Privacy policy

Effective 2 November 2026

The short version: WordLord never asks for your email address or real name, and has no chat. We keep only what's needed to save your progress and run online games, and you can delete it from inside the app. WordLord is paid for by ads from Google AdMob. Google receives device and ad data to show and measure those ads. Where the law requires it, we ask before any ads are personalised. Players under 13 only get non-personalised, family-friendly ads. The one-time Supporter pack turns ads off.

Who we are
What we collect and why
Ads
Children and teens
Who we share data with
Where data is processed
How long we keep it
Your rights and choices
US state privacy rights
Do Not Track
Security
This website
Changes to this policy
Contact us

1. Who we are

WordLord is made by Ronomade ("we", "us"). We are the data controller for the personal data described here. This policy covers the WordLord app for Android and iOS, its online services, and this website. You can reach us about anything in this policy at the address in Contact us.

2. What we collect and why

We designed WordLord to work with as little personal data as possible. Vs Computer, Pass & Play and the Daily Challenge work offline, and much of what you do stays on your device.

Stored only on your device

Your birth year, from the one-time question when you first open the app. It decides how ads treat you (see Children and teens). It is never sent to us.
Settings, coins and power-ups. When you're online, the app backs up your progress to our server, as described below.

Stored on our server

What	Why	Legal basis (GDPR / UK GDPR)
A random player ID and a random ID for each install, created by the app the first time it reaches our server. Neither is linked to your phone number, email or advertising ID.	To keep your account and sync your progress.	Performing our contract with you (Art. 6(1)(b))
Display name and avatar. Names are generated from word lists (for example "Clever Lion 53"). There's no free text, so you can't enter your real name.	So other players can see who they're playing with.	Contract (Art. 6(1)(b))
Game progress: Word Book, stats, level, daily challenge results, friend list, challenges you create or play, coin rewards for invites, and the moves and scores of online games you take part in.	To run the game: progress, leaderboards, friends, challenges, online matches and invite rewards.	Contract (Art. 6(1)(b))
Optional sign-in: only the account identifier Google or Apple gives us. We never receive or store your email address or name.	So your progress can follow you to another device.	Contract (Art. 6(1)(b))
Purchases: the store, product, order number and date of a Supporter pack purchase. Payment is handled entirely by Google Play or the App Store. We never see your card details.	To unlock what you bought, on every device you sign in to.	Contract (Art. 6(1)(b))
Notifications: if you allow them, a push token for your phone (a random address from Google's Firebase Cloud Messaging that lets us reach this app on this device), your app language, and which alerts you chose. Plus the friend and challenge alerts we send you (for example "Lucky Panda challenged you"), kept in your in-app inbox.	To tell you when a friend adds you, challenges you, beats your challenge or invites you to play, and, only if you turn it on, to send news about the game.	Contract for friend alerts (Art. 6(1)(b)); your consent for news (Art. 6(1)(a))
Your IP address, which any internet service sees when your device connects.	To deliver the service and to limit abuse (rate limiting). We don't add it to your profile or write it to our logs.	Our legitimate interest in running a secure service (Art. 6(1)(f))

Collected by our ad partner

When the app shows ads, Google's Mobile Ads SDK (AdMob) collects data on your device and sends it to Google. See Ads for what, why and your choices.

Kept only on your device

Play reminders (for example "Your 5-day streak is waiting") are planned by the app on your phone from your own progress and the hours you usually play. That information never leaves your device. You can turn reminders, friend alerts and news on or off separately in Settings → Notifications, or turn off all notifications for WordLord in your phone's settings.

We don't ask for or use your location, contacts, camera, microphone or photos.

3. Ads

WordLord shows ads from Google AdMob: a banner along the bottom of menu screens, an occasional ad inside longer lists, and now and then a full-screen ad between games. Ads never appear while you're playing a game, and never if you own the Supporter pack.

What Google collects

Your device's advertising ID (Android advertising ID, or Apple's IDFA if you allow tracking), or an app-set ID.
IP address, and the approximate location Google derives from it.
Device and app information, such as the model, operating system, language and app version.
How you interact with ads (impressions and taps), plus diagnostic and performance data.

Google uses this data to show ads, measure them, limit how often you see the same ad, and prevent fraud. If you give permission, Google also uses it to personalise ads to your interests. Google's own use of this data is governed by its privacy policy. See how Google uses information from apps that use its services and Google's privacy policy.

Consent and your choices

EEA, UK and Switzerland: before ads load, the app shows Google's consent form (a certified consent management platform under the IAB Transparency & Consent Framework). You can accept or decline personalised ads and the related device storage. If you decline, you may still see non-personalised or limited ads, which rely on our legitimate interest in funding the app or on your consent where storage on your device requires it. The legal basis for personalised ads is your consent (Art. 6(1)(a)).
US states with privacy laws: the app offers Google's opt-out of "sale" or "sharing" of personal information for targeted advertising (see US state privacy rights).
Changing your mind: open Settings → Ad privacy choices at any time to change or withdraw your choice. Withdrawing is as easy as giving consent.
iPhone and iPad: you may be asked whether WordLord may track you. If you choose "Ask App Not to Track", Google doesn't receive your IDFA.
Device settings: you can reset or delete your advertising ID (Android: Settings → Privacy → Ads; iOS: Settings → Privacy & Security → Tracking).
No ads at all: the one-time Supporter pack turns ads off for good.

4. Children and teens

WordLord is a general-audience word game that anyone can play without sharing personal information. It has no chat, no free-text names and no way for players to message each other.

The first time you open the app, it asks for your birth year without suggesting an answer. The answer stays on your device and decides how ads treat you:

Under 13: every ad request is tagged as child-directed, in line with the US Children's Online Privacy Protection Act (COPPA) and Google's Families policies. Google then serves only non-personalised ads rated for general audiences, doesn't use the advertising ID, and doesn't build an advertising profile. We don't show a consent form or tracking prompt.
13 to 15: the same protections as under 13: no personalised ads, no advertising profile, no consent form or tracking prompt. GDPR Article 8 lets EU countries set the age of digital consent as high as 16, and US state laws require opt-in consent before selling or sharing data of anyone under 16, so we don't ask. Ads may be rated for slightly older audiences (PG).
16 and 17: requests get teen treatment, which excludes ads and categories unsuitable for minors.

Notifications are also adjusted by age. Under 16, play reminders are off unless the player turns them on, they're limited to the daily challenge and streak, never come after 7 pm, and there are no news notifications. Under 13, no push token is sent to our server at all: friend alerts appear only inside the app.

The only data our own server keeps about any player is what's listed in What we collect: a random ID, a generated name and game progress, used only to run the game. COPPA permits this kind of data without parental consent for supporting a service's internal operations. We don't knowingly collect any other personal information from children under 13.

A parent or guardian can delete a child's account and progress at any time in Settings → Delete account and progress. Or email us with the child's friend code (shown on the Friends screen), and we'll review or delete the data and stop any further collection.

We don't sell your personal information for money. We share it only with:

Google (AdMob), for ads as described above. For personalised ads, Google acts as an independent controller.
Google and Apple, for optional sign-in, and Google Play and the App Store, to process and verify purchases.
Google (Firebase Cloud Messaging) and, on iPhone and iPad, Apple (Push Notification service), which deliver notifications to your phone as our processors. They receive the push token and the text of the notification.
Hetzner Online GmbH (Germany), which hosts our server and database as our processor under a data processing agreement.
Other players see your generated name, avatar and game results where relevant: in an online game with you, on a daily leaderboard, in a challenge you created, or in their friend list if you swapped friend codes.
Authorities, if we're legally required to, or to protect the safety of our players or the service.

6. Where data is processed

Our server and database are in the European Union (Germany). Google may process ad data, and Google and Apple notification data, in the United States and other countries. Those transfers are protected by the European Commission's Standard Contractual Clauses and, where Google is certified, the EU–US Data Privacy Framework and its UK and Swiss extensions.

7. How long we keep it

Account and progress: until you delete your account in the app, or ask us to. Deletion removes it from our live database straight away and from our rolling backups within 15 days. Moves you made in online games stay in those games' records so other players' history still adds up, but they're no longer linked to any account.
Data on your device: your progress until you delete your account in the app; settings (including your birth year) until you uninstall it.
Notifications: alerts in your in-app inbox for 30 days (room invites expire after 10 minutes). Your push token until you sign out, turn notifications off, delete your account, or the token stops working.
IP address: held in memory for about a minute for rate limiting. It isn't written to our logs. Server logs rotate automatically.
Ad data: kept by Google under its retention policies. See how Google retains data.

8. Your rights and choices

Wherever you live, you can:

Delete your account and progress in Settings → Delete account and progress.
Turn notifications off in Settings → Notifications, or in your phone's settings.
Change or withdraw ad consent in Settings → Ad privacy choices (shown where the law requires it), or turn ads off with the Supporter pack.
Ask us for a copy of your data, to correct it, or to delete it. Email us and include your friend code from the Friends screen so we can find your account. We never ask for ID documents.

If you're in the EEA, UK or Switzerland, you also have the right to access, rectify, erase, restrict and port your data, to object to processing based on legitimate interests, to withdraw consent at any time without affecting earlier processing, and to complain to your data protection authority. We'd appreciate the chance to help first.

Similar rights exist under Brazil's LGPD, Canada's PIPEDA, and the privacy laws of many other countries, including Kenya, South Africa, India, Japan and Australia. We honour requests from anyone, wherever they live, and reply within one month (45 days where US state law allows).

The app doesn't make decisions about you based solely on automated processing that have legal or similarly significant effects.

9. US state privacy rights

Residents of California and other US states with consumer privacy laws (for example Virginia, Colorado, Connecticut, Utah, Texas and Oregon) have these rights:

Categories collected in the last 12 months: identifiers (random player ID, install ID, push token, advertising ID, IP address); internet or other electronic activity (game progress, ad interactions); approximate geolocation derived from IP (by Google); commercial information (Supporter purchase record); and inferences Google may draw for personalised ads. The sources are you, your device and the app. The purposes are those in sections 2 and 3.
"Sale" and "sharing": we don't sell personal information for money. However, letting Google use identifiers and ad data for cross-context behavioural advertising can count as "selling" or "sharing" under these laws. You can opt out in Settings → Ad privacy choices, or by emailing us. We don't knowingly sell or share the personal information of consumers under 16.
Sensitive personal information: we don't collect any.
Your rights: to know, access, correct and delete your personal information, to opt out of its sale or sharing and of targeted advertising, to appeal a decision about your request (reply to our answer to appeal), and not to be discriminated against for using any of these rights. You can use an authorised agent. We may ask the agent to show your permission.

Under California's Online Privacy Protection Act (CalOPPA), this policy also tells you what we collect (section 2), who we share it with (section 5), how to review and change it (section 8), and how we announce changes (section 13). Third parties, specifically Google for ads, may collect personal information about your online activities over time and across different apps and websites when you use WordLord.

10. Do Not Track

The app isn't a web browser, so it doesn't receive browser "Do Not Track" signals. Use Settings → Ad privacy choices and your device's ad settings instead. This website doesn't track you, so it treats every visitor the same whether or not Do Not Track is on.

11. Security

All connections between the app and our server are encrypted (HTTPS). Sign-in tokens are short-lived, and our database stores only a one-way hash of refresh tokens. Access to the server is restricted to us. No system is perfectly secure, but if a breach ever puts your data at risk, we'll notify you and the authorities as the law requires.

12. This website

This website uses no cookies, analytics or ads, and our web server doesn't keep visitor logs. Its fonts load from Google Fonts, so your browser sends Google your IP address when it fetches them. See Google Fonts and privacy.

13. Changes to this policy

If we change this policy, we'll update this page and the effective date above. If a change is significant, for example new kinds of data or new partners, we'll also say so in the app's release notes and, where the law requires it, ask for your consent again.

14. Contact us

Ronomade, the maker of WordLord. Email privacy@wordlord.example. We reply within one month. You can also find our developer contact details on WordLord's Google Play and App Store listings.