How we handle your data

1What data we process

1. Player profile and progress. When you first use the app, you automatically receive an anonymous player ID, which is a random string that does not include your name or email address. We use it to store your game progress, including solved puzzles, levels, streaks, gameplay statistics such as words found in each language, stamps earned, your selected home language, and your chosen mascot and list. This information is stored on your device and in our cloud database so your progress carries over to a new device.

2. Optional account. You can link your profile to an Olympheon account using "Sign in with Apple" or "Sign in with Google." If you do, we also process your email address, the name provided by Apple or Google, and the username you choose. Friend features process the connection between your account and your friends' accounts.

3. Purchases. Payments are handled entirely by Apple (App Store) or Google (Google Play). We never see or store payment card or bank account information. To link your purchases, such as passes and puzzle books, to your profile, our systems process the purchased product, the status and expiration date of a subscription, the store used (Apple or Google), and a pseudonymous linking ID, which is your player ID. We use RevenueCat as a processor for this purpose (see below).

4. Technical data. When you use the app, our systems process limited technical data needed to keep it working, including the app version, operating system and version, device language and time zone, and technical logs of server requests. These logs include your IP address, which is retained briefly for security and abuse prevention. If you have allowed notifications, we also store a push token from your device so that we can send you a message, for example when we reply to your report to support.

5. Usage analytics and error reporting. To improve the app, we measure how it is used, including which screens you view, which levels and daily challenges you start and complete, which language you select, and whether you visit a store page. We also collect technical details such as the app version, device type, and operating system, along with error reports for crashes. We also capture session recordings, which are a series of screenshots showing what happens on your screen while you play, so we can see where players get stuck. Fields containing personal information, such as your username, are obscured in these recordings. This data is linked to your pseudonymous player ID, not your name or email address, and is stored within the EU. You can turn off this tracking at any time in the app (Settings > Usage Analytics). The game will continue to work normally.

6. Stored only on your device. Preferences such as board style, color blindness assistance, and sound settings remain on your device and are not sent to us. Reminders to play are scheduled locally on your device.

7. Reports to support. If you send us a report in the app (Report something), we process what you fill in yourself: the type of report, your description, the messages you send afterward in the conversation, and a screenshot if you add one. So that we can help you, we send technical context along with it: app version, device type and operating system, language and display settings, time zone, your progress in broad terms (such as your highest level and your streak), whether you have a pass, and, for a report about a level, which level it concerns. The report is linked to your player ID, so the reply reaches you in the app. If you email us, we process your email address and the contents of your message.

2Advertising

The free version of the app displays ads through Google AdMob, including short ads between levels and optional ads you can choose to watch in exchange for a hint or a second chance.

Even without your consent, Google processes certain technical data for this purpose: your IP address (which is used to determine a country or region), device and app characteristics, and limited identifiers needed to display an ad, apply frequency caps, and prevent fraud. This is why we cannot say that no data is processed without consent: the ads are not personalized, but they are not completely data-free.

Only if you explicitly consent (on iOS through Apple's tracking permission prompt, and in the EU through our consent screen) will Google use your device's advertising identifier to personalize and measure ads. You can withdraw your consent at any time: in the app via Settings > Privacy > Ad Privacy Choices, and on iOS also via Settings > Privacy & Security > Tracking.

With a Home Pass or World Pass, or in a booklet you purchased, the app does not show interstitial ads. Ads you choose to watch (for a hint or a second chance) remain available, including for subscribers.

3Why we process data and our legal basis

• Providing the game (saving progress, syncing across devices, unlocking purchases): necessary to perform our agreement with you.
• Helping you with a question or a problem (reports to support and email): performing our agreement with you, at your request.
• Security and preventing abuse (technical logs, purchase validation): legitimate interest.
• Improving the app (usage analytics, session recordings, error reporting): legitimate interest. You can turn this off at any time via Settings > Usage Analytics, without affecting the game.
• Optional features (account, friends): performing our agreement with you, at your request.
• Displaying ads in the free version: necessary to perform our agreement with you, because ads fund the free app.
• Personalized ads: only with your consent, which you can withdraw at any time without affecting the game.

We do not use your data for automated decision-making that has legal effects, and we do not sell it.

4Who else is involved

• Google Firebase (Google Ireland Ltd / Google LLC): database, sign-in, server functions, and push notifications. Google Privacy Policy
• RevenueCat, Inc. (US): subscription and purchase management, linked to your pseudonymous player ID. RevenueCat Privacy Policy
• PostHog, Inc. (US, with data stored on servers in the EU): usage analytics, session recordings, and error reporting. PostHog Privacy Policy
• Cloudflare, Inc. (US): storage of the screenshots you send with a report, and hosting of this website. Cloudflare Privacy Policy
• Google Workspace (Google Ireland Ltd / Google LLC): our email, and therefore also the messages you send us.
• Apple and Google Play: payments and app distribution, subject to their own terms and privacy policies.
• Google AdMob (Google Ireland Ltd / Google LLC): displaying and measuring ads and preventing fraud. For personalized ads, Google does not act as a processor but as an independent data controller. How Google uses advertising data
• AppsFlyer Ltd. (Israel and other countries where AppsFlyer or its subprocessors operate): attribution and campaign measurement. With your consent, AppsFlyer may process the IDFA or GAID and link it to your pseudonymous player ID, along with installs, sessions, progress milestones, ad revenue and purchase events. AppsFlyer Privacy Policy

We enter into data processing agreements with our processors. Some processors, including AppsFlyer, RevenueCat, PostHog, Cloudflare, and Google LLC, process data in or from the United States. These transfers are based on the EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs).

5How long we retain data

• Game progress and profile: for as long as you use the game. If you delete your account or request deletion, we will remove the data from our active systems within 30 days.
• Purchase records: for as long as required by law for tax and accounting purposes, then deleted.
• Reports to support and email: up to 24 months after the last message, or sooner if you request deletion. A screenshot you send with a report is deleted along with it.
• Technical logs: up to 12 months, with security logs kept for as little time as reasonably possible.
• Usage statistics and error reports: linked to your player ID for up to 24 months, with session recordings kept for up to 3 months.
• Advertising data: we do not store this ourselves. We only see aggregated reports with totals, not individuals. Google's retention policy applies to the underlying data.
• Attribution data at AppsFlyer: user-level data is retained for a limited period based on the integration type and the relevant advertising network's rules. AppsFlyer retains aggregated reports for up to 25 months. We also pass erasure requests on to AppsFlyer.

6Your rights

Under the GDPR, you have the right to access, correct, delete, restrict, and receive or transfer your data, as well as the right to object to processing based on legitimate interests. You can withdraw your consent at any time, including consent for personalized ads. To do so, email privacy@wordswithmia.com. We will respond within one month. You can also file a complaint with the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

You can delete your account and data directly in the app under Settings > Delete Account, or by emailing privacy@wordswithmia.com.

7Children

Words with Mia is intended for players ages 13 and up and is not a children's app. If you live in the Netherlands and are under 16, only use the optional account features with permission from your parent or guardian. We do not knowingly collect data from children under 13. If we discover that this has happened, we will delete that data.

8Changes

We will notify you in the app if we make significant changes to this policy. The latest version is always available on this page.