How we handle your data

1What data we process

1. Player profile and progress. When you first use the app, you automatically receive an anonymous player ID, which is a random string containing no name or email address. We use it to save your game progress, including solved puzzles, levels, streaks, play statistics such as words found in each language, stamps earned, your chosen home language, mascot, and word list. This information is stored on your device and in our cloud database so your progress carries over to a new device.

2. Optional account. You can link your profile to an Olympheon account using "Sign in with Apple" or "Sign in with Google." If you do, we also process your email address, the name provided by Apple or Google, and your chosen username. Friend features process the connection between your account and your friends' accounts.

3. Purchases. Payments are handled entirely by Apple (App Store) or Google (Google Play). We never see or store payment card or bank account details. To link your purchases, including passes and puzzle books, to your profile, our systems process the purchased product, the status and expiry date of a subscription, the store used (Apple or Google), and a pseudonymous linking ID, which is your player ID. We use RevenueCat as a data processor for this purpose (see below).

4. Technical data. When you use the app, our systems process limited technical data needed to keep it working, including the app version, operating system and version, device language and time zone, and technical logs of server requests. These logs include your IP address, which is retained briefly for security and abuse prevention. If you have allowed notifications, we also store a push token from your device so that we can send you a message, for example when we reply to your report to support.

5. Usage statistics and error reporting. To improve the app, we measure how it is used, including which screens you view, which levels and daily challenges you start and complete, which language you choose, and whether you visit a store page. We also collect technical details such as the app version, device type, and operating system, along with error reports such as crashes. We also capture session recordings, which are a series of screenshots showing what happens on your screen while you play, so we can see where players get stuck. Fields containing personal information, such as your username, are obscured in these recordings. This data is linked to your pseudonymous player ID, not your name or email address, and is stored within the EU. You can turn this measurement off at any time in the app under Settings > Usage Statistics. The game will continue to work as usual.

6. Stored only on your device. Preferences such as board style, colour-blind assistance, and sound settings remain on your device and are not sent to us. Reminders to play are scheduled locally on your device.

7. Reports to support. If you send us a report in the app (Report something), we process what you fill in yourself: the type of report, your description, the messages you send afterwards in the conversation, and a screenshot if you add one. So that we can help you, we send technical context along with it: app version, device type and operating system, language and display settings, time zone, your progress in broad terms (such as your highest level and your streak), whether you have a pass, and, for a report about a level, which level it concerns. The report is linked to your player ID, so the reply reaches you in the app. If you email us, we process your email address and the contents of your message.

2Advertising

The free version of the app displays ads through Google AdMob. These include short ads between levels and optional ads you can choose to watch in exchange for a hint or a second chance.

Even without your consent, Google processes certain technical data for these purposes: your IP address (which is used to determine a country or region), device and app characteristics, and limited identifiers needed to display an ad, apply frequency caps, and prevent fraud. This is why we cannot say that no data is processed without consent: the ads are not personalized, but they are not completely data-free.

Only if you expressly consent to it (on iOS through Apple's tracking permission prompt, and in the EU through our consent screen) does Google use your device's advertising identifier to personalize and measure ads. You can withdraw your consent at any time: in the app through Settings > Privacy > Ad Privacy Choices, and on iOS also through Settings > Privacy & Security > Tracking.

With a Home Pass or World Pass, or in a booklet you have purchased, the app does not show interstitial ads. Ads you choose to watch (for a hint or a second chance) remain available, including for subscribers.

3Why we use your data and our legal basis

• Providing the game (saving progress, syncing between devices, unlocking purchases): necessary to perform our agreement with you.
• Helping you with a question or a problem (reports to support and email): performing our agreement with you, at your request.
• Security and preventing abuse (technical logs, purchase validation): legitimate interest.
• Improving the app (usage analytics, session recordings, error reporting): legitimate interest. You can turn this off at any time through Settings > Usage Analytics, without affecting the game.
• Optional features (account, friends): performing our agreement with you, at your request.
• Showing ads in the free version: necessary to perform our agreement with you, since ads fund the free app.
• Personalized ads: only with your consent, which you can withdraw at any time without affecting the game.

We do not use your data for automated decision-making that has legal effects, and we do not sell it.

4Who else is involved

• Google Firebase (Google Ireland Ltd / Google LLC): database, sign-in, server functions, and push notifications. Google Privacy Policy
• RevenueCat, Inc. (US): subscription and purchase management, linked to your pseudonymous player ID. RevenueCat Privacy Policy
• PostHog, Inc. (US, with data stored on servers in the EU): usage analytics, session recordings, and error reporting. PostHog Privacy Policy
• Cloudflare, Inc. (US): storage of the screenshots you send with a report, and hosting of this website. Cloudflare Privacy Policy
• Google Workspace (Google Ireland Ltd / Google LLC): our email, and therefore also the messages you send us.
• Apple and Google Play: payments and app distribution, under their own terms and privacy policies.
• Google AdMob (Google Ireland Ltd / Google LLC): displaying and measuring ads, and preventing fraud. For personalized ads, Google acts as an independent data controller rather than as a processor. How Google uses advertising data
• AppsFlyer Ltd. (Israel and other countries where AppsFlyer or its subprocessors operate): attribution and campaign measurement. With your consent, AppsFlyer may process the IDFA or GAID and link it to your pseudonymous player ID, along with installs, sessions, progress milestones, ad revenue and purchase events. AppsFlyer Privacy Policy

We enter into data processing agreements with our processors. Some processors, including AppsFlyer, RevenueCat, PostHog, Cloudflare, and Google LLC, process data in or from the United States. These transfers are based on the EU-US Data Privacy Framework and/or the European Standard Contractual Clauses (SCCs).

5How long we keep your data

• Game progress and profile: for as long as you use the game. If you delete your account or request deletion, we will erase this data from our active systems within 30 days.
• Purchase records: for as long as required by legal and tax retention obligations, after which they will be deleted.
• Reports to support and email: up to 24 months after the last message, or sooner if you request deletion. A screenshot you send with a report is deleted along with it.
• Technical logs: up to 12 months, with security logs kept for as short a time as reasonably possible.
• Usage statistics and error reports: up to 24 months when linked to your player ID, with session recordings kept for up to 3 months.
• Advertising data: we do not store this ourselves. We only see aggregated reports with totals, not individuals. Google's retention policy applies to the underlying data.
• Attribution data at AppsFlyer: user-level data is retained for a limited period based on the integration type and the relevant advertising network's rules. AppsFlyer retains aggregated reports for up to 25 months. We also pass erasure requests on to AppsFlyer.

6Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, and transfer your data, and to object to processing based on legitimate interests. You can withdraw your consent at any time, including consent for personalized advertising. To do so, email privacy@wordswithmia.com. We will respond within one month. You can also file a complaint with the Dutch Data Protection Authority at autoriteitpersoonsgegevens.nl.

You can delete your account and data directly in the app under Settings > Delete Account, or by emailing privacy@wordswithmia.com.

7Children

Words with Mia is intended for players aged 13 and older and is not a children's app. If you live in the Netherlands and are under 16, only use the optional account features with permission from your parent or guardian. We do not knowingly collect data from children under 13. If we discover that this has happened, we will delete the data.

8Changes

We will notify you in the app if we make significant changes to this policy. The current version will always be available on this page.