WordCraft Privacy Notice
Last updated: 18 October 2026
1. Who we are
WordCraft is operated by Autom8Sustain, 91 Wentworth Avenue, Finchley, London N3 1YN ("we", "us"). We are the controller of your personal data.
Privacy contact: support@autom8sustain.com
2. Playing as a guest
If you play as a guest, your games, scores and settings are stored on your device. Guest play needs no email address or password. To keep the game working, the app signs you in to our service with an anonymous identifier that contains no personal details. Guests are not entered on leaderboards or in leagues. Deleting the app removes your guest data from your device.
3. What we collect, why, and our legal basis
| Data | Why we use it | Legal basis |
|---|---|---|
| Email address (email or Google sign-in) | Create and secure your account, sign you in, recover your password | Contract (running your account) |
| Username and avatar | Identify you in the game, on leaderboards and in leagues | Contract |
| Sign-in method (email or Google) and account creation date | Operate your account | Contract |
| Last login time | Delete inactive accounts after 2 years | Legitimate interests (keeping data only as long as needed) |
| Validated scores, league results and trophies | Show leaderboards, weekly continental leagues and awards | Contract |
| Your chosen continent | Place you in your continental weekly league | Contract |
| Game replay data (seed and moves) sent for score checking | Check that scores are genuine and prevent cheating | Legitimate interests (a fair game) |
| Technical logs (for example errors and request times) | Keep the service secure and working | Legitimate interests |
We do not sell your data or use it for profiling. We do not currently collect analytics or crash reports. If we add them in future we will ask for your consent first and update this notice.
Advertising. WordCraft shows a banner advert served by Google AdMob (Google Ads). We show non-personalised ads only: ads are not based on your profile or your activity across other apps or sites. Google still processes your device's advertising identifier and IP address to serve the ad, measure it and prevent fraud, and acts as an independent controller for that processing (see policies.google.com/privacy). Where the law requires, we ask for your choice before any ad loads; if you decline, no ads are requested. You can change your choice at any time in Settings > Ad choices. Choosing "No ads" does not affect gameplay, scores or leagues. Ads are never shown during a game round.
If you sign in with Google, Google tells us your email address and a Google account identifier. We do not get your Google password.
4. What other people can see
Your username, avatar, scores, league position and trophies are public to other players on leaderboards and in leagues. Please do not use your real name or personal information as your username. We never show your email address to other players.
5. How long we keep your data
| Data | How long |
|---|---|
| Account profile | While your account is active, and 2 years after your last login; deleted sooner if you ask |
| Username | Released for others to use when your account is deleted |
| Weekly leaderboard and league results | 12 months |
| All-time best score | 2 years |
| Trophies | Deleted when your account is deleted |
| Game replay data | Discarded once the score is checked. If a score is rejected, kept for 30 days for cheat review |
| Server logs | 30 days (no emails or raw moves in logs) |
| Backups | Daily backups kept for 30 days. Deleted accounts disappear from backups within 30 days |
| Guest data | Stays on your device. Delete the app to remove it |
6. Who we share data with
We use Google Cloud / Firebase (Google LLC and its affiliates) to run sign-in, store data and host our services. Google acts as our processor under its data processing terms. If you choose Google sign-in, Google also acts as an independent controller of your Google account. Google AdMob receives your device advertising identifier and IP address only if you accept ads. We do not share your data with anyone else except where the law requires.
7. Where your data is stored
Our primary data is stored in London, United Kingdom (europe-west2). Google may process limited data outside the UK or EEA. Where it does, transfers rely on approved safeguards such as the UK International Data Transfer Addendum or adequacy decisions.
8. Your rights
You can ask us to access your data, correct it, delete it, restrict or object to our use of it, give you a portable copy, and (for any optional processing based on consent) withdraw consent at any time without affecting earlier processing.
- Delete your account: use Account settings in the app. If you want your league results removed too, email us and we will do it.
- Anything else: email support@autom8sustain.com. We aim to reply within one month.
If you are unhappy with our response, you can complain to the UK Information Commissioner's Office (ico.org.uk, 0303 123 1113).
9. Children
WordCraft is for players aged 13 and over. If you are under 18, please ask a parent or guardian before creating an account. If you believe a child has given us personal data without permission, email support@autom8sustain.com and we will delete it. We aim to follow the ICO Children's Code (high privacy by default, no unnecessary data, no nudging to share more).
10. Security
Accounts are protected by Firebase Authentication, and access to stored data is restricted by security rules and least-privilege access. Scores are checked on our servers so that results cannot be altered by the app on your device. No system is perfectly secure; if a breach puts your rights at risk we will tell you and the regulator as the law requires.
11. Changes to this notice
We will update this notice when our practices change and show the new date at the top. For material changes we will tell you in the app.
12. Contact
Autom8Sustain, 91 Wentworth Avenue, Finchley, London N3 1YN. Support: support@autom8sustain.com