Privacy Policy for Trifecta Word

Effective date: September 4, 2026

1. Agreeing to This Policy

Before you can play, the App asks you to tick a box confirming that you have read this Privacy Policy and the Terms of Service, and that you agree to the Terms of Service and acknowledge this Privacy Policy. Until that box is ticked, you cannot sign in with Google and cannot continue as a guest. If you do not agree, please do not use the App.

2. Information We Collect

What we hold depends on how you use the App. A guest who never signs in is only ever recorded on their own device; a signed-in player has an account on our server.

2.1 Account and authentication data

• Your Google account identifier and email address, and the Google ID token used to authenticate you, if you choose to sign in with Google. The token itself also carries the name on your Google account, but we do not store it — the account record we keep holds your Google account identifier, your email address, your public ID and the nickname you chose yourself. We never receive your Google password.
• A backend session token, issued to the web app in exchange for your Google ID token so your browser session survives longer than the one hour a Google token is valid for.
• A random 16-digit public ID we generate for your account. It is what other players type to invite you to a private scoreboard, so that inviting somebody never requires knowing their email address.
• Guest session status, if you choose to play without an account.

2.2 Gameplay and app data

• Puzzle progress, scores, and completion/timed-out status, together with the server-side state of a round in progress (the clock, the column you are on, hints used) so a puzzle can be resumed on another device.
• Your leaderboard nickname, score, and ranking. This information is publicly visible to other players on the live scoreboard once you choose to share a result. Do not use your real name as a nickname if you wish to remain anonymous.
• Basic app preferences: theme setting, tutorial and intro-puzzle progress, and the fact that you agreed to these documents.
• Your in-game currency ("coins") balance and the ledger of how it moved — coins earned from solving puzzles, daily and rewarded-ad coin boxes, rewards and gifts, and coins spent on hints, extra puzzles, cosmetic item boxes and private scoreboards.
• Which cosmetic items you have unlocked and which you have equipped (keyboard themes, nickname borders, profile icons, and nickname fonts), and how many item boxes you have opened.
• Rewards granted to you for scoreboard placements, whether you have collected them, and your "double reward" token balance.
• The private ("friends") scoreboards you create or are invited to, and the invitations between you and other players.
• If you choose to donate coins to the monthly community leaderboard, your donation total for that month. Your monthly donation rank and any resulting status badge ("Royalty", "Nobility", or "Bourgeoisie", depending on rank) are publicly visible next to your nickname on scoreboards, the same way your score already is.

2.3 Advertising and device-related data

• In the Android app, Google AdMob may collect your Advertising ID, device information, IP address, and ad interaction data in order to serve and measure the rewarded video ads, and — where you have not opted out — to personalize them.
• In the web app, Google H5 Games Ads may set cookies and collect device, browsing and ad interaction data when serving and measuring an optional rewarded ad.

These are collected by Google under its own privacy policy, not by us. See Section 6.

2.4 Analytics, crash reports and notifications (Android app)

From version 2.2.0 the Android app uses three Google Firebase services. All three are switched off until you have answered the consent form the app shows on first launch, and you can turn analytics and crash reporting off at any time in Settings → Notifications & Privacy.

• Firebase Analytics records which screens you open and which actions you take in the game — a puzzle started and finished, a hint bought, a scoreboard viewed — together with a Google-generated app instance identifier, your device model and operating system version, and an approximate location derived from your IP address. Events never include your nickname, your email address, or anything you type into the game.
• Firebase Crashlytics records crashes and handled errors: the stack trace, your device model and operating system version, and the screen you were on.
• Firebase Cloud Messaging stores a device registration token so we can send the one daily reminder described in Section 2.5. It is created only if you ask for reminders, and deleted when you turn them off or delete your account.

Where you are signed in, analytics events and crash reports are labelled with the random public ID the app shows you in Settings — never your email address or your Google account identifier. Where you are playing as a guest, they are labelled with the literal word “guest”, with no device identifier attached.

2.5 Notifications (Android app)

If you opt in, the app sends at most one notification a day: a reminder, six hours before the day’s puzzle expires, asking whether you can still solve it. It is never sent once you have solved or timed out on that day’s puzzle. To send it we store your notification token, the app version, your device’s time zone, and — if you are signed in — a link to your account, so we can skip you once you have played. You can turn reminders off at any time in Settings → Notifications & Privacy, or in your device’s notification settings.

2.6 Information we do not collect

• We do not request access to your contacts, location, camera, microphone, photos, or device storage.
• We do not collect payment information of any kind. The App contains no in-app purchases and no paid tiers: there is nothing to buy, so no payment details ever exist to be collected.
• We do not collect the contents of anything you type into the game, and no analytics event or crash report carries your nickname, your email address, or any free text.

3. How We Use Information

We use the information we collect to:

• Provide and operate the puzzles, the timer, hints, and the rest of core gameplay;
• Authenticate you and sync your progress, coins and collection across your devices;
• Operate the live, monthly and private scoreboards, and deliver the rewards they pay out;
• Let players invite each other to private scoreboards without exposing anyone’s email address;
• Show and measure ads, which are what fund the App;
• Answer your support emails and your data access and deletion requests;
• Detect abuse (for example duplicate nicknames or manipulated scores), keep the service secure, and prevent fraud;
• Comply with legal obligations.

We do not sell your personal information for money, and we do not use your data for any purpose unrelated to operating and improving the App.

4. Legal Bases (EEA/UK/EU Users)

Where the General Data Protection Regulation ("GDPR") applies, we process your data under one or more of the following bases:

• Contract — providing the features you asked for (syncing progress, publishing scoreboard results, running private scoreboards);
• Legitimate interests — security, reliability, and preventing abuse;
• Consent — for personalized advertising and any optional data processing, obtained through the in-app consent form shown to users in the EEA, UK, and Switzerland;
• Legal compliance.

You may withdraw consent at any time through the in-app ad consent settings or by contacting us.

5. Data Retention

Local data on your device (puzzle history, saved nickname, preferences) is kept until you clear the App’s data, uninstall it, or delete your account from within the App. Data on our server is kept for as long as your account exists, and is deleted or anonymized when you delete your account (Section 7.2) or when it is no longer needed, subject to any legal obligations.

“No longer needed” is enforced by automated jobs that run every day, not left to judgement:

• Kept while your account exists: your account record, your lifetime counters (puzzles completed, coins earned, scores shared), your coin balance, the items and achievements you own, your private scoreboards, and your monthly donation and podium totals. These are what the game is built on.
• Kept for a day: daily-puzzle scores and the puzzle rounds behind them. Each day’s scoreboard is archived down to its top three and the rest is deleted the following night.
• Kept for two days: the short-lived records behind the App’s anti-abuse limits — which rewarded actions and coin boxes you have used recently.
• Kept for 90 days: the running record of individual coin movements behind your balance, so a question about your balance can still be answered.
• Kept for 180 days: security audit entries.
• Deleted as they expire: browser sign-in sessions, cleared nightly once expired.

6. Third-Party Services

We use the following third-party providers, each acting as an independent controller or processor under its own privacy policy:

• Google Sign-In (authentication)
• Google Mobile Ads / AdMob (advertising in the Android app)
• Google H5 Games Ads / Ad Placement API (rewarded advertising in the web app)
• Google Firebase Analytics (usage measurement in the Android app)
• Google Firebase Crashlytics (crash and error reporting in the Android app)
• Google Firebase Cloud Messaging (the daily puzzle reminder in the Android app)

See Google’s Privacy Policy, how Google uses information from sites and apps that use its services, and Google’s Ads Privacy & Terms.

7. Your Rights and Choices

You do not have to email us to see or delete your data. Both are built into the App.

7.1 Requesting a copy of your data

• In the Android app: Settings → Legal → Request Account Data. This shows you, in JSON, the account data our server keeps about you — your account identifier and email, your nickname and public ID, your lifetime puzzle and coin counters, your coin balance, and your private scoreboards.
• To save that copy as a file: Settings → Legal → Download my data in the web app at trifectaword.com, signed in to the same account. The Android app points you here, because it has nowhere to save a file to.

For your own protection, the copy never includes credentials: session tokens and Google ID tokens are never part of it.

The copy is short because the App itself keeps very little for very long. Scores, puzzle rounds and expired browser sessions are deleted within a day of the day they belong to, and the running records behind your coin balance are deleted on a rolling schedule once nothing in the game reads them any more. What lasts is what the game needs: your account, your lifetime counters, your balance, the items you own and the scoreboards you are part of. Nothing is kept simply because it might be interesting later.

7.2 Deleting your account and data

• In the Android app: Settings → Legal → Delete Account & Data.
• In the web app: Settings → Legal → Delete Account & Data.

Because it cannot be undone, we ask you to type the word "Delete" to confirm. Doing so permanently erases your account and everything attached to it — your account record, nickname and public ID, scores and puzzle history, coins and their ledger, unlocked and equipped items, hints, extra puzzles, rewards and tokens, donation totals, private scoreboards you own, and your memberships of other players’ boards — and signs you out of the App. Your device’s local copy of that progress is erased in the same step.

One thing survives: the archived daily top-three podiums you appeared on. Those record the result of a past day rather than describing you, so the entry stays, with your nickname replaced by a neutral placeholder and the link to your account removed. Nothing in it can be traced back to you.

Deleting your account also deletes the notification token of every device you had signed in on, and clears the analytics and crash-reporting identifiers held on the device you delete it from. If you lead a team, it dissolves the team for every member.

For the full step-by-step, including how to request deletion by email if you can no longer sign in, and exactly what is erased and what is kept, see Delete Your Account.

Deleting your account does not delete your Google account, and it does not affect the data Google holds under its own privacy policy.

7.3 Users in the EEA/UK/Switzerland (GDPR)

You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing based on legitimate interests. You have the right to lodge a complaint with your local data protection supervisory authority at any time.

7.4 Users in California (CCPA/CPRA) and other U.S. states

You have the right to know what personal information we collect, to request deletion, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information (which may include the use of advertising identifiers for personalized ads). We do not sell personal information for monetary payment. To opt out of ad personalization, use the controls described in Section 9, or contact us — we will not discriminate against you for exercising these rights.

7.5 All users

If you would rather not use the in-app controls, or you need something they do not cover, email us at [email protected] with the subject line "Privacy Request." We will respond within the time required by applicable law (generally within 30 days). You can also delete your locally stored data at any time by clearing the App’s data or uninstalling it.

8. Data Sharing

We do not sell personal information, and we do not share it with third parties for their own independent marketing purposes.

We may share data only:

• With the service providers listed in Section 6, as needed to operate the App;
• Publicly on the live and monthly scoreboards (nickname and score), if you choose to share a result;
• Publicly on scoreboards and rankings (nickname, monthly donation rank, and status badge), if you choose to donate coins to the monthly community leaderboard;
• With the other members of a private scoreboard you create or join (your nickname and your scores);
• To comply with legal obligations or valid legal requests;
• To protect rights, safety and security, and to prevent fraud;
• In connection with a merger, acquisition, or asset transfer (with notice where required).

9. Advertising Opt-Out

You can control ad personalization at any time:

• Reset or delete your Advertising ID and opt out of personalized ads in your device’s Settings → Google → Ads.
• Where applicable (EEA, UK, Switzerland), use the in-app consent form, reachable again from Settings → Legal → Ad Privacy Settings, to control ad personalization and data collection.
• In the browser, use your own cookie and tracking controls, and Google’s Ads Settings.

10. Children’s Privacy

The App is a general-audience word puzzle game and is not directed at children under 13 (or 16, in EEA member states that set a higher age of consent). We do not knowingly collect personal information from children under this age. If you believe a child has provided us with personal information, contact us and we will delete it.

11. Security

We use industry-standard measures (encrypted network connections, token-based authentication, server-side validation of scores and purchases of in-game items) to protect your information. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

12. International Data Transfers

Your information may be processed on servers located outside your country of residence, including in the European Union and the United States. Where required, we rely on appropriate safeguards (such as Standard Contractual Clauses) for such transfers.

13. Changes to This Privacy Policy

We may update this policy from time to time. Material changes will be reflected by updating the effective date above and, where required by law, an additional in-app notice.

14. Contact Us

Nikola Hristovski, North Macedonia. Email: [email protected]

Last updated: September 4, 2026