Privacy Policy

This policy covers the WordBowl apps for iPhone, iPad, and Android, the WordBowl site at www.wordbowl.app, and the account you use with both. One account works across all of them.

What the app collects

• Account details. Your email address and a hashed password, or, if you use Sign in with Apple or Continue with Google, the email address and name that provider shares with us. We also store the display name you choose.
• Games you play. The games you host or join, team names and the player names you enter, the decks you pick, which cards were guessed or skipped and how long each took, and the scores. This powers your game history and helps us balance decks.
• Cards you write. Custom Deck cards and custom bowls you create are stored so they can be played. Cards you add during a game are shown to the other players in that game. We may review submitted Custom Deck cards and use them, without your name attached, to build new official decks.
• Purchases. Payments are handled by Apple or Google; we never see your card details. We receive which plan you bought, when it started and renews or ends, and whether it was refunded, through our purchase provider RevenueCat, so Pro works on all your devices.
• Invites. If you invite a friend by email, we store that email address to send the invite and to credit you when they join. Invites are never sent to someone who has blocked you.
• Notifications. If you allow notifications, we store your device's push token so we can tell you about game invites, games starting and finishing, your turn, and friend requests.
• Crash reports. If the app crashes or hits an error, we receive a report with the error, your device model, operating system and app version, and your account ID (not your name or email), through Sentry.
• Reports and blocks. If you report or block another player, we store that so we can review reports and keep blocked players away from you.
• Camera. The camera is used only to scan game and invite QR codes. Scanning happens on your device and no images are stored or sent to us.

The app has no advertising and no third-party tracking, and we do not link your data with data from other companies.

What the website collects

• Waitlist email. If you join the waitlist, we store the email address you submit plus the page you joined from, your user agent, and your IP. We use this only to email you at launch and to fight spam signups.
• Account email and password. If you create an account, we store your email address and a hashed password through our auth provider, Supabase. We never see your password in plain text.
• Google sign-in. If you choose “Continue with Google,” Google shares your email address and basic profile info (name, avatar) with us through OAuth. We only use this to identify your account.
• Session cookies. Signing in sets first-party cookies so you stay logged in between visits. These are required for the site to work and are not used for advertising.
• Deletion requests. If you submit the account deletion or data deletion form, we store the email you provided, the categories you asked us to delete (data deletion only), any notes you wrote, your user agent, and your IP. We use this only to verify the request, action it, and keep an audit trail of what was deleted and when.
• Support requests. If you contact support through /support, we store your name, reply email, optional account email, topic, platform, message, user agent, and IP. We use this only to answer your question, investigate issues, and keep a record of what we told you.

What we do not do

• No advertising or third-party advertising trackers, in the app or on this site.
• No selling of your data, ever.
• No profile building across other sites.

Who processes your data

• Vercel hosts this site and handles incoming requests.
• Supabase stores your account, games, decks, and the other app data above, and issues session cookies.
• Apple and Google provide optional sign-in and process in-app purchases. Their terms apply when you use them.
• RevenueCat keeps track of your purchases so Pro works on every device.
• Sentry receives crash and error reports from the app.
• Expo delivers push notifications to your device.
• Resend sends invite emails, and internal email notifications for waitlist and support form submissions so we can reply quickly.

Your choices

• Delete your account. Use the in-app option under Profile, Delete account, or submit the public form at /delete-account. We email you to confirm and then delete within 30 days.
• Delete some of your data without deleting your account. Use the form at /delete-data to pick specific categories (game history, decks, custom bowls, push tokens, profile data, analytics) and we will wipe just those within 30 days.
• Unsubscribe from the waitlist. Email hello@wordbowl.app and we will remove your waitlist entry the same day.
• Sign out. You can sign out any time from /account.
• Other questions or requests. Email hello@wordbowl.app. We handle GDPR access, portability, and correction requests through the same address.

How long we keep things

• Waitlist entries: kept until launch, then we email you and delete on request.
• Account data: kept until you delete your account.
• Deletion request records: kept for one year after we action them as an audit trail, then deleted.
• Support requests: kept for up to two years after the last response, then deleted unless we need them for safety, fraud, or legal reasons.
• Backups: rotated within 30 days, so deleted data fully clears backups within that window.

Children

WordBowl is not directed at children under 13. Please do not sign up if you are under 13.

Changes

If we change this policy in a way that matters, we will update the date at the top and notify account holders by email.

Contact

Questions go to hello@wordbowl.app.