Privacy Policy — Hidden Word
In short: you can start with an anonymous account and optionally connect Google. We store the profile, preferences, progress, results, events needed to operate rounds, and hint inventory. The app uses Google AdMob for advertising, Google's advertising-consent tools, and Sentry for error diagnostics. We use Google account data only to connect and identify the account, not to personalize ads. We do not sell personal data. You can delete your account from the app.
1. Data controller
The application is operated by D-WEB ENGINEERING SRL, registered at Str. Col. Scarlat Demetriade no. 2, bl. G7, entrance 1, apt. 153, Craiova, Dolj County, Romania. For privacy questions or to exercise your rights, email dwebegineering.support@gmail.com.
2. Data we process
- Account and authentication: the Supabase technical identifier, anonymous-user status, and technical session information.
- Optional Google data: if you choose Google connection, we receive the Google identifier and basic profile information made available by Google, including email address and name; provider metadata may also contain a profile picture.
- Profile and preferences: display name, language, Easy or Hard mode, music, sound effects, vibration, and the official-video feature choice.
- Gameplay and progress: levels started and completed, round language and difficulty, letters added or removed, wrong submissions, hints, active time, score, and stars.
- Hints and rewards: hint balance, audited balance changes, and rewarded-ad events needed to verify rewards, apply limits, and prevent duplicate grants.
- Advertising data: when advertising features are active, Google Mobile Ads may collect and share the IP address, interactions with the app and ads (such as launches, taps, and video views), diagnostic information, and device or account identifiers, including the Android advertising ID and app set ID.
- Technical, error, and security data: IP address, network requests, app version, device model and operating system, application state, error reports, technical error traces, and diagnostic logs to the extent processed by infrastructure providers for operation, troubleshooting, security, and abuse prevention.
- Communications: information you choose to provide when requesting support or account deletion.
The app does not request access to contacts, location, microphone, or device photos for normal gameplay.
3. How we use Google user data
Google connection is optional. We use Google user data only to authenticate you, link the existing anonymous account to your Google identity, preserve progress across devices, and populate the display name. We do not use Google user data for personalized advertising, sell it, or transfer it for training artificial-intelligence models. It is shared only with providers needed to operate the service or when required by law.
4. Other purposes
- creating and maintaining the account, synchronizing progress, and delivering content in the selected language;
- validating answers, calculating scores, and granting hints;
- detecting and diagnosing crashes and technical errors;
- securing and debugging the service, preventing fraud, and complying with legal obligations;
- providing support and responding to requests;
- selecting eligible results for official videos only when you enable the separate Settings option.
5. Legal bases
Depending on the situation, processing is necessary to provide the requested service, based on legitimate interests in security and operation, required by law, or based on consent where consent is required. Consent can be withdrawn without affecting processing performed before withdrawal.
6. Official videos
The option is disabled by default. If enabled, your display name and information about how you solved an eligible round may be selected for an official video. Turning it off prevents future selections. A video published earlier may remain on the platform where it was distributed; you may ask support to review a removal request.
7. Providers
- Supabase: authentication, database, storage, and server functions.
- Google: optional authentication, Google AdMob for serving and measuring ads, and Google User Messaging Platform for managing advertising privacy choices.
- Sentry: collecting and organizing error reports, associated technical information, and enabled diagnostic logs so we can identify and fix application problems.
- Firebase Hosting: hosting these public application pages.
Providers may process data in other countries under their applicable transfer mechanisms and safeguards. We do not sell personal data.
We configure Sentry not to send personally identifiable information by default. Reports are associated only with the account's technical Supabase identifier, without a name or email address. We do not enable Sentry Session Replay or the Sentry feedback form.
8. Advertising
The app contains three Google AdMob formats: a banner in the gameplay footer, interstitial ads shown after certain completed levels, and rewarded videos that you choose to watch in exchange for a hint. Ads may be unavailable in a particular session because of app or server configuration, region, connection, limits, or provider availability.
Google Mobile Ads uses the advertising data described above for advertising, analytics, and fraud prevention; the IP address may be used to estimate general location. Where required, Google User Messaging Platform presents the applicable choices before the app requests ads. You can reopen advertising privacy options from Settings when that entry point is required and available. Rewarded ads are voluntary, and closing one before meeting its conditions or failure of server verification does not grant the hint.
9. Retention and deletion
Account data is retained while the account exists and as needed for operation, security, and legal obligations. Account deletion removes the authentication identity and associated data controlled by us, including the profile, progress, attempts, results, and inventory. Temporary provider backups or logs may expire later under their retention cycles. See Account deletion.
10. Your rights and security
Subject to applicable law, you may request access, correction, deletion, restriction, portability, or objection and may complain to the Romanian National Supervisory Authority for Personal Data Processing. We use encrypted connections, access controls, and database-level security rules, but no method can guarantee absolute security.
11. Children
The app is not specifically designed for children. If you are not old enough to accept this policy in your jurisdiction, use the app only with the permission and supervision of a parent or guardian.
12. Changes and contact
We may update this policy when the app, providers, or legal requirements change. We will publish the new version date here. Contact: D-WEB ENGINEERING SRL, Str. Col. Scarlat Demetriade no. 2, bl. G7, entrance 1, apt. 153, Craiova, Dolj, Romania, dwebegineering.support@gmail.com.