Privacy Policy
WordsApp for Android · 25 July 2026 · Deutsche Fassung
Who is responsible
Matthias Voigt
Hubertusstr. 37
01129 Dresden, Germany
E-mail: contact@wordsapp.org
The short version
WordsApp can be played from start to finish without a single piece of data reaching us: games against the AI, pass-and-play on one device and the “Cascade” solitaire mode all run entirely on your phone.
Only when you want to play online against other people do you sign in with Play Games, and only then do we create an account for you. What gets stored from that point on is listed line by line below.
WordsApp contains no advertising, no tracking, no analytics SDKs and no advertising ID. We do not sell your data and do not pass it on for advertising purposes.
What never leaves your device
- Saved games against the AI and pass-and-play games
- The solitaire high score list and the words you played for the first time
- Your settings, the chosen board design and the dictionaries
This data does not leave your device. It disappears when you uninstall the app — except for any backup Android itself may create if you have Google's device backup switched on.
What reaches our server once you play online
| Data | What for | Legal basis |
|---|---|---|
| Your Play Games player id | So your account recognises you again after a new device or a reinstall | Art. 6(1)(b) GDPR (contract) |
| Display name and tag (the Name#1234 form) | So opponents see you at the board and in the friends list, and so people can find you by your handle | Art. 6(1)(b) GDPR |
| Your profile picture: the figure, colour and rim you picked, plus the image rendered from them — or, if you choose so, the picture from your Play Games account | Shown next to your name to the people you play with | Art. 6(1)(b) GDPR |
| A session marker (a hash of your sign-in token) with its creation, expiry and last-used timestamps | Staying signed in without logging in again; spotting expired sessions | Art. 6(1)(b) GDPR |
| The time you were last active | The online dot in the friends list | Art. 6(1)(b) GDPR |
| Your online games: language, game state, moves with timestamps, scores | Without them there would be no game — it lives on the server so both sides see the same state | Art. 6(1)(b) GDPR |
| Your friendships and your private “close friend” mark | Friends list and challenges. The mark is yours alone; it is never shown to anyone | Art. 6(1)(b) GDPR |
| A device token for notifications (Firebase Cloud Messaging) | Telling you it is your move again, or that a friend request is waiting | Art. 6(1)(a) GDPR (your consent — you allow notifications and can switch them off at any time) |
| Your IP address when your device talks to the server | Technically required for the connection; held briefly in memory to rate-limit sign-in and search requests (abuse protection). We build no profiles from it | Art. 6(1)(f) GDPR (legitimate interest in protection against abuse) |
What we explicitly do not receive
When you sign in through Play Games, Google tells us only your player id and your Play Games display name. Your e-mail address, your legal name, your Google account, your contacts and your location never reach us. We do not ask for them and could not retrieve them.
Who else can see your details
- Opponents and friends see your display name, your handle, your profile picture and whether you are online right now.
- You can only be found by your full handle (Name#1234). There is no search by name, and other people's profiles cannot be browsed.
- Your profile picture sits at a fixed address on our server so that opponents can load it. Anyone who knows that address can fetch the image, signed in or not. Usually it is a figure from our catalogue. If you pick the picture from your Play Games account in the profile instead, then it is that photo, and it sits just as openly. That is your choice, and you can take it back at any time by choosing a figure again.
Services we rely on
- Google Play Games Services (Google Ireland Limited) for signing in. When you sign in, Google processes that under its own privacy policy.
- Firebase Cloud Messaging (Google) to deliver notifications. All that travels is a short nudge (“go and look”) — no game states and no names. The app then fetches the content from us itself.
- MonsterASP.NET s.r.o., data centre in Germany (Falkenstein, Saxony) as the operator of the server the app data sits on, acting on our instructions under a data processing agreement.
- STRATO AG (Berlin), servers in Germany as the operator of this website. That covers the pages you are reading and nothing else: not the app, not your game data. Also under a data processing agreement.
Google may process data in countries outside the EU. It relies on the European Commission's standard contractual clauses for this.
This website
The pages at wordsapp.org are separate from the game and know nothing about your account. They set no cookies, load nothing from anybody else's servers — the fonts and images are ours — and carry no analytics, no audience measurement and no advertising.
As with any web server, fetching a page produces technical log data: IP address, time, the page requested, the referring page, and browser and system details. It arises at STRATO and serves only the secure operation of the site. We do not evaluate it, do not combine it with anything, and build no profiles from it. The legal basis is our legitimate interest in a working, defensible site (Art. 6(1)(f) GDPR).
How long we keep things
- Account, profile and friendships: for as long as your account exists.
- Sign-in sessions: up to 180 days, then deleted automatically — together with the notification token.
- Finished games: for as long as your account exists, so your game history stays intact.
- IP addresses used for rate limiting: a few minutes, in memory.
Deleting your account and your data
You can ask us to delete your account and everything belonging to it at any time, with no particular form. Write to contact@wordsapp.org and please include your handle (Name#1234) so we delete the right account. We then remove your profile, your sessions, your friendships, your profile picture and your games.
As long as you only play against the AI or pass-and-play, there is nothing to delete — no account exists on our side.
Your rights
You hold the rights set out in Art. 15 to 21 GDPR: access, rectification, erasure, restriction of processing, data portability and objection. Any consent you have given — for notifications, for instance — can be withdrawn at any time with effect for the future, in the app's settings or your device's.
You may also lodge a complaint with a data protection supervisory authority, for example the one responsible for where we are based.
Children
WordsApp is not directed at children. Google's own age rules apply to signing in through Play Games.
Changes
When the app changes, this policy changes with it. The date at the top tells you which version you are reading.