Letters Fall, Words Form privacy policy.

01Data controller

02Data we collect

Letters Fall, Words Form is a single-player word game. Almost everything it knows about you stays on your phone. What does leave it is described below.

Kept on your device, never sent to us:

• →Your saved games — up to three in each game mode
• →Your lifetime dictionary of the words you have scored, and their definitions
• →Your collections progress and your badges
• →Your settings: theme, board style, hint style, sound and vibration
• →The diagnostics report (About → Diagnostics), which leaves the device as a whole only if you copy it and send it to us. If Anonymous analytics is on, the errors in it are also sent as error reports (see below)

Uninstalling the app removes all of this from your phone. One caveat: if backup is switched on in your Android settings, as it usually is, Android also keeps a copy in your Google account and puts it back when you reinstall the game or set up a new phone. We can’t see that copy. You can turn backup off, or delete the copy, in your phone’s Google settings.

Usage statistics, sent to us: a small number of events describing how the app is used — when it opens, when a game starts and ends, the level reached, how many words were found, which panels were opened, and which settings are in use. They are tied to a random identifier generated on your device the first time the app runs. It is not your name, your email address, your phone number, your Google account or your advertising ID, and we cannot use it to contact you or to recognise you anywhere else. The setting for this in the app is called Anonymous analytics. Anonymous here means we can’t tell who you are from the data. It doesn’t mean there is no identifier at all: the random ID is what keeps one phone’s events together, and it is also the only way we can find yours if you ask us to delete them (see §05).

The same switch covers error reports. When something in the app goes wrong, we send the error message and where in the app’s code it happened, with web addresses shortened and anything that looks like a key or a saved game removed; the app version, and whether it is a test build; and the level and game mode you were on. Every event, error reports included, also carries a random identifier for the current session of use, made on your device each time the app starts and again after half an hour away from it, so we can tell one problem seen twice from two problems.

Google Play Games. When you open the game, Google Play Games may sign you in by itself and show a short welcome message. That happens between your phone and Google, before you have answered anything in the game, and we don’t read or keep anything from it unless you turn Google Play Games on. Google’s Play Games software in the app also sends Google its own usage and diagnostic data, under Google’s privacy policy. If you turn Google Play Games on, we send Google your leaderboard scores and the achievements you unlock, and we save a backup to your Play Games account: your word list, your statistics, your settings, and a record of what you have already seen in the game (tips and definitions, for example) so it isn’t shown to you twice. The game also reads your Play Games player ID and public display name, both of which come from Google, and keeps the ID on your phone so it can tell if a different Google account signs in. We ask once, and you can switch it off at any time in the menu.

Advertising data, handled by Google: to show ads, measure them and prevent fraud, Google’s ad software in the app collects your device’s advertising ID and app set ID, your IP address (which can indicate your general location), information about your device and how the app is performing, and how you interact with the ads. We do not receive any of it.

Purchases. When you buy something, Google Play takes the payment. RevenueCat, the service we use to manage purchases, receives the purchase record from Google Play — what was bought, when, the price and currency, and Google’s purchase token — together with an identifier for you: a random one made by the app, or your Play Games player ID if Google Play Games is on, so that a purchase can follow you to a new phone. RevenueCat checks the purchase with Google and tells the app what to unlock.

We never collect:

• →The words you play, or any text you enter
• →Your IP address or your location — our analytics provider discards IP addresses, and its location lookup is switched off
• →Your advertising ID
• →Your contacts, photos, files or anything else on your device
• →Any payment or card details

We do not sell your data. We have no accounts, passwords or sign-ups of our own.

03Purpose of processing

• →Usage statistics and error reports — to see whether the game works: where players get stuck, which features are found, whether a release made something worse, and what broke so we can fix it.
• →Play Games Services — to provide leaderboards and achievements, and to carry your word list between your own devices.
• →Advertising — to fund a game that is free to play.
• →Remote configuration — to switch a feature off quickly if it misbehaves, without waiting for an app update.
• →Purchases — to unlock what you have bought.

04Legal basis (GDPR)

• →Usage statistics — legitimate interest in understanding and improving the app, with an opt-out in the menu
• →Play Games Services — your consent, given in the app and revocable at any time
• →Personalised advertising — your consent, collected through Google’s own consent form
• →Non-personalised advertising — legitimate interest in funding a free app
• →Purchases — performance of a contract

05Data retention and deletion

• →On your device — kept until you delete it in the app or uninstall the app. If Android backup is on, a copy also stays in your Google account until you delete it there or turn backup off.
• →Purchase records — kept by Google Play and RevenueCat while the purchase is in force, so that it can be restored on a new phone, and afterwards for as long as the law requires.
• →Usage statistics and error reports — twelve months. Our analytics provider stores them on our behalf and does not delete them automatically, so we review the data annually and delete anything older than twelve months. You can ask us to delete your own records at any time (below).
• →Play Games Services data — held by Google in your own Play Games account, for as long as you keep it there. Manage or delete it at myaccount.google.com.
• →To stop analytics at any time — Menu → Advanced settings → Anonymous analytics → Off. It takes effect immediately and nothing further is sent.
• →To have your analytics records deleted, write to info@kumakart.com. If you include the identifier from About → Diagnostics → Copy we can find and delete exactly your records; if you cannot, we may be unable to tell which data is yours, because we hold nothing else that points to you.

06Third-party services

• →PostHog — usage statistics and error reports, processed on servers in the European Union. PostHog also serves the small configuration file the app fetches at startup, whether or not analytics is on. That request carries no identifier of yours and no personal data. As with any request to a web server, the provider’s logs may briefly record the requesting IP address; we do not use those logs to identify anybody.
• →Google Play Games Services — leaderboards, achievements and your word-list backup, if you turn it on. Google may still sign you in when the app starts; that part is Google’s own service. Handled by Google under Google’s Privacy Policy. We run no server of our own for it, and what the game gets back (your player ID, display names and leaderboard ranks) stays in the app.
• →Google AdMob — advertising. What Google collects and how it is used is described in Google’s Privacy & Terms and in the AdMob documentation.
• →Google Play, and RevenueCat as our purchase processor — purchases. RevenueCat handles purchase records on our behalf, in the United States. We never see your card details, billing address or any payment information. We learn only whether a purchase is active, so the app knows what to unlock. Google Play also shows the occasional rating prompt; a rating you give there goes to Google Play, not to us.

Outside the EU. Google and RevenueCat may process data in the United States. Where data about you leaves the European Economic Area, the transfer relies on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

About the advertising in this app. No ads appear before level 15, and none appear in Custom mode. There are two kinds: a banner (during a game, on the game-over screen and in the dictionary), and optional video ads you may choose to watch in exchange for an in-game bonus. The video ads are never forced: you can always decline and carry on playing. In the European Economic Area, the United Kingdom and Switzerland, Google’s own consent form asks whether ads may be personalised, and you can change that answer at any time from the menu; declining does not remove ads, it makes them non-personalised. Buying Remove Ads or Premium removes every ad from the app permanently.

07Your rights

If you are in the European Economic Area or the United Kingdom you have the right to access, correct, delete, restrict or object to the processing of your personal data, and the right to data portability. You also have the right to complain to your national data protection authority; in Finland that is the Office of the Data Protection Ombudsman.

In practice, for this app:

• →To stop analytics — Menu → Advanced settings → Anonymous analytics → Off
• →To stop Play Games data — Menu → Advanced settings → Google Play Games → Off
• →To delete everything held on your device — uninstall the app. If Android backup is on, delete the game’s backup in your phone’s Google settings as well
• →To request deletion of analytics data — write to info@kumakart.com (see §05)
• →For Play Games data — use Google’s own controls at myaccount.google.com

08Children’s privacy

The app is not directed at children under 13 and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, write to info@kumakart.com and we will delete it.

09Changes to this policy

If this policy changes materially we will update the effective date above and note the change in the app’s release notes. The current version is always at kumakart.com/en/letters-fall-words-form-privacy-policy.html.

10Contact

For any privacy question or request:

• →KumaKart Oy, Sähköttäjänkatu 4 B, 00520 Helsinki, Finland
• →info@kumakart.com