Privacy Policy

Last Updated: August 6, 2024

1. Introduction

Welcome to Wordria ("we," "our," or "us"). We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website https://wordria.com (the "Service") and play our online word game.

By using the Service, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with this policy, please do not use our Service.

2. Information We Collect

2.1 Information You Provide to Us

Data Type	When Collected	Purpose
Email Address	Account registration or Google Sign-In	Account identification, communication
Username	Account registration	Public display name in games
Password (hashed)	Account registration	Account security (never stored in plain text)
Profile Picture	Google Sign-In	Display in game and profile
Game Data	During gameplay	Words played, scores, game history

2.2 Information Collected Automatically

Data Type	How Collected	Purpose
IP Address	Server logs	Security, fraud prevention, consent records
Browser Type & Version	HTTP headers	Compatibility optimization
Device Information	User Agent string	Mobile/desktop optimization
Game Statistics	Gameplay tracking	ELO rating, matchmaking
Cookie Preferences	Consent banner	Remember consent choices
LocalStorage Data	Browser storage	Game state, dictionary cache

2.3 Google Sign-In Data

When you sign in using Google OAuth, we receive the following information from Google:

Email address - Used as your primary account identifier
Full name - Displayed on your profile
Profile picture URL - Displayed as your avatar
Google Account ID - Used for authentication linking

We use Google's openid, userinfo.email, and userinfo.profile scopes only. We do not access your Google Drive, contacts, calendar, or any other Google services.

3. Cookies and Tracking Technologies

3.1 Essential Cookies

These cookies are necessary for the Service to function and cannot be disabled:

Cookie Name	Purpose	Duration
`PHPSESSID`	Server session management	Session (until browser closes)
`wordria_consent`	Cookie consent preferences	365 days
`wordria_token`	JWT authentication token	12 hours (game session)

3.2 Functional Cookies (LocalStorage)

Storage Key	Purpose	Type
`wordria_saved_game`	Save ongoing game state	LocalStorage
`wordria_dictionary_v1`	Dictionary word list cache	LocalStorage
`wordria_ai_difficulty`	AI difficulty preference	LocalStorage
`wordria_boards`	Multi-board management	LocalStorage

3.3 Consent Records

When you accept our cookie policy, we store a record in our database with:

Your IP address (for legal compliance)
Consent timestamp
Which categories you accepted (essential, analytics, marketing)
User agent (browser information)

This record is stored in the wordria_consent database table.

4. How We Use Your Information

Purpose	Data Used	Legal Basis
Account creation & management	Email, username, password	Contractual necessity
Gameplay functionality	Game moves, scores, board state	Contractual necessity
Matchmaking & ELO rating	Game statistics, win/loss record	Legitimate interest
Anti-cheat & fraud prevention	IP address, game patterns	Legitimate interest
Service improvement	Aggregated gameplay statistics	Legitimate interest
Legal compliance (GDPR, CCPA)	Consent records, IP logs	Legal obligation

                тЪая╕П What We DO NOT Do
                We do NOT sell your personal data to third parties
We do NOT use your data for advertising purposes
We do NOT track you across other websites
We do NOT collect data from children under 13 (GDPR: under 16)
We do NOT process sensitive personal data (race, religion, health, etc.)

            

5. Data Storage and Security

5.1 Where Your Data is Stored

Data Type	Storage Location	Retention Period
Account information	MySQL Database (cPanel hosting)	Until account deletion
Game history	MySQL Database	Indefinitely (for leaderboards)
Consent records	MySQL Database	5 years (legal requirement)
Game state (solo mode)	Browser LocalStorage	Until cleared by user or 24 hours
Dictionary cache	Browser LocalStorage	7 days (auto-refresh)
JWT Session Token	Browser LocalStorage	12 hours (game) / 7 days (refresh)

5.2 Security Measures

Passwords are hashed using bcrypt (never stored in plain text)
JWT tokens are signed with HMAC-SHA256
Database credentials stored outside public web root
All traffic encrypted via HTTPS (SSL/TLS)
API rate limiting to prevent abuse
Input validation and SQL injection prevention (PDO prepared statements)
CORS headers restrict cross-origin access
Security headers: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection

6. Third-Party Services

Service	Purpose	Data Shared	Their Privacy Policy
Google OAuth	Social login	Google Account ID, email, name, avatar	Google Privacy Policy
Free Dictionary API	Word definitions	Queried word (not linked to user)	Dictionary API
cPanel Hosting	Server infrastructure	All server-side data	Hosting provider policy

We do not use any analytics services (Google Analytics, Facebook Pixel), advertising networks, or third-party tracking scripts on Wordria.

7. Your Rights (GDPR & CCPA)

7.1 GDPR Rights (EU/EEA Users)

Right to Access: Request a copy of your personal data
Right to Rectification: Correct inaccurate data
Right to Erasure: Request deletion of your data
Right to Restrict Processing: Limit how we use your data
Right to Data Portability: Receive your data in JSON format
Right to Object: Object to processing based on legitimate interest
Right to Withdraw Consent: Withdraw cookie consent at any time

7.2 CCPA Rights (California Users)

Right to Know: What personal data we collect and share
Right to Delete: Request deletion of personal data
Right to Opt-Out: We do not sell data, so opt-out is inherent
Right to Non-Discrimination: No penalty for exercising your rights

To exercise any of these rights, contact us at info@wordria.com. We will respond within 30 days (GDPR requirement).

8. Children's Privacy

Wordria is not intended for children under the age of 13 (or 16 in the EU). We do not knowingly collect personal information from children. If you believe a child has provided us with personal data, please contact us immediately at info@wordria.com and we will delete it.

9. Data Breach Policy

In the event of a data breach, we will:

Notify affected users within 72 hours (GDPR requirement)
Notify the relevant supervisory authority
Provide details of the breach and steps taken to mitigate it
Reset all affected passwords and tokens

10. International Data Transfers

Wordria is hosted on servers located in Istanbul. If you access our Service from outside this location, your data may be transferred to and processed in this jurisdiction. By using the Service, you consent to this transfer.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by:

Posting the new Privacy Policy on this page
Updating the "Last Updated" date at the top
For material changes, displaying a notice on the website

Continued use of the Service after changes constitutes acceptance of the new policy.

12. Contact Information

Data Controller

Wordria
Email: info@wordria.com
Website: https://wordria.com
Privacy Policy: https://wordria.com/agreements/privacy-policy

For GDPR-related inquiries, you may contact our Data Protection Officer at info@wordria.com.

You have the right to lodge a complaint with your local data protection supervisory authority.