Privacy Policy

1. Who we are

Word Waypoint is operated by Bytevia Limited, the data controller for the processing described in this policy.

We are registered with the UK Information Commissioner's Office (ICO) as a data controller. This policy is written under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018; where you play from the European Economic Area, the EU GDPR applies equivalently.

2. What we don't collect unless you choose online features

The game is fully playable offline with no sign-up. Unless you use optional online backup or sign in, we do not collect:

• your name, email address, phone number or postal address;
• your precise or approximate location;
• your contacts, photos, files, calendar or messages;
• audio or video recordings — the game only plays sound effects and never records;
• health, financial or any special-category data;
• anything you type outside the game.

If you optionally link Google or Apple sign-in for cloud backup, we receive the display name and email address those providers share with us (see Online backup & leaderboard). We also do not sell personal data, and we do not send marketing emails or push notifications — the game has one optional local reminder and nothing else.

3. Data stored on your device

Your game data is stored locally on your device and does not pass through any server of ours. It includes your level progress and stars, statistics (puzzles solved, streaks), claimed stamps, hint balance, settings (sound, haptics, accessibility options, reminder preference), and one-time flags such as whether you have finished the tutorial.

You can erase all of it at any time by clearing the app's data (Android: Settings → Apps → Word Waypoint → Storage → Clear data) or uninstalling the app. Your device's operating system may include this data in its normal device backups (Android Backup, iCloud device backup), which are governed by Google's and Apple's own terms.

Optional online backup

When online features are enabled in the app, your device registers an anonymous account on the Word Waypoint service (operated by Bytevia Limited). If you choose Back up now in Settings, a snapshot of your progress is stored on our servers so you can restore it on a new phone. The snapshot contains only game data (levels, stars, settings, hints) — not your contacts or location. Signing in with Google or Apple links that anonymous account to your provider identity so the backup survives device changes. Online backup is optional; the game is fully playable without it.

4. Data processed by our partners

The partners below process data on their own infrastructure when you play. We have chosen configurations that minimise what they receive.

4.1 Advertising — Google AdMob

The free version of the game shows a limited number of ads through Google AdMob (Google LLC / Google Ireland Limited). To select and deliver ads, and to measure and prevent fraud, Google may process:

• your device's advertising identifier (Google Advertising ID or Apple IDFA);
• your IP address and coarse, IP-derived location (such as country);
• device and app information (model, operating system, app version, language);
• ad interaction data (which ads were shown, viewed or tapped).

How this works depends on your choices:

• In the UK and EEA, before any ad loads you are shown a consent message (Google's UMP framework). Personalised ads are served only if you consent; otherwise you receive non-personalised ads, which use no advertising profile. You can revisit and change this choice at any time in the game under Settings → Privacy & ad consent.
• On iOS, access to the advertising identifier additionally requires your permission through Apple's App Tracking Transparency prompt. If you decline, the identifier is not available to Google and ads are not personalised. The app also supports Apple's privacy-preserving SKAdNetwork for aggregate ad measurement.
• While an ad-free subscription is active, the game shows no ads at all and no advertising data is processed.

Ads are configured as not child-directed with a maximum ad content rating of "T" (teen). Google acts as an independent controller for ad serving; see How Google uses information from apps and the Google Privacy Policy.

4.2 Purchases — Apple, Google and RevenueCat

All purchases (the optional ad-free subscription and hint packs) are made through Apple's App Store or Google Play. Apple or Google is the merchant: they process your payment and hold your card details, which we never see or receive.

To know which purchases belong to your app installation (so an active subscription keeps working after a reinstall, and lapses when it should), we use RevenueCat, Inc. as a processor. RevenueCat receives a randomly generated, anonymous app-user identifier, purchase receipts and transaction metadata (product, price, currency, store country, timestamps) and the entitlement status derived from them. It receives no name, email or payment details. See the RevenueCat Privacy Policy.

4.3 Analytics — PostHog (EU)

To understand which levels are too hard and which features are used, the game sends a small set of anonymous gameplay events to PostHog, hosted in the European Union (eu.i.posthog.com). The complete event list:

• level_complete (level id, stars, mode, first clear)
• daily_complete (streak length)
• night_run_end, loop_run_end (depth reached)
• hint_spent (resulting balance), hints_granted (how many and from which source), adfree_stipend (daily subscriber hints)
• ad_shown (ad type and placement)
• purchase (product identifier, whether it was a subscription or a hint pack, and the price and currency shown by the store — never card or payment details, which we never receive)
• shop_viewed, hint_shop_viewed, adfree_viewed, adfree_offer_tapped, adfree_offer_dismissed (which storefronts were opened)
• review_prompted (what triggered the rating prompt)
• depot_graduated, onboarding_done (tutorial finished, and whether progress was restored)
• link_report (a word pairing you reported as wrong)
• content_downloaded (level-content bundle version)
• sign_in (provider, and whether an existing save was linked) and leaderboard_viewed — only ever sent if the optional online features are enabled; they are not active in the current release

Events carry a randomly generated identifier local to the analytics service plus basic device and app metadata attached by the SDK (device model, OS version, app version, language/locale, timezone). They contain no advertising identifiers and nothing that identifies you personally. See the PostHog Privacy Policy.

4.4 Crash reporting — Sentry (EU)

If the game crashes or hits an error, a crash report is sent to Functional Software, Inc. (Sentry), ingested in the European Union (Germany). Reports contain the technical stack trace, device model, operating system version, app version and the sequence of technical events leading to the crash. We have configured Sentry not to send default personal information (no IP-based user records are created). See the Sentry Privacy Policy.

4.5 Online backup & leaderboard — Word Waypoint service

When online features are enabled, Bytevia Limited operates a small backend that stores:

• an anonymous player identifier and a device credential (hashed on our servers);
• your optional cloud-save snapshot and leaderboard score (display name, total stars, Night Line best);
• if you link Google or Apple sign-in: the provider's subject identifier plus the display name and email address they share.

We use this data only to sync your progress, show leaderboard ranks, and let you delete your account. We do not use it for advertising. You can delete your server data in the app (Settings → Delete account & cloud data) or via our data deletion page.

5. Notifications

The optional daily reminder is generated locally on your device — there is no push-notification server, no push tokens, and no marketing messages. It is opt-in, limited to a single pending reminder at around 7 pm, and can be switched off in the game's settings or your device's notification settings at any time.

6. App permissions

The game plays short sound effects on your device and does not record audio or use the microphone. The optional daily reminder uses local notifications only — there is no push-notification server. On iOS, personalised ads may request permission through Apple's App Tracking Transparency prompt; on Android and in the UK/EEA, Google's consent message appears before ads load. The app requests no location, camera, contacts or photo-library permissions.

7. Legal bases for processing

8. International transfers

We prefer partners with UK/EU processing: analytics (PostHog) and crash reports (Sentry) are hosted in the European Union, which the UK recognises as providing adequate protection. Google, Apple and RevenueCat may process data in the United States and other countries; those transfers rely on the UK–US Data Bridge (the UK Extension to the EU–US Data Privacy Framework) and/or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, as applicable.

9. How long data is kept

• On-device game data — until you clear the app's data or uninstall.
• Cloud saves on our service — until you delete them in the app (Settings → Delete account & cloud data) or ask us via the deletion page.
• Crash reports — retained by Sentry for up to 90 days, then deleted.
• Analytics events — retained in PostHog for no longer than 12 months in identifiable-event form.
• Purchase and transaction records — retained for as long as needed to keep your entitlements working, and for up to 6 years where UK tax and accounting law requires it.
• Advertising data — retained by Google under its own published retention periods.
• Emails to support — kept for up to 24 months after the matter is closed, then deleted.

10. Children

Word Waypoint is intended for players aged 13 and over and is not directed at children. Ads are configured as not child-directed and capped at a "T" (teen) content rating. We do not knowingly collect personal data from children under 13; the game collects no age, name or contact details from anyone. If you believe a child under 13 has used the game in a way that involved personal data (for example through the ad consent flow), contact us at wordwaypoint@bytevia.app and we will help put it right.

11. Your rights

Under UK GDPR you have the right to:

• access the personal data held about you;
• rectify inaccurate data;
• erase data ("right to be forgotten") — see our data deletion page for the practical steps;
• restrict or object to processing, including any processing based on legitimate interests;
• data portability for data processed by consent or contract;
• withdraw consent at any time (for ads: Settings → Privacy & ad consent in the game), without affecting prior processing.

An honest practical note: most data our partners hold is keyed to random identifiers. If you use online backup, you can delete your server account directly in the app. Where we genuinely cannot identify which records are yours (for example anonymous purchase records at RevenueCat), UK GDPR (Article 11) may limit what we can retrieve — but we will always tell you what is and isn't possible and help you use the controls that do work (described on the deletion page).

To exercise any right, email wordwaypoint@bytevia.app. We respond within one month. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office — ico.org.uk/make-a-complaint, helpline 0303 123 1113 — or to your local EEA authority if you are outside the UK.

12. Managing your choices

• Change or withdraw ad consent — in the game: Settings → Privacy & ad consent (shown wherever the consent framework applies).
• Remove ads entirely — an active ad-free subscription switches all advertising off.
• Reset or delete your advertising ID — Android: Settings → Privacy → Ads. iOS: Settings → Privacy & Security → Tracking (and Apple Advertising).
• Turn off the daily reminder — in the game's settings or your device's notification settings.
• Delete cloud saves or game data — see the data deletion page.

13. This website

This website (wordwaypoint.bytevia.app) is a static site. It sets no cookies, runs no analytics or trackers, and loads no third-party resources — even the fonts are served from this domain. Our hosting provider may keep short-lived technical server logs (IP address, requested page, user agent) for security and operations, as virtually all web hosting does.

14. Changes to this policy

If we change what data is processed — for example by adding or removing a partner — we will update this page and the "Last updated" date above, and for significant changes we will highlight the change in the app's release notes. Earlier versions are available on request.

15. Contact us

Questions, concerns or requests about privacy: