Privacy Policy
WordsApp for Android · 27 July 2026 · Deutsche Fassung
Who is responsible
Matthias Voigt
Hubertusstr. 37
01129 Dresden, Germany
E-mail: contact@wordsapp.org
The short version
WordsApp can be played from start to finish without a single piece of data reaching us: games against the AI, pass-and-play on one device and the “Cascade” solitaire mode all run entirely on your phone.
Only when you want to play online against other people do you sign in with Play Games, and only then do we create an account for you. What gets stored from that point on is listed line by line below.
WordsApp contains no advertising, no tracking, no analytics SDKs and no advertising ID. We do not sell your data and do not pass it on for advertising purposes.
What never leaves your device
- Saved games against the AI and pass-and-play games
- The solitaire high score list and the words you played for the first time
- Your settings, the chosen board design and the dictionaries
This data does not leave your device. It disappears when you uninstall the app — except for any backup Android itself may create if you have Google's device backup switched on.
What reaches our server once you play online
| Data | What for | Legal basis |
|---|---|---|
| Your Play Games player id | So your account recognises you again after a new device or a reinstall | Art. 6(1)(b) GDPR (contract) |
| Display name and tag (the Name#1234 form) | So opponents see you at the board and in the friends list, and so people can find you by your handle | Art. 6(1)(b) GDPR |
| Your profile picture: the figure, colour and rim you picked, plus the image rendered from them — or, if you choose so, the picture from your Play Games account | Shown next to your name to the people you play with | Art. 6(1)(b) GDPR |
| A session marker (a hash of your sign-in token) with its creation, expiry and last-used timestamps | Staying signed in without logging in again; spotting expired sessions | Art. 6(1)(b) GDPR |
| The time you were last active | The online dot in the friends list | Art. 6(1)(b) GDPR |
| Your online games: language, game state, moves with timestamps, scores | Without them there would be no game — it lives on the server so both sides see the same state | Art. 6(1)(b) GDPR |
| Your friendships and your private “close friend” mark | Friends list and challenges. The mark is yours alone; it is never shown to anyone | Art. 6(1)(b) GDPR |
| A device token for notifications (Firebase Cloud Messaging) | Telling you it is your move again, or that a friend request is waiting | Art. 6(1)(a) GDPR (your consent — you allow notifications and can switch them off at any time) |
| Your IP address when your device talks to the server | Technically required for the connection; held briefly in memory to rate-limit sign-in and search requests (abuse protection). We build no profiles from it | Art. 6(1)(f) GDPR (legitimate interest in protection against abuse) |
What we explicitly do not receive
When you sign in through Play Games, Google tells us only your player id and your Play Games display name. Your e-mail address, your legal name, your Google account, your contacts and your location never reach us. We do not ask for them and could not retrieve them.
Who else can see your details
- Opponents and friends see your display name, your handle, your profile picture and whether you are online right now.
- You can only be found by your full handle (Name#1234). There is no search by name, and other people's profiles cannot be browsed.
- Your profile picture sits at a fixed address on our server so that opponents can load it. Anyone who knows that address can fetch the image, signed in or not. Usually it is a figure from our catalogue. If you pick the picture from your Play Games account in the profile instead, then it is that photo, and it sits just as openly. That is your choice, and you can take it back at any time by choosing a figure again.
Services we rely on
- Google Play Games Services (Google Ireland Limited) for signing in. When you sign in, Google processes that under its own privacy policy.
- Firebase Cloud Messaging (Google) to deliver notifications. So that the notice says something on the lock screen already, the occasion travels through Google with it: the other player's display name — their handle in the case of a friend request — and, for a move, the word played and what it scored, along with the identifiers of the game and the sender. The game state itself does not travel through the notification: the board, your tiles and the history stay with us, and the app fetches them when you open it.
- MonsterASP.NET s.r.o., data centre in Germany (Falkenstein, Saxony) as the operator of the server the app data sits on, acting on our instructions under a data processing agreement.
- STRATO AG (Berlin), servers in Germany as the operator of this website. That covers the pages you are reading and nothing else: not the app, not your game data. Also under a data processing agreement.
Google may process data in countries outside the EU. It relies on the European Commission's standard contractual clauses for this.
This website
The pages at wordsapp.org are separate from the game and know nothing about your account. They set no cookies, load nothing from anybody else's servers — the fonts and images are ours — and carry no analytics, no audience measurement and no advertising.
As with any web server, fetching a page produces technical log data: IP address, time, the page requested, the referring page, and browser and system details. It arises at STRATO and serves only the secure operation of the site. We do not evaluate it, do not combine it with anything, and build no profiles from it. The legal basis is our legitimate interest in a working, defensible site (Art. 6(1)(f) GDPR).
How long we keep things
- Account, profile and friendships: for as long as your account exists.
- Sign-in sessions: up to 180 days, then deleted automatically — together with the notification token.
- Finished games: for as long as either side keeps their account — a game is part of both players' history.
- After deletion an empty account row remains, holding the time of deletion and nothing else: no name, no picture, no link back to you. It only keeps your opponents' games readable.
- IP addresses used for rate limiting: a few minutes, in memory.
Deleting your account and your data
You delete your account yourself, inside the app: the gear icon at the top right of the main menu, then Account, then Delete account at the bottom. It happens immediately — no waiting period, nothing to confirm by email. The account deletion page spells out the steps.
Deleted are your display name, your tag, your profile picture, your friends and any open friend requests, the link to your Play Games account, and every sign-in on every device together with the notification token. Games still running are given up in the process; they end there and then.
What stays: games you already finished remain with the other player — they are that person's history as much as yours, and one player cannot take from another the record of a game they played together. You appear in them as “Deleted player”, with no name and no picture. What remains on our side is an empty account row holding the time of deletion: it carries nothing about you and is detached from your Play Games sign-in, so signing in later cannot lead back into the deleted account.
We cannot delete by email, and that is not reluctance: your handle is not a secret — everyone you have played knows it — and acting on it would let a stranger destroy your games. We also hold no email address for you; signing in is the only proof of ownership there is. If you genuinely cannot get back in, contact@wordsapp.org will help you into your account — the delete button is still yours to press.
As long as you only play against the AI or pass-and-play, there is nothing to delete — no account exists on our side.
Your rights
You hold the rights set out in Art. 15 to 21 GDPR: access, rectification, erasure, restriction of processing, data portability and objection. Any consent you have given — for notifications, for instance — can be withdrawn at any time with effect for the future, in the app's settings or your device's.
You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for where we are based.
Children
WordsApp is not directed at children. Google's own age rules apply to signing in through Play Games.
Changes
When the app changes, this policy changes with it. The date at the top tells you which version you are reading.