WordRoam
Privacy Policy
You can play WordRoam without giving us an email address. An account is optional and is used to keep your journey across devices.
Information we use
| When | Information | Purpose |
|---|---|---|
| Guest play | Destination stamps, favorites, puzzle history, last stop, and saved puzzle progress in browser storage | Keep your collection on this browser |
| Account registration and login | Email, password hash and salt, account identifier, and expiring session records | Authenticate and save your journey |
| Account saving | Stamps, puzzle date, destination, difficulty, grid seed, found words, elapsed time, hints, favorites, and completion timestamps | Restore progress and show your private history |
| Usage statistics | Page paths, hashed anonymous browser/session IDs, referring source, campaign labels, language, device/browser category, and coarse country/region | Understand which pages work and identify problems |
| Account activity | Registration, login and logout type, success or failure, timestamp, and email when supplied | Operational monitoring and private administrator notifications |
| Support | The email and message you choose to send, support replies, and a private conversation token in this browser | Answer your request |
We store a derived password hash, not your password in plain text. Passwords and session tokens are not included in administrator notifications. Our application statistics store page paths without URL query strings and do not store raw IP addresses. Short-lived security/rate-limit records use an IP hash. Our hosting provider necessarily processes network information to deliver and protect the service.
Cookies and browser storage
The essential meadow_session cookie keeps you signed in. It is HttpOnly, SameSite=Lax, and Secure on HTTPS, and expires after seven days unless you log out first. The older internal name is retained for compatibility. Local storage keeps your game collection, anonymous analytics browser ID, support conversation token, and privacy preference; session storage keeps an anonymous analytics session. Clearing site storage removes those local records and may disconnect your support conversation.
Usage statistics and your choice
We use our own shared site-statistics service rather than advertising trackers. It records anonymous browser page views and aggregate usage; anonymous IDs can still distinguish repeat visits in the same browser. It respects Do Not Track and Global Privacy Control signals. You can also disable optional page statistics in this browser below. Essential account security and support processing continue.
Service providers and notifications
Cloudflare hosts the site and databases and processes delivery/security information. Our shared administrator service reports usage summaries and account events to a private Telegram channel used by the operator. Account-event notifications can contain an email address, action and result. Support requests use the operator’s shared support service at tokviewer.app and Telegram so the team can read and answer them. Support content is not published on the website. Cloudflare may also collect aggregate browser performance and usage measurements through its own beacon; the choice below controls WordRoam’s shared page-statistics service. The game may request fonts from Google Fonts, which receives ordinary network request information. Providers may process data in countries other than your own.
We do not sell personal information or run targeted advertising on this site. There are no payment features in the current version.
How long we keep information
Application page-view and business-event records are retained for up to 90 days; reporting run logs are retained for 30 days. Sessions expire after seven days, and short-lived rate-limit records expire on their configured security window. Account collections remain until deleted. Guest storage remains until you clear it. Support messages and delivered administrator notifications may remain in the support service or private Telegram history until removed; they are not covered by the 90-day analytics cleanup.
Children
Accounts and the support form are intended for people aged 13 or older. Younger players should use guest play with a parent or guardian and avoid submitting personal information. If you believe a child under 13 has supplied personal data, contact us so we can investigate and arrange removal.
Access, correction, and deletion
Use our contact form to ask about your data, request a copy, correct an email or record, or request deletion. Include the account email and the request, but never a password. We may need to verify ownership. Legal obligations, security investigations, and provider backup retention can affect the timing or scope of deletion. You can remove guest records yourself by clearing this site’s browser data.
Changes and contact
We update this page when our data practices change and show the effective date above. Questions about this policy can be sent through Contact WordRoam.