Privacy Policy

Who is responsible

WordBan (wordban.io) is provided by ZENKOJI WORKS LTDA, a Brazilian company registered under CNPJ 65.424.972/0001-59, which is the controller of the personal data processed in the game.

For any privacy matter, including exercising your rights, write to hello@quickrefs.com. This is also the contact for our data protection officer.

What data we use

• Nicknamethe name you type to join a room (up to 20 characters). It is shown to the people in the same room. Use a nickname: there is no need, and we don't recommend, using your full name.
• Guest identifiera random code created automatically when you open the game. It lets you get back into the same room if your connection drops, and it doesn't reveal who you are.
• Game dataroom, team, color, points, guesses you type and cards played, plus the time of your device's last signal, used to tell whether you dropped out of the game.
• Technical dataIP address, browser and device type, and access logs, received by the services that host and protect the game.
• Usage statisticsonly if you accept in the cookie banner: pages visited (without the room code), device and browser type, language, approximate country and city, where the visit came from and a random identifier stored in a cookie. It does not use your nickname or match contents and does not identify you.
• Error reportswhen something breaks, we record what went wrong (page, browser, operating system and technical details of the error), without your IP address, cookies or nickname.
• Card reportswhen you report a card, we keep only the card and the reason, with no data about who reported it.
• Contact messagesif you write to us through the contact page: name, email, WhatsApp (if you give it), subject, message and any images you attach. Images are shrunk on your device before sending, which removes location and camera data.

To play, we don't ask for your email, phone number, date of birth, location or photos, nor for access to your camera or microphone. We only ask for a name and email if you want to reach us through the contact page. We don't use advertising cookies. We only measure how the game is used, with Google Analytics, if you accept in the cookie banner.

What we use it for

• To make the game work: creating and joining rooms, showing the game live to everyone, keeping score and reconnecting you if your internet drops.
• To protect the game from abuse: stopping bots, spam and attempts to guess room codes, with an invisible CAPTCHA and attempt limits.
• To reply to people who write to us through the contact page.
• To find and fix errors and improve performance.
• To understand how the game is used, so we can improve it, only if you accept usage statistics.
• To improve the cards, using totals of hits, passes and taboos for each card, not linked to any player.

We never sell or share data that identifies you, and we don't use it for personalized advertising.

Anonymized data

We may turn usage and access data into anonymized, aggregated information that doesn't identify any person and can't be traced back to anyone, even when combined with other information. For example: how many games were played, in which languages, countries and times of day, how long they last and how the cards performed.

We may use this information in reports, research and for commercial purposes, including sharing it with partners and advertisers. Because it is no longer personal data, it isn't subject to the deletion periods in this policy (GDPR recital 26 and art. 12 of the LGPD).

Legal bases

We process this data to provide the game you chose to use (performance of a contract: art. 6(1)(b) GDPR and art. 7, V, of Brazil's LGPD) and based on our legitimate interest in keeping the game safe, stable and free from abuse, in replying when you contact us and in producing anonymized statistics (art. 6(1)(f) GDPR and art. 7, IX, LGPD), always respecting your rights and expectations.

Usage statistics (Google Analytics) are only measured with your consent (art. 6(1)(a) GDPR and art. 7, I, LGPD), which you can decline or withdraw at any time without losing anything in the game.

How long we keep it

• Rooms, nicknames, teams, points and guesses: deleted automatically 24 hours after the room's last activity.
• Guest identifier: deleted after 7 days without use.
• Attempt-limit records: deleted after 1 day.
• Contact messages: not stored on the website. They arrive in our email inbox and are kept for as long as needed to handle your request and meet legal obligations.
• Error reports: deleted automatically by the monitoring service within 90 days.
• Usage statistics (Google Analytics): kept for up to 14 months, and only exist if you accepted.
• Technical access logs kept by our hosting and security providers: kept for the short period each provider sets, for security and troubleshooting.
• Card statistics, reports and other anonymized data: kept with no time limit, because they don't identify anyone.

Who we share it with

We use a few providers, who process data only to provide their service to us, under contract and their own policies:

• Supabasedatabase, guest login and real-time communication. Game data is stored on servers in São Paulo, Brazil.privacy policy →
• Vercelwebsite hosting and page delivery, with servers in the United States and other countries.privacy policy →
• Cloudflareinvisible CAPTCHA (Turnstile), which checks that whoever joins is a person and not a bot. It analyzes technical browser signals and the IP address.privacy policy →
• Resenddelivery of contact page messages to our email inbox.privacy policy →
• Sentryerror monitoring, with data stored in the European Union (Germany).privacy policy →
• Google Analyticsusage statistics for the game, only with your consent and without personalized ads. Data may be processed in the United States and other countries.privacy policy →

We may also share data when required by law or by a competent authority.

The “Buy me a coffee” button leads to a third-party website with its own privacy policy. Nothing is sent to it while you're just playing.

International transfers

Some of these providers process data outside Brazil, for example in the United States and the European Union. In these cases, transfers follow the safeguards provided for in the LGPD and the GDPR, such as standard contractual clauses.

What stays on your device

• Your nickname, so you don't have to type it again.
• Your guest session, so the game recognizes your device.
• The room open in each tab, so you go straight back to it if you reload the page.
• A cookie with your chosen language.
• If you accept usage statistics: Google Analytics cookies (_ga and _ga_*), lasting up to 2 years.
• Your choice about usage statistics.

Except for the Google Analytics cookies and your choice about them, all of these are needed for the game to work. You can delete them at any time in your browser settings: the game still works, but it will ask for your nickname again. To change your choice about usage statistics, use the button at the end of this page.

Children and teenagers

WordBan can be played with family and in the classroom. Since we don't ask for identifying data, we recommend that children use only a nickname and play with a parent, guardian or teacher around. Any data about children and teenagers is handled in their best interest, as the law requires.

Your rights

At any time, you can: confirm whether we process your data and access it; correct it; ask for it to be anonymized, blocked or deleted; ask for portability; find out who we share it with; and object to processing. If you are in the European Union, you also have the rights provided by the GDPR, such as restricting processing.

Because the game doesn't ask for your real name or email, we often can't tell which data is yours. To help, include in your email the room code, the nickname you used and the day you played. And remember that almost everything is deleted automatically within 24 hours.

If you're not satisfied with our answer, you can complain to Brazil's National Data Protection Authority (ANPD) or to the data protection authority in your country.

Security

We use encrypted connections (HTTPS), database access rules that stop a player from seeing data from other rooms, bot protection and attempt limits. No system is 100% secure, but we work to protect data and act quickly if something happens.

Changes to this policy

If we change how we handle data (for example, by adding ads), we'll update this page and the date at the top before the change, and ask for your consent where the law requires it.