Privacy policy
Last updated 2 October 2026
Word Mastermind is a free word game at wordmastermind.app, run by Paul Langdon. This page says what the game keeps about you, where, and why. The short version: no ads, no tracking, and nothing is sold or shared for marketing.
What stays on your device
Single player, two player against the computer and Solo Rush are played entirely in your browser. Your profile (name, country, settings), your game history, statistics and achievements are kept in your browser's storage. As a guest, they're never sent to us; if you sign in, they're kept with your account too (see below). Clearing your browser's data, or Reset profile, deletes this browser's copy.
What the server keeps
The game's server is used for games against a friend, turn alerts and accounts. It keeps:
- A random device ID that your browser makes the first time you use the game. It identifies your device to the server; it isn't linked to who you are unless you sign in.
- Games against a friend: the display name you chose, both secret words, every guess and when it was made, and each player's difficulty. Your friend sees your display name, never your email.
- Your account, if you sign in: your email address and, if you use Google, Google's ID for your account. We ask Google for your email address only, not your name, photo or contacts.
- Your synced profile, if you sign in: your display name, country, the date you started playing, your game settings, and every game you finish (its words, guesses and when they were made), so each device you sign in on shows the same profile, history and statistics.
- Your friends list, if you sign in: your friend code, who you've added or asked to add, and invitations to Rush lobbies. Anyone with your friend code can see your display name and send you a friend request; they never see your email.
- Sign-in records: when you're signed in on a device, and the sign-in links we email you. We store only a scrambled (hashed) form of each sign-in link and session, so they can't be used by anyone who reads the database.
- Issue reports, if you send one: what you wrote, and a scrambled (hashed) form of your internet address, deleted once it's an hour old (when the next report arrives), so the form can't be used to flood the issue tracker.
- Turn alerts, if you turn them on: the address your browser's push service gives us for your device, and the keys to encrypt notifications to it.
We use this only to run the game: to referee games, show you your games and profile on each device you sign in on, send your sign-in links and tell you when it's your turn. The game uses no cookies and no analytics or advertising services, and it loads nothing from other websites.
Services that handle your data for us
- Cloudflare hosts the game and its server and stores the data above. It also counts visits to the site (how many, which pages, and from which countries) from its own records of requests, with no cookie or script in your browser.
- Resend sends the sign-in emails, so it receives your email address and the message.
- Google, only if you choose Continue with Google: you sign in on Google's page, and Google tells us your email address and account ID.
- Your browser's push service (Apple, Google or Mozilla, depending on your browser) delivers turn alerts. The alerts are encrypted so only your device can read them.
How long we keep it
- Your account stays until you delete it.
- A sign-in link works for 15 minutes, and its record is deleted about a day later.
- A session ends after 180 days without use, or when you sign out.
- Finished games against a friend stay in the game's history, since they're your friend's games too. They're stored under random device IDs, not your email.
Deleting your data
In the game, open your profile and choose Delete account. That signs out every device, stops their turn alerts and deletes your email address, sign-in records, synced profile and game history, and friends list. Sign out stops turn alerts for that device. To have anything else removed, or to ask what we hold about you, email [email protected].
Children
The game isn't aimed at children under 13, and we don't knowingly keep accounts for them.
Changes
If this policy changes, the new version will be posted here with a new date.