Privacy Policy
Effective date: 15 March 2026 | Last updated: 11 June 2026
This privacy policy explains how ONE ONE FOUR PTY LTD ("we", "us", "our") collects, uses, stores, and protects your information when you use WordBattle (the "Service"), available at wordbattle.fun and via mobile applications.
1. Who we are
ONE ONE FOUR PTY LTD (ABN 14 695 785 098) is a software company registered in Queensland, Australia. We are the operator of WordBattle.
- Email: [email protected]
- Website: oneonefour.au
2. What we collect
2.0 Visitors and anonymous players
You may play the daily word puzzle without creating an account. When you do, we collect the following data:
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Game state (guesses and results) | Stored in your browser's local storage so you can continue playing across visits | Legitimate interest |
| Player identifier | A randomly generated identifier stored in your browser's local storage, used to persist your game history and to deduplicate anonymised analytics data. This identifier is never stored in our database. | Legitimate interest (game persistence and analytics deduplication) |
| Theme and colour preferences | Stored in cookies and local storage for consistent visual experience | Legitimate interest |
| Analytics data | Anonymised device, browser, and preference data as described in section 2.3 | Legitimate interest |
Cloudflare (our CDN and security provider) also processes your IP address and request headers as part of delivering the Service. Our error monitoring service (Sentry) may collect error data as described in section 5.
If you later create an account, your game history stored in your browser is linked to your new account as part of the registration process (see section 2.4).
2.1 Account information
When you create an account, we collect:
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Email address | Account identification, email verification, security notifications, password reset | Contractual necessity |
| Display name | Identification on leaderboards and within teams | Contractual necessity |
| Password | Account security (stored as a bcrypt hash - we never store your password in plain text) | Contractual necessity |
| Profile image | Optional personalisation (uploaded by you) | Consent |
2.2 Security data
When you sign in, we record security data linked to your account for the purpose of detecting unauthorised access and preventing abuse. This data is processed under our legitimate interest in ensuring the security and integrity of the Service (GDPR Article 6(1)(f)).
| Data | Details | Retention |
|---|---|---|
| Masked IP address | Last octet zeroed (IPv4) or last 80 bits zeroed (IPv6) before storage - your full IP address is never stored | 90 days |
| Browser and operating system | Derived from your browser's user agent string | 90 days |
| Device category | Desktop, mobile, or tablet - derived from screen size and device characteristics | 90 days |
| Screen and viewport dimensions | As reported by your browser | 90 days |
| User agent string | The full identification string sent by your browser | 90 days |
| Accept-Language header | The language preferences sent by your browser | 90 days |
| Timezone | As reported by your browser | 90 days |
| Country | Derived from your timezone | 90 days |
Security data is automatically deleted after 90 days.
2.3 Analytics data
We also record anonymised analytics data that cannot be linked back to your account or to any individual anonymous player. This data is collected from both logged-in and anonymous users. Each analytics record includes an indicator of whether the session was logged-in or anonymous, but is stored separately with no user identifier:
| Data | Details |
|---|---|
| Country | Derived from timezone |
| Browser name | e.g. Chrome, Safari, Firefox |
| Operating system | e.g. macOS, Windows, iOS |
| Device category | Desktop, mobile, or tablet |
| Screen size category | A general bucket (e.g. "mobile", "tablet", "laptop"), not exact pixel dimensions |
| Language | Primary language only |
| Timezone | As reported by your browser |
| System theme preference | Light or dark |
| App theme preference | Light, dark, or auto |
| Hue preference | Warm or cool |
Analytics data contains no user identifier, email address, IP address, or any other information that could identify you, whether you play with or without an account. No analytics record can be linked to any individual player. Analytics data is retained indefinitely to help us understand how WordBattle is used and to improve the Service.
2.4 Gameplay data
We store your gameplay history, including:
- Daily word guesses and results (including step history from the retired Word Ladder mode, where you played it before it was discontinued)
- Game statistics (games played, win rate, streak data)
- Team membership and team-level statistics
Gameplay data is associated with your account and is retained for the lifetime of your account.
If you played before creating an account, your game history stored in your browser may be linked to your new account upon registration or sign-in. This migration is performed at your request under contractual necessity (GDPR Article 6(1)(b)). Analytics records are not affected by account creation. They are always anonymous regardless of whether you play with or without an account (see section 2.3).
If your team owner enables a messaging integration (such as Slack, Discord, Telegram, or Microsoft Teams), your gameplay data may be sent to the configured messaging platform as part of team notifications. This includes your display name, game completion results (guess count and emoji grid), streak milestones, daily and weekly team summaries (participation rates, win rates, best-player highlights), and team membership events (such as joining a team). This data is sent to an external service controlled by your team owner, not by us. Once delivered, the data is subject to that platform's privacy policy and the team owner's workspace settings. You can see which integrations are active on your team page.
2.5 What we do NOT collect
- We do not use any third-party analytics or advertising services (such as Google Analytics)
- We do not use any advertising networks or tracking pixels
- We do not sell, rent, or trade your personal data to any third party
- We do not collect payment information (WordBattle is free to use)
We use a third-party error monitoring service (Sentry) to detect and fix technical problems. See section 5 for details of the data shared with this provider.
3. Cookies
We use a minimal number of cookies, all of which are strictly necessary or functional:
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
session | Keeps you signed in | Strictly necessary | 30 days |
theme | Remembers your light/dark preference for server-side rendering | Functional | 1 year |
hue | Remembers your colour temperature preference (warm/cool) for server-side rendering | Functional | 1 year |
wb_guest | Set the first time you play without an account. A random value that lets us keep your puzzle progress on the server, so that the day's answer is only revealed once you have actually finished the game. Contains no personal information and is not used for tracking. | Strictly necessary | 30 days |
The following data is also stored in your browser's local storage:
| Item | Purpose | Type |
|---|---|---|
| Theme and colour preferences | Consistent visual experience on the client side | Functional |
| Returning user indicator | Remembers that you previously had an account, so we can prompt you to sign in rather than play as a guest. Not cleared when guest data is removed. | Functional |
Cloudflare (our CDN and security provider) may set additional cookies necessary for security and performance. These are strictly necessary cookies and do not track you across sites.
Our error monitoring service (Sentry) does not set cookies or use browser storage.
We do not use any advertising, analytics, or tracking cookies.
4. How we use your data
We use your data for the following purposes:
- Providing the Service - account management, gameplay, leaderboards, team features
- Security - detecting unauthorised access, preventing abuse, investigating suspicious activity
- Communications - we send the following types of email:
- Transactional emails (cannot be opted out of while your account is active): email verification, password reset, account lockout notifications, account deletion confirmation
- Service notifications (can be managed in your profile settings; enabled by default under our legitimate interest in providing the Service): achievement unlocks, milestone celebrations, team membership changes
- Marketing notifications (only sent with your express opt-in consent; can be withdrawn at any time via your profile settings or the unsubscribe link in any email): daily play reminders, weekly team digests, re-engagement emails for inactive players
- Analytics - understanding usage patterns, device and browser trends, geographic distribution (using anonymised, non-identifying data only)
- Team messaging integrations - if enabled by a team owner, we send team notifications (game completions, daily and weekly summaries, and membership events) containing display names, guess results, streaks, win rates, and participation data to the messaging platform configured by the team owner. This processing is carried out under our legitimate interest in providing team competition features (GDPR Article 6(1)(f)). Where summaries highlight individual performance (such as best player or longest streak), the display name you chose for the Service is used. You may object by leaving the team or by contacting us at [email protected].
- Legal compliance - responding to lawful requests, enforcing our terms of service
5. Who we share data with
We share data only with the following service providers, who process data on our behalf:
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Cloudflare | CDN, DNS, DDoS protection, TLS | Visitor traffic (IP addresses, headers) | Global (US-headquartered) |
| Hetzner | Server hosting and encrypted backup storage | All data (stored on our server). Encrypted backups are stored in the EU. | EU-headquartered (Germany; servers in US) |
| Postmark | Transactional and notification email delivery | Email address, email content | US-headquartered |
| Sentry | Error monitoring and crash reporting | Error details (stack traces, error messages), page URLs, browser and OS information, device category, interaction breadcrumbs (page navigations and button clicks leading up to an error). No account data, passwords, game guesses, or cookies are shared. | US-headquartered |
Our error monitoring service automatically collects recent user interactions (such as page navigations and button clicks) leading up to an error, to help us reproduce and fix technical problems. This data does not include text you type, your game guesses, or any account information. This processing is carried out under our legitimate interest in maintaining the reliability and security of the Service (GDPR Article 6(1)(f)).
Team messaging integrations
When a team owner configures a messaging integration (such as Slack, Discord, Telegram, or Microsoft Teams), we deliver team notifications to the webhook URL or bot configured by the team owner. These notifications include:
- Game completions - display name, guess count, emoji result grid, and callouts for notable achievements (fast solves, streak milestones)
- Daily summaries - each member's completion status and guess count, team win rate and participation rate
- Weekly recaps - team statistics, best player by average guesses, longest active streak holder
- Membership events - display name of members who join the team
We do not have a direct data processing agreement with these messaging platforms for webhook deliveries. The team owner is responsible for the data once it reaches their messaging workspace. Active integrations are visible to all team members on the team page.
| Provider | Purpose | Data shared | Location |
|---|---|---|---|
| Slack, Discord, Telegram, Microsoft Teams (as configured by team owner) | Team notifications | Display names, guess results, streaks, win rates, participation data | Varies by platform |
We do not sell, rent, or otherwise disclose your personal data to any other third party.
6. International transfers
WordBattle is operated from Australia. Your data may be processed in countries outside your jurisdiction, including the United States, through our use of Cloudflare, Hetzner, Postmark, and Sentry. Encrypted backups are stored on Hetzner infrastructure within the European Union. Where we transfer data internationally, we rely on recognised transfer mechanisms such as the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) included in our data processing agreements with these providers.
7. Data retention
| Data type | Retention period |
|---|---|
| Account information | Until you delete your account |
| Security data (login events) | 90 days (automatically purged) |
| Analytics data | Indefinitely (contains no personal data) |
| Gameplay data | Until you delete your account (anonymised upon deletion) |
| Notification preferences | Until you delete your account |
| Notification log | 90 days (automatically purged) |
| Consent records | Duration of your account + 3 years after consent withdrawal |
| Error monitoring data | 90 days (automatically purged by provider) |
| Webhook configuration | Until removed by team owner or team deletion |
| Webhook send log | 90 days (automatically purged) |
| Guest puzzle progress | 30 days (automatically purged), or deleted immediately when imported into a new account |
| Backups | 30 days (automatically purged) |
8. Account deletion
8.1 Anonymous players
If you use the Service without creating an account, we do not hold your name, email address, or any other identifying information. When you make your first guess we set a wb_guest cookie containing a random value, and store your guesses for that puzzle against it on our servers. This is necessary to run the game fairly: the day's answer is released only once the server has recorded that your game is over. That progress is deleted automatically after 30 days, and immediately if you create an account and import it. Deleting the cookie through your browser settings ends our ability to link the remaining records to you.
A separate indicator that remembers you previously had an account is stored in your browser's local storage and is not removed when guest data is cleared; you can remove it by clearing all site data in your browser settings. Anonymous analytics records cannot be retrieved, exported, or deleted as they contain no link to your identity.
8.2 Account holders
You may delete your account at any time from your profile settings. When you delete your account:
- Your email address, display name, and profile image are permanently erased
- Your password hash is deleted
- All security data (login events) and active sessions are deleted
- Your gameplay history is retained in anonymised form to preserve team statistics and leaderboard integrity, but can no longer be linked to you or any identifiable person. Your display name is replaced with "Former Player" on leaderboards and in team views.
- Analytics data requires no deletion as it contains no link to your identity
Encrypted backups may temporarily retain personal data for up to 30 days after account deletion for disaster recovery purposes. Backups older than 30 days are automatically deleted. In the event a backup is restored, any account deletions that occurred after the backup date are automatically re-applied.
9. Data export
You may request an export of your personal data at any time from your profile settings. The export includes your profile information, gameplay history, and login events in a machine-readable JSON format.
10. Your rights
Depending on your jurisdiction, you may have the following rights:
- Access - request a copy of the personal data we hold about you
- Correction - request that we correct inaccurate personal data
- Deletion - request that we delete your personal data (see section 8)
- Portability - receive your personal data in a structured, machine-readable format (see section 9)
- Objection - object to our processing of your personal data
- Restriction - request that we restrict processing of your personal data
- Withdraw consent - where we process data based on your consent (e.g. profile image), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.
10.1 Complaints
If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a supervisory authority:
- Australian residents - Office of the Australian Information Commissioner (OAIC)
- EU/EEA residents - your local data protection authority
- All other jurisdictions - the relevant data protection or privacy authority in your country of residence, where applicable
11. Children
WordBattle is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16, in accordance with the EU General Data Protection Regulation (GDPR) and the US Children's Online Privacy Protection Act (COPPA). If we become aware that a user is under 16, we will promptly delete their account and associated data.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].
12. Security
We implement appropriate technical and organisational measures to protect your personal data, including:
- Passwords hashed with bcrypt (cost factor 12)
- Session tokens stored as SHA-256 hashes
- IP addresses masked before storage (last octet zeroed)
- HTTPS encryption for all connections
- Content Security Policy, X-Frame-Options, and other security headers
- Timing-safe comparisons to prevent enumeration attacks
No system is completely secure. If you discover a security vulnerability, please report it to [email protected].
13. Changes to this policy
We may update this policy from time to time. If we make material changes, we will notify you by:
- Posting the updated policy on this page with a new effective date
- Displaying a notice within the Service
Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.
14. Contact
For privacy enquiries, data access requests, or complaints, contact us at:
- Email: [email protected]