Privacy Policy

1. Who we are

ONE ONE FOUR PTY LTD (ABN 14 695 785 098) is a software company registered in Queensland, Australia. We are the operator of WordBattle.

• Email: [email protected]
• Website: oneonefour.au

2. What we collect

2.0 Visitors and anonymous players

You may play the daily word puzzle without creating an account. When you do, we collect the following data:

Cloudflare (our CDN and security provider) also processes your IP address and request headers as part of delivering the Service. Our error monitoring service (Sentry) may collect error data as described in section 5.

If you later create an account, your game history stored in your browser is linked to your new account as part of the registration process (see section 2.4).

2.1 Account information

When you create an account, we collect:

When you dismiss an in-app announcement while signed in, we store its identifier and the dismissal time against your account. This remembers your choice across browsers and devices. We do not record announcement views or whether you read the notice.

2.2 Security data

When you sign in, we record security data linked to your account for the purpose of detecting unauthorised access and preventing abuse. This data is processed under our legitimate interest in ensuring the security and integrity of the Service (GDPR Article 6(1)(f)).

Security data is automatically deleted after 90 days.

2.3 Analytics data

We also record anonymised analytics data that cannot be linked back to your account or to any individual anonymous player. This data is collected from both logged-in and anonymous users. Each analytics record includes an indicator of whether the session was logged-in or anonymous, but is stored separately with no user identifier:

Analytics data contains no user identifier, email address, IP address, or any other information that could identify you, whether you play with or without an account. No analytics record can be linked to any individual player. Analytics data is retained indefinitely to help us understand how WordBattle is used and to improve the Service.

2.4 Gameplay data

We store your gameplay history, including:

• Daily word guesses and results (including step history from the retired Word Ladder mode, where you played it before it was discontinued)
• Game statistics (games played, win rate, streak data)
• Team membership and team-level statistics
• Daily and weekly battle results, earned awards and team award streaks

Gameplay data is associated with your account and is retained for the lifetime of your account.

If you played before creating an account, your game history stored in your browser may be linked to your new account upon registration or sign-in. This migration is performed at your request under contractual necessity (GDPR Article 6(1)(b)). Analytics records are not affected by account creation. They are always anonymous regardless of whether you play with or without an account (see section 2.3).

If your team owner enables a messaging integration (such as Slack, Discord, Telegram, or Microsoft Teams), your gameplay data may be sent to the configured messaging platform as part of team notifications. This includes your display name, game completion results (guess count and emoji grid), streak milestones, daily and weekly team summaries (participation rates, win rates, best-player highlights), and team membership events (such as joining a team). This data is sent to an external service controlled by your team owner, not by us. Once delivered, the data is subject to that platform's privacy policy and the team owner's workspace settings. You can see which integrations are active on your team page.

2.5 Retired Team Banter

Team Banter has been retired and no new Banter records are collected. Existing preset messages and reactions are automatically deleted 30 days after creation. Any existing mute preferences remain until the team or account is deleted. Your retained Banter records remain available in your personal data export and are removed when you delete your account.

2.6 What we do NOT collect

• We do not use any third-party analytics or advertising services (such as Google Analytics)
• We do not use any advertising networks or tracking pixels
• We do not sell, rent, or trade your personal data to any third party
• We do not collect payment information (WordBattle is free to use)

We use a third-party error monitoring service (Sentry) to detect and fix technical problems. See section 5 for details of the data shared with this provider.

3. Cookies

We use a minimal number of cookies, all of which are strictly necessary or functional:

The following data is also stored in your browser's local storage:

Cloudflare (our CDN and security provider) may set additional cookies necessary for security and performance. These are strictly necessary cookies and do not track you across sites.

Our error monitoring service (Sentry) does not set cookies or use browser storage.

We do not use any advertising, analytics, or tracking cookies.

4. How we use your data

We use your data for the following purposes:

• Providing the Service - account management, gameplay, leaderboards, team features
• Security - detecting unauthorised access, preventing abuse, investigating suspicious activity
• Communications - we send the following types of email:
  • Transactional emails (cannot be opted out of while your account is active): email verification, password reset, account lockout notifications, account deletion confirmation
  • Service notifications (can be managed in your profile settings; enabled by default under our legitimate interest in providing the Service): achievement unlocks, milestone celebrations, team membership changes
  • Marketing notifications (only sent with your express opt-in consent; can be withdrawn at any time via your profile settings or the unsubscribe link in any email): daily play reminders, weekly team digests, re-engagement emails for inactive players
• Analytics - understanding usage patterns, device and browser trends, geographic distribution (using anonymised, non-identifying data only)
• Team messaging integrations - if enabled by a team owner, we send team notifications (game completions, daily and weekly summaries, and membership events) containing display names, guess results, streaks, win rates, and participation data to the messaging platform configured by the team owner. This processing is carried out under our legitimate interest in providing team competition features (GDPR Article 6(1)(f)). Where summaries highlight individual performance (such as best player or longest streak), the display name you chose for the Service is used. You may object by leaving the team or by contacting us at [email protected].
• Legal compliance - responding to lawful requests, enforcing our terms of service

5. Who we share data with

We share data only with the following service providers, who process data on our behalf:

Our error monitoring service automatically collects recent user interactions (such as page navigations and button clicks) leading up to an error, to help us reproduce and fix technical problems. This data does not include text you type, your game guesses, or any account information. This processing is carried out under our legitimate interest in maintaining the reliability and security of the Service (GDPR Article 6(1)(f)).

Team messaging integrations

When a team owner configures a messaging integration (such as Slack, Discord, Telegram, or Microsoft Teams), we deliver team notifications to the webhook URL or bot configured by the team owner. These notifications include:

• Game completions - display name, guess count, emoji result grid, and callouts for notable achievements (fast solves, streak milestones)
• Daily summaries - each member's completion status and guess count, team win rate and participation rate, daily Crown and Clown awards, and Castle or Circus awards for three consecutive team titles. Daily ranks, scores and awards are visible to teammates once everyone has finished or the daily window closes. Awards may appear in daily summaries.
• Weekly recaps - completed weekly battle standings, champions, points, games played and won, team win rate, and weekly achievement highlights, including badges for setbacks and funny results. All earned weekly badges are visible to teammates after the daily window closes and may appear in recaps. Messages already delivered remain in the external workspace.
• Membership events - display name of members who join the team

We do not have a direct data processing agreement with these messaging platforms for webhook deliveries. The team owner is responsible for the data once it reaches their messaging workspace. Active integrations are visible to all team members on the team page.

We do not sell, rent, or otherwise disclose your personal data to any other third party.

6. International transfers

WordBattle is operated from Australia. Your data may be processed in countries outside your jurisdiction, including the United States, through our use of Cloudflare, Hetzner, Postmark, and Sentry. Encrypted backups are stored on Hetzner infrastructure within the European Union. Where we transfer data internationally, we rely on recognised transfer mechanisms such as the EU-US Data Privacy Framework and Standard Contractual Clauses (SCCs) included in our data processing agreements with these providers.

7. Data retention

8. Account deletion

8.1 Anonymous players

If you use the Service without creating an account, we do not hold your name, email address, or any other identifying information. When you make your first guess we set a wb_guest cookie containing a random value, and store your guesses for that puzzle against it on our servers. This is necessary to run the game fairly: the day's answer is released only once the server has recorded that your game is over. That progress is deleted automatically after 30 days, and immediately if you create an account and import it. Deleting the cookie through your browser settings ends our ability to link the remaining records to you.

A separate indicator that remembers you previously had an account is stored in your browser's local storage and is not removed when guest data is cleared; you can remove it by clearing all site data in your browser settings. Anonymous analytics records cannot be retrieved, exported, or deleted as they contain no link to your identity.

8.2 Account holders

You may delete your account at any time from your profile settings. When you delete your account:

• Your email address, display name, and profile image are permanently erased
• Your password hash is deleted
• All security data (login events) and active sessions are deleted
• Your announcement dismissal records are deleted
• Your retained records from retired Team Banter, including legacy mute preferences, are deleted
• Your gameplay history is retained in anonymised form to preserve team statistics and leaderboard integrity, but can no longer be linked to you or any identifiable person. Your display name is replaced with "Former Player" on leaderboards and in team views.
• Analytics data requires no deletion as it contains no link to your identity

Encrypted backups may temporarily retain personal data for up to 30 days after account deletion for disaster recovery purposes. Backups older than 30 days are automatically deleted. In the event a backup is restored, any account deletions that occurred after the backup date are automatically re-applied.

9. Data export

You may request an export of your personal data at any time from your profile settings. The export includes your profile information, gameplay history, login events, announcement dismissals, and any of your retained records from retired Team Banter in a machine-readable JSON format. Other players' Banter records are excluded.

10. Your rights

Depending on your jurisdiction, you may have the following rights:

• Access - request a copy of the personal data we hold about you
• Correction - request that we correct inaccurate personal data
• Deletion - request that we delete your personal data (see section 8)
• Portability - receive your personal data in a structured, machine-readable format (see section 9)
• Objection - object to our processing of your personal data
• Restriction - request that we restrict processing of your personal data
• Withdraw consent - where we process data based on your consent (e.g. profile image), you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

10.1 Complaints

If you are not satisfied with our response to a privacy concern, you have the right to lodge a complaint with a supervisory authority:

• Australian residents - Office of the Australian Information Commissioner (OAIC)
• EU/EEA residents - your local data protection authority
• All other jurisdictions - the relevant data protection or privacy authority in your country of residence, where applicable

11. Children

WordBattle is not intended for users under the age of 16. We do not knowingly collect personal data from children under 16, in accordance with the EU General Data Protection Regulation (GDPR) and the US Children's Online Privacy Protection Act (COPPA). If we become aware that a user is under 16, we will promptly delete their account and associated data.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at [email protected].

12. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Passwords hashed with bcrypt (cost factor 12)
• Session tokens stored as SHA-256 hashes
• IP addresses masked before storage (last octet zeroed)
• HTTPS encryption for all connections
• Content Security Policy, X-Frame-Options, and other security headers
• Timing-safe comparisons to prevent enumeration attacks

No system is completely secure. If you discover a security vulnerability, please report it to [email protected].

13. Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by:

• Posting the updated policy on this page with a new effective date
• Displaying a notice within the Service

Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.

14. Contact

For privacy enquiries, data access requests, or complaints, contact us at:

• Email: [email protected]