier and the screen you reported from. This is used solely for moderating offensive display names, and is the one report type that records limited data about another player.

Anonymous interaction counts (no identifier)

We count how often certain actions happen in the app and on this website, for example “tutorial finished”, “multiplayer match found” or “demo round started on the website”, to understand which features are working. Each count is a single row in our database with the event name and a timestamp. Specifically:

• There is no identifier of any kind attached to the count.
• There is no IP address, no device information, and no user agent stored.
• We cannot tell who took an action — only that one happened.
• Counts go to our own Supabase backend; no third-party analytics service is involved.
• To stop spam from the app, the server briefly notes that your anonymous identifier sent a count, not which count, and clears that note within about 15 minutes.

First-time setup steps (random install code)

When you first open the app it makes a random code for that installation. As you go through the first-time steps, such as the tutorial or choosing your name, the app records the step, the time, whether the phone is an iPhone or Android, and the app version against that code. The code is not linked to your profile, your name or any advertising identifier. We use it only to see where new players get stuck. These records are kept with no fixed end date. Because they are not linked to your profile, deleting your profile does not remove them.

On-device name safety (AI second opinion)

On phones that support on-device AI, Wordy Bunch adds a private second opinion to its display-name filter. When you choose or change your display name, a small AI model running entirely on your own device takes a quick look to help catch offensive names that slip past our word list. It is purely a safety check, and:

• Your name is checked on your device only — it is never sent to us, or to anyone else, for this check.
• If the on-device check thinks a name looks suspect, we add a single anonymous +1 to a counter (one of the anonymous interaction counts above) — with no name and no identifier attached. It only tells us how often the filter might be missing something.
• This check never blocks you and never changes your name on its own — our ordinary word-list filter remains what decides whether a name is allowed.
• Phones that don’t support on-device AI simply skip this; nothing changes for them.

Aggregate gameplay analytics (in-house only)

To understand how the game is being used and to guide design decisions, for example whether a feature is reached, whether multiplayer rounds complete or whether the campaign is too hard, we run in-house queries over the gameplay data we already store: words found per round, scores, Daily completion, multiplayer results and purchase history. This data is stored against your anonymous identifier, so a query can answer things like “what percentage of players reach campaign level 10”. The results are never shared with third-party analytics services, advertising networks or data brokers, and they are not used to profile you individually or to personalise the game.

Launch-notification list (closed)

Before launch, this website had a “Be the first to know” form for email addresses. The form was removed on 20 July 2026 and the list has been deleted.

On your device

• All of the above, cached for offline use.
• Sound, music, haptics, theme, and motion preferences.
• Tutorial and first-time-tip flags.
• Dictionary lookup cache for word definitions.
• Optional notification preferences — if you opt in to a daily reminder, your chosen time-of-day is stored on your device. See “Notifications” below for what enabling notifications involves.

iMessage word duels

Wordy Bunch includes an optional iMessage extension that lets you play a turn-based word duel directly inside a Messages conversation. The extension itself has no network access. For one-to-one duels, playing inside Messages sends nothing to our servers: the whole game state rides inside the iMessage itself, delivered by Apple’s Messages service to the person you’re playing. Specifically:

• Duel messages carry the full game state in the message link’s ?d= token (capped at 5000 characters). That token contains your chosen display name, a random ID that Messages gives you in that conversation, cosmetic IDs (avatar, colour, finish, and card-background), your equipped title and badges, the game board, per-turn scores, and the list of words each player found — so both players can replay the round on their own device.
• Friend-code invites carry only your 6-character friend code and chosen name in the link’s ?fc= and ?n= fields — nothing else.
• Inside Messages, none of this passes through Wordy Bunch servers. The data travels inside the iMessage as part of the message link. If the person you send it to does not have the app, tapping the message opens that link (https://wordybunch.co.uk/imessage-duel.html) in their browser with the data in it, so it reaches our web host and Cloudflare, and the page’s App Store button passes it on in the App Store link. Two actions hand off to the main Wordy Bunch app (not the extension itself): adding a friend from a received invite, and — if you tap “Report” on a received duel — filing a player-name report, which passes only the opponent’s display name — no identifier — to the main app’s moderation backend (see “Player-name reports” above).
• Group Word Duels (3+ players) are the one exception — they use our server for the shared scoreboard. A group duel needs everyone’s turns compared in one place, so when you create or play a group duel the main Wordy Bunch app (not the Messages extension) stores the challenge and your entry on our Supabase backend: your anonymous identifier, your display name, your score, the words you found, and when you submitted. This is the same kind of match data we already store for in-app multiplayer. It is used only to build that duel’s standings, which anyone with the duel’s link can open. While the duel is open they show each player’s name, score before the bonus for unique words, and place; when it ends they also show everyone’s words and final scores. Your entries are deleted when you delete your profile.

League results posting to chat apps (your opt-in)

This feature is not switched on yet. If we turn it on, a league’s admin chooses whether to connect a chat, and the details below apply.

Leagues are an optional private monthly competition over the Daily. A league admin can connect their league to an external Slack, Discord, or Telegram channel so each day’s results can be posted there automatically. This is the one feature that can send your display name and score to a third-party chat service outside Wordy Bunch, so your own results are sent only if you switch posting on yourself:

• You choose, with an off-by-default switch. The league screen shows you a notice naming the connected service (“…each day’s results, including your name and score, are sent there”). Your results are not posted unless you turn on the “Post my results” switch yourself. It starts off. You can turn it back off at any time, which stops your results being posted straight away.
• What is posted — for each member who has turned posting on and played that day, their display name, score, and league ranking. No identifier, email address, or word list is sent to the channel.
• Where it goes — the post is delivered to the channel the admin linked, on Slack, Discord, or Telegram. Once it reaches that service it is governed by that service’s own privacy policy and by your league admin, not by us. The connection secret the admin provides (a webhook URL or bot token) is stored encrypted in our backend and is never shown back to anyone.
• Off by default. Nothing is posted unless a league admin has linked a channel and you have turned on posting of your own results. Turning it off, leaving the league, or deleting your profile all stop your results being included.

Notifications (opt-in)

Notifications are off until you turn them on, either from a prompt in the game or from Settings → Notifications. There are five switches:

• Daily reminder: a once-a-day reminder scheduled entirely by your device’s operating system at the time you chose. Nothing about this reminder is sent over the network; your phone schedules the alert locally.
• Friend invites, League activity, Weekly Arena and Duels: turning on any of these registers your device’s push token with our Supabase backend so we can send that kind of notification, for example a friend’s “join my game”, a league result, an Arena reminder or a new Duel challenge. Friend game invites are allowed by default on our side: once your device is registered for any of these notifications, a friend’s invite can reach it unless you have switched Friend invites off. Notifications are delivered through Expo’s push service and your platform’s notification service (Apple Push Notification service on iOS, Firebase Cloud Messaging on Android), used only as a delivery pipe. See “Third-party services” below.
• Group Word Duel reminders: if you created a group duel and have not played, or started a turn and did not finish it, we send one reminder about two hours before the duel closes. It goes to any device registered for the notifications above, whichever of those switches is on, so to stop it turn all four off or turn off Wordy Bunch notifications in your phone’s settings.

You can turn each switch off at any time in Settings → Notifications. The change reaches our server when your phone is online; if you are offline, it is sent the next time the app starts with a connection. To stop notifications straight away, turn off notifications for Wordy Bunch in your phone’s settings. Your stored push token is removed when you turn off every switch that uses it and the change reaches our server, or when you delete your profile. We count opt-in and opt-out as an identifier-free interaction count (see above): it only tells us “someone enabled notifications”, not who.

What we do not collect

• Phone number, postal address or government ID. We don’t ask for your real name; the only way one reaches us is through Google sign-in (see “Email address” above).
• Your location. The app does not ask for it. Like any online service, our providers see your IP address when the app connects, and RevenueCat uses it to work out your country for purchase records.
• Device advertising identifiers (IDFA / GAID).
• Contacts, calendar, photos, or microphone.
• Third-party analytics SDK data — we have not integrated Firebase Analytics, Amplitude, Mixpanel, AppsFlyer, or any third-party behavioural-analytics service. We use Sentry for crash and performance diagnostics only (see “Third-party services”). We use Firebase Cloud Messaging solely to deliver notifications on Android — Google Analytics for Firebase is disabled; see “Notifications” and “Third-party services”. Aggregate gameplay metrics (rounds played, words found, feature use) are computed inside our own Supabase backend; nothing is forwarded to third-party trackers.
• Payment information. Purchases (see “In-app purchases” below) are processed by Apple App Store or Google Play directly. We never see your card number, billing address, or any payment credential.

In-app purchases

The app is free to download and play. We offer optional in-app purchases: cosmetic items (avatars, themes, finishes and card backgrounds), Helping Hand packs (hints used in the campaign), and Beyond the Horizon, a one-time purchase that opens six extra campaign worlds (£5.99 in the UK). These purchases:

• Never affect competitive play. Ranked, Duels, the Weekly Arena, the Daily and leagues are the same for everyone. The first six campaign worlds are free; the last six need Beyond the Horizon.
• Are processed by Apple or Google directly. We never see your card details, billing address, or any payment credential.
• Restoring. Avatars, themes, finishes, card backgrounds and Beyond the Horizon can be restored from the Shop on another device signed in to the same store account. Helping Hands are used up as you play, so the store cannot restore them: any you have not used stay with your Wordy Bunch account, so link a sign-in to keep them when you change device.

Third-party services

• Supabase — hosts the database and sign-in.
• RevenueCat — handles in-app purchase receipt validation and entitlement restoration. RevenueCat receives your player ID (pseudonymous, as above) and the purchase receipt from the App Store or Play Store, and keeps your purchase history against that ID. We do not send it your name, email or advertising identifier, and it does not receive your payment details.
• Sentry — crash and performance diagnostics. If the app crashes, hangs, or runs into an unexpected error, Sentry records the technical context (stack trace, breadcrumbs of recent in-app actions, device model, OS version, app version) which can include your anonymous identifier so we can match a crash to a player. When a round's score cannot be checked, the report can also include limited details of that round, such as the score, the words you played and how you traced them, so we can find the bug. We do not send Sentry your email, display name or any advertising identifier. We use it strictly to fix bugs and improve stability.
• Word definition lookups (dictionaryapi.dev, Datamuse, Wikimedia REST) — when you long-press a word to see its definition, the app sends the word to one of these services. No player identifier is sent with it, though like any web request it reveals your IP address.
• Notification delivery (Expo push service; Apple Push Notification service on iOS; Firebase Cloud Messaging on Android) — if you enable notifications, these services relay the notifications you have switched on to your device. They receive your device’s push token and the notification text purely to deliver it; no analytics or advertising data is involved.
• Expo updates: when the app opens, it checks Expo’s update service for game updates. The check carries technical details such as your app version and platform and, like any web request, your IP address. It is used only to deliver updates.

We do not embed advertising SDKs, tracking pixels, or third-party analytics.

Visiting this website

• Our web host and Cloudflare, which sits in front of this site, process visitors’ IP addresses to serve and protect it.
• The PixelPicked badge in the footer of the front page loads its image from PixelPicked, which receives that request like any web server.
• If you pick a look with the Editorial, Classic, Dark and Light buttons, your choice is saved in your own browser only.
• The demo board on the front page sends an anonymous count when a demo round starts and ends (see “Anonymous interaction counts” above). The site has no advertising or analytics scripts beyond that.

Children

Wordy Bunch is rated suitable for ages 4 and up and is designed for a general audience. You can play without giving us your real name, age or contact details. Every profile does have a random player ID, a display name, a friend code and gameplay records stored against it: this is pseudonymous personal data. An email address is stored only if you choose to sign in with Apple or Google or link an email yourself (those sign-in providers have their own minimum-age requirements). We do not ask for your age or date of birth, show advertising, or use third-party analytics.

Data retention

• Local data — kept on your device until you uninstall the app or clear its storage. Removing the app removes everything cached locally.
• Server-side anonymous profile — persists indefinitely so your stats, friends, and ranked rating survive app reinstalls. Deleted on request (see “Your rights”).
• Reddit totals code record — kept so a code can never be used twice. When you delete your profile, your player ID and the totals are removed from it; only the code’s random tag stays, marked as used, with nothing linking it to you.
• Multiplayer rooms: an hourly clean-up removes rooms with their chat and word data, finished rooms after about six hours and abandoned rooms about an hour after the last player activity.
• Group Word Duel turns — a group duel stops accepting turns 6 hours after it is created. The stored standings (display names, scores, words found) are kept briefly after that so players in the conversation can still open the final result, then deleted automatically about a week after the duel ends — and sooner if you delete your profile.
• Notification token and game invites — your push token is kept while notifications are enabled and removed when you turn them off (once the change reaches our server) or delete your profile; game-invite records expire after 15 minutes and are normally removed within two days.
• Duels and Weekly Arena results: when you delete your profile, your Duel results (score and words) stay in other players’ history as “Deleted player”. Some records keep your old anonymous player ID: a Duel’s winner, the record of who has played whom (used to limit repeat Duels), each weekly Duel roundup you appeared in (your tier, percentile positions, best three results and the rating cut-off for that week), and any league season you won, as its champion. Your profile, name and sign-in are deleted, so that ID is no longer tied to a name or a login, but it is not removed from those records: it is pseudonymous, not anonymous. Your places in past Arena brackets stay as “Deleted player” with no ID, and your Arena runs are deleted.
• Deletion safeguards: after you delete your profile, your old player ID stays for about 48 hours on a short list that stops an old sign-in from recreating your profile. If removing your sign-in identity has to be retried, the request, with that ID, is kept until it succeeds.
• First-time setup records: kept with no fixed end date. They are not linked to your profile, so deleting your profile does not remove them.
• Anti-spam log: for actions with a rate limit, the server briefly notes your player ID, the kind of action and the time, and clears each note within about 15 minutes.
• Word reports and suggestions: kept, including after we review them, until you delete your profile.
• Player-name reports: kept after review, marked as resolved, until the person who reported it deletes their profile, or the reported player does when we know who they are.

Your rights

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to access, correct, erase, restrict or object to processing of your personal data, and to data portability. In Wordy Bunch you can exercise these directly:

• Hide your presence. Settings → Privacy → “Appear offline to friends” hides your online status and current activity from your friends list. You still see your friends’ status normally; they see you as offline regardless of whether you’re using the app.
• Hide from leaderboards. Settings → Privacy → “Hide me from leaderboards” keeps you off the global leaderboards and out of the lists other players use to find a new Duel opponent. Your friends can still find you, and players you have already finished a Duel with can still see you among their rivals and challenge you again; blocking a player stops that. Change these two settings while you are online; they take effect once they reach our server.
• Edit your profile: your display name, avatar, colour and region can be changed from the home screen and Settings (region changes have a 24-hour cooldown).
• Remove a friend at any time from their profile card; this removes the friendship for both of you.
• Clear local data by uninstalling the app from your device — this removes everything cached locally, including the link to your server-side profile. The next install starts fresh as a brand-new anonymous user.
• Delete your server-side profile. See our dedicated Account & data deletion page for the full step-by-step process — both the in-app route (Settings → Privacy → 🗑 Delete my data, instant) and the by-email route to [email protected] (we reply within 7 days and complete the deletion within 30 days). We remove your player_profiles row, friendships, push token, game invites, group-duel turns, league memberships, Weekly Arena runs, word reports, name reports you filed or reports about you that identify your player ID, suggestions, and any Apple, Google, or email sign-in identity linked to the account. If the app cannot confirm sign-in removal after deleting the game profile, it tells you identity removal is pending and logs the issue for support follow-up. Duel results and places in past Arena brackets stay as “Deleted player”, and some Duel records keep your old anonymous player ID (see “Data retention”).

Right to complain. If you’re unhappy with how we’ve handled your information you can complain to the UK supervisory authority: the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. We’d appreciate the chance to address your concern first.

Changes to this policy

If we change this policy, we’ll update the “Last updated” date at the top. We will mention material changes, such as new kinds of data or new third-party services, in the app’s What’s new notes.

Contact

For game-specific support: [email protected]

For data-rights requests, complaints, or anything addressed to the data controller: [email protected]