WordFall

Privacy Policy

Last updated: 20 September 2026

This policy explains what data the WordFall app (ro.wordfall.game) collects, why, and what control you have over it.

1. What we collect

1.1 Collected only if you sign in

You can sign in with Google or with an email and password. When you choose “Sign in with Google”, we receive from Google:

This data is handled by Firebase Authentication (Google).

1.2 Game progress, synced to the cloud

If you are signed in, we store in Cloud Firestore:

• games played and won
• total points, words found, longest word
• best score per game mode
• your streak of consecutive days played
• unlocked achievements
• on leaderboards: your display name, score and when you achieved it

Leaderboards are visible to other signed-in players — they can see your display name and score.

1.3 Duels (1 vs 1 mode)

A duel is played between two people who share an eight-character code. For each of you to see the other's score, those scores have to pass through a server — so duels are the one place in the app where something is uploaded without signing in with Google.

When you start your first duel, the app creates an anonymous identity in Firebase Authentication: a random identifier, with no email, no name, and no link to your Google account. At the same moment we ask you for a display name — you choose it, it can be anything, and it exists so your opponent knows who they played.

For each duel played we upload to Cloud Firestore: the duel code, the name you chose, your score, the number of words you found, your longest word and when you played. We do not upload the list of words you formed.

Who can see this: anyone holding the duel code. In practice, the person you sent it to. The code appears nowhere public and cannot reasonably be guessed, but if you pass it on, you pass on the result with it.

A submitted result can no longer be changed from within the app — that stops anyone from “correcting” their score after seeing their opponent's. If you want it deleted, write to us (section 6).

1.4 Collected always, even without an account

Firebase Analytics records how the app is used: when a game starts and ends, the score, the duration, which tutorial steps you saw, which challenges you completed. Alongside these, Google collects app and device identifiers, device model, Android version and approximate country (derived from your IP address, which we do not store).

Firebase Crashlytics sends automatic reports when the app crashes: the error type, device model, Android version and the app's state at that moment.

This tells us what works and what breaks. It does not contain the words you form and is not used for advertising.

1.5 Data that never leaves your phone

Settings (language, difficulty, theme, sound), daily and weekly challenges, unlocked themes, tutorial state and the word dictionaries all stay on your device.

1.6 Google Play Games

The app initialises Google Play Games services. If you have an active Play Games profile, Google may associate gameplay activity with your account, under Google's own policy.

1.7 Ads (Google AdMob)

The app never shows ads on its own: there are no banners and no clips interrupting a game. The only ads are rewarded video clips that you start yourself by tapping a button: “Watch a clip · continue” after the board fills up, or “Watch a clip · +1” when you run out of a tool. You can decline every time; the game is fully playable without ever watching an ad.

The clips are served by Google AdMob. When a clip loads or plays, Google receives the device's advertising ID (you can reset or delete it in Android settings), the IP address, device model, Android version and information about how you interact with the ad. In the European Union we ask for your consent through a form at first launch; if you don't grant it, any ads shown are non-personalised. You can change your choice at any time in Settings → Privacy options. How Google uses this data is described in Google's advertising policy.

2. External links

When you tap a found word to see its definition, the app opens the dictionary for the language you are playing in: dexonline.ro for Romanian, merriam-webster.com for English, cnrtl.fr for French. From that point, that site's own privacy policy applies. The app does not send any data to these sites in the background.

3. Legal basis (GDPR)

For users in the European Union:

• Performance of a contract (Art. 6(1)(b)) — for your account and progress sync, the features you explicitly ask for
• Legitimate interest (Art. 6(1)(f)) — for usage analytics and crash reports, needed to keep the app working and improve it
• Consent (Art. 6(1)(a)) — for personalised ads; you grant or refuse it in the form at first launch and can withdraw it at any time in Settings

4. Who else has access

Data is processed by Google Ireland Limited / Google LLC through Firebase Authentication, Cloud Firestore, Firebase Analytics, Crashlytics and Google AdMob (rewarded ads). Google acts as our processor and may transfer data outside the EU under standard contractual clauses.

We do not sell, rent or pass your data to any other third party.

5. How long we keep it

• Profile and leaderboards: until you ask us to delete your account
• Duels: until you ask us to delete them; we need them for no more than 30 days anyway, after which a duel interests nobody
• Analytics: per Firebase settings, at most 14 months
• Crashlytics: approximately 90 days
• Ads: we keep nothing; ad-related data is retained by Google under its own policy

6. Your rights

You may request access to your data, correction, deletion, portability (a copy in a common format), restriction of processing, and you may object to processing based on legitimate interest.

To delete your cloud data, follow the steps on Delete your data. We delete your profile and leaderboard entries within 30 days.

You can remove local data at any time by uninstalling the app or clearing its data in Android settings.

If you are in the EU, you may lodge a complaint with your national data protection authority.

7. Children

WordFall is not directed at children under 13 and we do not knowingly collect data from them. If you learn that a child under 13 has given us data, write to us and we will delete it.

8. Changes

If we change this policy, we update the date at the top. Material changes — for example introducing ads or in-app purchases — will be announced inside the app before they take effect.

9. Contact