Privacy Policy

1. About this policy

This policy describes the Word Surge web and iOS versions that present this notice, including Daily, Endless, practice tutorials, nicknames, and online leaderboards where enabled. “We” refers to Ryan Crahan, the operator responsible for the player information described here. You can reach Ryan using the contact details below. This notice does not claim that an older mobile version used the same data practices.

2. Information the app uses

• Setup: before naming or initializing Firebase, the game asks you to select your age, agree to the Terms of Service, and acknowledge reading this Privacy Policy. Your exact age is processed on-device, then discarded. The device remembers only local/online play mode and the acknowledgment version, not your exact age or birth date. This is self-reported age screening, not verified age or parental consent. Reading this notice is not a blanket consent to other uses of your information.
• On-device play: an under-13 selection enables Daily and Endless without initializing Firebase, cloud profiles, cloud saves, or online leaderboard access. This mode skips name setup and saves progress and best scores in local browser/app storage. Names saved by earlier local builds may remain on the device, but this version does not display or use them. These local game records are not sent to Firebase.
• Online guest profile: after an age-13-or-older selection and acknowledgment, Firebase creates or restores a persistent player identifier. Your chosen display name and its normalized reservation are associated with that identifier. The app also records completion of name setup. Guest play is not the same as having no stored information.
• Game activity: the app can save puzzle dates, letter arrangements, solution words, elapsed time, checks and Xs, completion status, scores, personal bests, and record timestamps.
• Preferences: saved game state can include a performance preference. Tutorial moves are practice-only and are not saved to your score or Daily progress.
• Existing accounts: login and signup are currently hidden. If you created an account previously, Firebase may still hold the account information you supplied, such as an email address and authentication credentials.
• Service information: infrastructure providers receive information needed to deliver and secure requests, such as IP addresses and browser information. Firebase describes its authentication and hosting processing in its privacy and security disclosures.
• Messages you send: if you contact the operator, your message and reply address are needed to respond. Never send passwords or sign-in tokens.

3. Why information is used

Information is used to recognize returning players, restore available progress, maintain unique display names, calculate and display scores, run leaderboards, and protect the service from abuse. It is also used to respond to requests and resolve technical problems.

There are currently no ads or in-app purchases. This web and iOS version does not integrate advertising, payment, or analytics SDKs. Infrastructure providers still process technical service information as described below.

Advertising may be introduced later, but no advertising provider is active in this version. Before ads or materially different data uses begin, this notice will be updated with the relevant providers, information collected, purposes, sharing, and choices. Any required consent, including parental consent where applicable, must be obtained before the relevant collection or disclosure begins. Future advertising is not a use already authorized by accepting the Terms or reading this notice.

4. What other players can see

Your leaderboard name, rank, score, and, for Daily, time and X marks are visible to other players. The underlying score records and username reservations can also be read by authenticated visitors, including visitors automatically signed in as guests. Those records can include your player identifier, puzzle date, completion details, and timestamps.

Use a nickname rather than personal or sensitive information. Private puzzle-progress records are restricted to the corresponding player account by database access rules, but leaderboard records are not private. Other people may copy publicly visible information.

Choosing Share copies your result to your clipboard or opens your device’s sharing interface. A destination you choose handles that information under its own policies.

Google Firebase provides the online infrastructure described below. Our support mailbox is provided through Gmail when you email us. Information may also need to be disclosed in response to a binding legal requirement or to address abuse, security incidents, or legal claims; any such handling must be limited to what is appropriate and required by applicable law.

5. Providers and browser storage

Your sound-effects preference is saved locally on your device so mute stays set after a reload. This preference is not sent to Firebase. Sound files are bundled with the game, not streamed from a third-party audio service.

Online play uses Google Firebase Authentication for player sessions and Cloud Firestore for saved data. The website uses Firebase Hosting; the current Firestore database location is in the United States, and Firebase Authentication processes data in the United States. Other provider processing may occur in countries where Google operates. See Firebase’s privacy, processing-location and transfer information. This description is not an agreement to waive any protections or rights that apply to international transfers.

The iOS app packages its game, puzzle files and policy pages on the device. Opening the website or external links creates ordinary hosting requests, including when local play is selected on the web. Infrastructure providers can process IP addresses and request information, so local play is not a promise that every network or service log disappears.

Fonts, icons, and sounds are bundled with the updated web and iOS game. It no longer requests fonts from Google Fonts or icon code from UNPKG while playing.

For online play, Firebase stores authentication state in browser storage so a guest session can survive a reload. The updated game does not initialize Firebase or restore that session in on-device play. Your browser also caches site resources. Clearing site data removes local settings and saves and may remove access to a guest profile; it does not itself delete existing server records. See the Firebase session documentation.

The Terms and Privacy pages do not load the game’s authentication or database code. Their floating background particles run locally and do not read or store player information. Web delivery involves ordinary hosting requests and browser caching; the copies bundled in the iOS app can be read locally.

6. Keeping and protecting information

On-device saves keep today and yesterday's Daily records and the highest Endless score when the app next runs. The local play-mode decision stays in place across reloads; the app does not automatically upgrade it as a player gets older. Clearing local storage removes that decision and local saves. Existing cloud records created by older versions are not automatically deleted by choosing on-device play; contact the operator about those records.

The current build attempts to clean up a player's older records when that player opens the game or keeps it online and visible across midnight Eastern time. It keeps today's and yesterday's Daily scores and saved progress, and keeps the player's highest Endless score instead of separate older runs. A Daily started before midnight can finish afterward without switching puzzles.

This cleanup is performed by the game, not a server-wide scheduled deletion job. Older records can remain while a player is inactive, offline, using an older app version, or unable to access the same guest profile. Unrecognized records may need manual review. An owner-operated tool can also remove expired Daily score documents, but it is not an automatic midnight deletion service.

Profiles, reserved names and best scores support returning-player access and saved progress. There is currently no automatic inactivity expiry for those records: they remain unless the account is deleted or the records are otherwise removed. Score-history cleanup does not delete the account. Support emails are stored separately from game records and are not erased by the in-game Delete account button; there is currently no automatic deletion schedule for that mailbox. You can request deletion using the contact process below. Information required for a specific legal obligation or dispute may need to be retained to the extent the applicable law permits or requires.

Provider retention is separate from visible game records. Firebase states that Authentication IP logs last a few weeks, Hosting IP data lasts a few months, and other authentication data is removed from its live and backup systems within 180 days after customer-initiated user deletion. These provider periods are not a promise that all Word Surge records remain for 180 days, or that every category is deleted instantly. See Firebase’s current retention information.

The app uses authenticated access rules for private game records and HTTPS for hosted service connections. No online service can promise absolute security or uninterrupted access. Keep your device and session secure and report suspected unauthorized access using the contact details below.

7. Your choices and requests

In online play, you can change your display name by selecting the profile badge. Open the Settings gear at the bottom of the game and choose Delete account to remove the currently signed-in profile, its Daily and Endless score records, reserved names, and saved progress. A separate confirmation is required. Close other game tabs and devices first, and keep this session available until deletion finishes. If deletion is interrupted, retry from Settings; some records may already have been removed. Previously registered password accounts may need to confirm their password.

In on-device play, Delete account only clears local progress, any legacy saved nickname, and this device’s Word Surge settings; it does not access or delete historical cloud profiles. In both modes, completed deletion also clears the saved age-mode choice, policy acknowledgment, and sound preference. The game then refreshes automatically and begins age selection and setup again, without automatically creating a new online profile. A temporary deletion marker stores the online profile identifier while deletion is unfinished so the game can resume safely; the identifier is removed from that marker after completion, and the completion marker is cleared before the automatic refresh.

To request access to information about you, a correction, or deletion of your profile, associated records or support messages, email longshotstudiossupport@gmail.com. Describe the request and whether you use web or iOS. Keep the original guest session available if possible. We may ask for a proportionate way to verify control of the relevant profile before disclosing or deleting information; a public nickname or player identifier alone is not proof of ownership. Do not email passwords, sign-in tokens or identity documents.

Depending on where you live and the applicable conditions, you may also have rights to restrict or object to processing, receive a portable copy of your data, withdraw consent for processing based on consent, or complain to your local data-protection authority. Withdrawal does not make earlier lawful consent-based processing unlawful. We will respond within the time required by applicable law and explain any applicable exception, verification requirement or available complaint route if we cannot fulfil the request. These rights are not limited by the game’s Terms.

8. Children and age requirements

Word Surge is intended for players ages 9 and older, including children ages 9–12. The age screen is shown before online profile or name setup. Under 13 means local play; an age of 13 or older enables the online setup flow. Local players are not asked to choose a nickname, and this version does not initialize Firebase, create online profiles or submit their local gameplay records to leaderboards.

The game uses self-reported age screening, not verified age assurance. It does not implement verified parental consent. The setup checkbox and App Store content rating are not parental consent, and the online cutoff does not override any local legal requirements. Device storage can be cleared or altered, and full account deletion resets the saved age choice. Parents should help younger players select their actual age and understand the game.

A parent or guardian can email longshotstudiossupport@gmail.com to request review or deletion of a child’s information, ask that further collection or use stop, or report an online profile created for a child under 13. Describe the concern and keep the original device/session available if possible. We will take reasonable steps to verify the parent’s authority and identify the relevant records before giving access or making changes. Do not send passwords, identity documents or sign-in tokens.

Local Delete account clears this device, not any historical cloud profile created by an earlier version or a different age selection. Contact us about those records. The web-hosting information described above and any email you choose to send are separate from local game saves. This notice does not ask parents to authorize an under-13 online account or advertising.

9. Changes

The effective date above identifies this version of the policy. We will update the notice when our practices change and explain material changes through the game or another appropriate channel. Where required, we will provide additional notice and obtain consent before a new use begins. The setup screen may ask you to read a new version again; this does not reset your saved age mode or itself authorize new data uses.

10. Contact

Operator: Ryan Crahan

Location: Massachusetts, United States

Privacy and support: longshotstudiossupport@gmail.com

For privacy questions, data requests, or help with Word Surge, contact Ryan at the email above. Do not send passwords or sign-in tokens, or submit private account details in public GitHub issues.