Privacy Policy

Word² is a word game you play against friends and the bot. This page says what the app and its server keep about you, who else handles it, how long it is kept, and how to delete it.

Who is responsible

Catch Final AB is responsible for this data. To ask about it, or to see, correct or get a copy of it, write to contact@catchfinal.se.

What we keep

When you sign in with Apple or Google, we keep:

• the ID that Apple or Google gives your account there. We never see your password.
• your email address, or the relay address Apple gives us if you hide yours.
• the username you choose. Other players see it and can find you by it, but never see your email.
• for Apple only, a token that lets us end Word²'s access to your Apple account when you delete your Word² account.
• a hashed copy of the token that keeps you signed in on each phone, with the times it was created and last used, and when it runs out.

Apple shares only your email, besides the ID. Google may also send your name and profile picture with your sign-in; we don't keep them. We keep nothing else about you from Apple or Google. If you play as a guest, we keep no email and no Apple or Google ID, and your name is a generated one.

For your matches we keep who played, the letters picked and where each was placed, the result and the times.

From your finished matches against other players we also keep your stats: for each opponent, how many matches you won, lost and tied and your total score, and your five best scores with the opponent and the date. They stay when the matches themselves are deleted.

For your friends we keep who you are friends with, and the friend requests you have sent and received, with the time each was sent. Only you see your list. The person you ask sees your username among their requests.

Blocks and reports. When you block a player, we store who you blocked and when, until you unblock them or either account is deleted. When you report a player, we store who reported whom, the player's username at that moment, the reason you picked, and when. We use reports only to deal with abuse. The reported player is never told who reported them. Reports are deleted when either account is deleted. A report's log line names the reported player's username, and we receive it in an alert email; Google Cloud keeps that log line as long as its other logs.

For daily letters we keep each day's board you play, with your score and when you finished, for 30 days. Friends who finish the same day's letters see your username, your score and your board. We also keep which language you play in, your phone's time zone, so that your day and the morning reminder follow your clock, and whether you want the morning reminder.

If you allow notifications, we also keep your phone's push token with its platform and language, to tell you about invites, friend requests, today's letters and when it is your turn. A notice can name the other player and give the round or the score, but never a letter.

If you subscribe to Word² Plus, we keep the date your subscription runs until, which RevenueCat tells us. We never see your card or payment details.

Google Cloud, which runs our server, keeps logs of the requests to it, such as the time, the address asked for and the IP address. Some of our own log lines name an account or a match by its ID.

Who else handles it

• Google Cloud runs our server in Belgium and keeps its logs.
• Neon hosts our database in Frankfurt, where your account, matches, friends, daily boards and push token are kept.
• Expo delivers push notifications. It receives your push token, the text of each notice, the kind of notice and, for a match, its ID.
• Apple handles Sign in with Apple, and takes payment for Word² Plus through the App Store.
• Google handles Sign in with Google.
• RevenueCat handles the Word² Plus subscription. When you sign in to your account, the app gives it your Word² account ID so it can tell whether you have Plus, also if you never subscribe. It knows you by that ID, a random number, and not by your name or email.

Apple and Google handle your sign-in under their own privacy policies.

How long we keep it

• Your account, matches, stats and Plus date: until you delete your account. What stays then is described below.
• Your sign-in token and push token: until you sign out of the app or delete your account.
• Your friends and friend requests: until either of you removes them, or one of you deletes your account.
• Your daily boards: 30 days after their day.
• If you stop signing in before you choose a username, the email and ID from Apple or Google, and for Apple the token mentioned above, wait in a temporary record until you finish. Unfinished records older than 30 days are deleted the next time someone signs in with a new Apple or Google account. Older records, from before we stopped collecting names, may also hold the first name Apple or Google sent.
• Server logs: kept by Google Cloud for the period set for our project.

Deleting your account

In the app, open Settings and choose Delete account. We then:

• end Word²'s access to your Apple account, if you signed in with Apple.
• end your matches in progress against other players as given up, and remove invites that nobody has accepted.
• delete your Apple or Google ID, your sign-ins, your push tokens, and your friends and friend requests, and your daily boards.
• replace your username and email with placeholders that point to no one, and clear your Plus date.
• delete your stats. Other players keep theirs, including their results against you.
• ask RevenueCat to delete its record of you. If that request fails, your account is deleted anyway. Until the app is closed, RevenueCat can make a new record under your account's random ID, without your name or email.

Matches that are over, including the ones that just ended as given up, stay for the other player, who sees a former player. They are deleted once the other player has deleted them or has left Word² too. Matches against the bot and on one phone are not deleted; they stay, tied to the emptied account.

Deleting your account does not cancel a Word² Plus subscription. Apple bills you until you cancel it, so cancel it in your Apple account's subscription settings first if you don't want to keep paying.

Your rights

You can ask to see the data we hold about you, to have it corrected or deleted, or to get a copy. Write to the address above. You can also delete your account yourself, as described. If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection (IMY) at imy.se.