Privacy Policy

Who we are

WordQuest is operated by ToNi Tech Games (KVK 42117317), registered at F. Bordewijkstraat 17, 1613 MP Grootebroek, the Netherlands. We are the “data controller” for the personal data described here. You can reach us any time at hello@wordquest.gg.

What we collect

• Account information — the email address and password you sign up with. Passwords are stored only in a securely hashed form by our authentication provider; we never see them.
• Profile information you choose to add — username, and optionally your country, city, gender, a short bio and an avatar. These appear to other players on your public profile and the leaderboards.
• Gameplay data — the games you play, scores, points, achievements, duels, tournaments and similar activity needed to run the game and the leaderboards.
• Purchase records — if you buy WQ Points or Premium, we keep a record of what was bought, when, which store or payment provider it came through, and the identifier that provider gives the transaction. We need this to give you what you paid for, to handle refunds and to keep our accounts. We never receive or store your card number. Payment details are handled entirely by Apple, Google or our payment provider.
• Technical data — basic information your device and our hosting provider exchange to deliver the site (such as IP address and browser type), used for security and to keep the service running.
• Preferences — for example your chosen interface language, stored in a cookie on your device.
• Diagnostics and crash reports — when the app crashes or hits an error, we collect a crash report (the error details, basic device and browser information and an identifier) so we can find and fix problems.
• Usage and performance data — privacy-friendly, aggregated statistics about how the app is used (for example which screens are visited) and how it performs on your device. This is collected without cookies, is not linked to your identity, and is never used for advertising — we use it only to understand what to improve.
• Advertising and measurement data — only if you agree. If you accept advertising cookies, we use the Meta (Facebook) Pixel to measure our ads and show WordQuest to similar people. It records actions like a page view, a game started or a completed sign-up, and shares them with Meta. We do not enable Meta's “advanced matching”, so we don't send your name or email to Meta through it. This only runs after you accept the cookie banner, and you can withdraw your consent at any time (see “Cookies” below).

How we use your data

• To create and run your account and let you play.
• To show leaderboards, profiles, duels and tournaments to you and other players.
• To send essential account emails (for example confirming your email, resetting your password, or confirming an account-deletion request).
• To occasionally email you if you haven't played in a while (a “we miss you” reminder, at most once every two weeks). Every such email contains a one-click unsubscribe link, and you can also turn them off anytime in Settings → Notifications.
• To keep WordQuest secure and prevent abuse, cheating and spam.
• To understand which screens and features are used, and how the app performs, so we can fix problems and improve it — using privacy-friendly, aggregated analytics that don't identify you.

We do not sell your personal data. We use advertising and cross-site measurement (the Meta Pixel) only if you give your consent, and you can withdraw that consent at any time — see “Cookies” below.

Our legal bases (GDPR)

Under the GDPR we rely on the following legal bases:

• Performance of a contract — to provide the game you signed up for (your account, gameplay and leaderboards), and to deliver and support anything you buy.
• Legal obligation — to keep records of purchases for as long as tax and accounting law requires.
• Legitimate interests — to keep the service secure, prevent abuse and improve how it works, and to send existing players the occasional “we miss you” email described above (you can opt out at any time).
• Consent — where you choose to add optional profile details such as your country or city (removable any time in your settings), and where you accept advertising cookies (the Meta Pixel). You can withdraw either at any time.

Who we share it with

We use a small number of trusted service providers. Most are “processors” who handle data only on our instructions; a few — the app stores, our payment provider and Meta — act as independent controllers for the part they handle, and their own privacy policies apply to it. Each is noted below.

• Supabase — database and authentication (stores your account and gameplay data).
• Vercel — hosting and content delivery, plus privacy-friendly, cookieless analytics (aggregated page views and app-performance metrics, with no cross-site tracking and no advertising).
• Resend — sending our emails: the essential account emails and the optional “we miss you” reminders described above.
• Cloudflare — bot and abuse protection on sign-up and login.
• Sentry — crash and error reporting, so we can detect and fix problems in the app.
• Apple and Google — if you buy something inside our iPhone or Android app, the purchase is made through the App Store or Google Play. They handle the payment as the seller and act as independent controllers for it; they tell us only that a purchase succeeded, for which product, and its transaction identifier.
• RevenueCat — validates app-store purchases and subscription status on our behalf, so we know when to give or withdraw Premium. It receives your WordQuest account identifier and the store's purchase details — never your payment details.
• Our website payment provider — if you buy on our website rather than in the app, the provider named on the checkout page processes the payment and, where they are the seller of record, handles VAT and invoicing. They receive the payment and contact details you enter at checkout. We receive only confirmation of the purchase.
• Meta Platforms — only if you accept advertising cookies: the Meta (Facebook) Pixel, used to measure our Instagram/Facebook ads. Meta acts as an independent controller for this data. Nothing is shared with Meta unless and until you consent.

Some of these providers may process data outside the European Economic Area. Where they do, that transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses.

Cookies

We keep cookies to a minimum. We use a strictly necessary cookie to keep you signed in, and a small preference cookie to remember your chosen interface language. These are always on because the game can't work without them.

Advertising cookies (optional). If you accept the cookie banner, we load the Meta (Facebook) Pixel, which sets cookies (such as _fbp) and shares a few in-game actions with Meta so we can measure our ads. These load only after you accept, never before. If you decline, they are never loaded. You can change your mind at any time using the control below — turning them off stops the Pixel from loading again.

How long we keep it

We keep your data for as long as your account is active. When you delete your account, your personal information — email, profile details and login — is permanently erased after a short 24-hour grace period (in case you change your mind). To keep past games fair for the players you competed against, your match results remain on the leaderboards but are shown only as “Deleted player”, with no personal data attached.

Purchase records are an exception. If you have bought something, Dutch tax and accounting law requires us to keep the transaction record — what was sold, when, for how much — for seven years, even after you delete your account. We keep only what the law requires, and it is no longer linked to a usable profile.

Your rights

You have the right to:

• Access the personal data we hold about you.
• Correct it if it's wrong (most of it you can edit directly in your settings).
• Delete your account and personal data.
• Restrict or object to certain processing.
• Receive a copy of your data in a portable format.
• Withdraw consent for any optional data you provided.

You can delete your account from Settings while logged in, or — without logging in — from our account-deletion page. For any other request, email hello@wordquest.gg. You also have the right to lodge a complaint with your local data protection authority — in the Netherlands, the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

Children

WordQuest is not directed at young children. You must be at least 16 years old to create an account. If you believe a child has given us personal data, contact us and we will delete it.

Security

We protect your data with industry-standard measures, including encrypted connections, hashed passwords and strict database access rules so players can only read public data and change their own. No system is perfectly secure, but we work to keep your information safe.

Changes to this policy

We may update this policy from time to time. If we make a significant change we'll update the date above and, where appropriate, let you know in the app or by email.

Contact

Questions about your privacy? Email hello@wordquest.gg.