Privacy Policy

Effective date: September 17, 2026

Word Mystery is a general-audience word-guessing game provided by Koswattha M Koswattha (“Word Mystery,” “we,” “us,” or “our”). This Privacy Policy explains what information the Word Mystery app for iPad processes, why we process it, how long we keep it, and the choices available to players.

Information we process

Username and account information

When a player creates an account, they choose a username. Usernames must be 3–16 characters, start with a letter, end with a letter or number, and contain only letters, numbers, and underscores. The app rejects email-style usernames and long runs of numbers to reduce the chance that a player enters contact information. Please use a made-up nickname.

We store the normalized username on our servers so it remains unique and can be used to sign in on the same app installation. We also store the account’s authentication version and creation and update timestamps. A username is not displayed to other players, and Word Mystery has no public profiles, chat, messaging, or social features.

Accounts are tied to security credentials on the device where they were created. They are not currently portable to another device, and we do not currently provide account recovery after those credentials are lost, including after some reinstalls.

App and device security information

Word Mystery uses Apple App Attest and Firebase App Check to help distinguish the genuine app from modified, automated, or unauthorized clients. For this purpose, we and our service providers process limited app- and device-related security information, including:

• an App Attest public key and key identifier;
• a counter used to prevent replayed requests;
• app-attestation tokens and validation results;
• authentication version, creation time, and update time; and
• request metadata such as IP address, request time, and error or security-event details.

The App Attest private key is managed by Apple on the device and is not sent to us. The identifiers above are not used for advertising or cross-app tracking. Because device and network identifiers can be considered personal information under some laws, this policy treats them as personal information even though we do not ask for a player’s real identity.

When a player registers, signs in, renames, or deletes an account, the service creates a one-time security challenge linked to the username. A challenge expires after five minutes and cannot be reused. A successfully used challenge is deleted immediately; an unused expired challenge may remain briefly until automated cleanup removes it.

Gameplay requests

To provide a word or clue, the app and our servers may process:

• the selected word category;
• up to 20 recently played words, used only to reduce repetition;
• the generated answer word;
• the clue number; and
• clues already shown for the current word.

The app does not send the player’s letter guesses to the server. Gameplay requests sent for AI generation or review do not include the player’s username, App Attest key identifier, account record, or win streak.

Operational information

Our hosting and security providers automatically create limited technical logs. These may include IP address, request time, service and app identifiers, requested service route, response status, security-validation results, and error details. Azure service telemetry may also contain gameplay parameters present in a request URL, such as a category, answer word, or clue text. These logs do not include the player’s username unless it appears in an account request or error record. We use this information to deliver requests, prevent abuse, troubleshoot failures, monitor reliability, and protect the service. We do not use it for advertising, marketing profiles, or tracking players across apps or websites.

Information stored on the device

Word Mystery stores the following locally:

• the win streak for each local player;
• the currently selected username and session settings;
• up to 20 recently played words;
• a local mapping to the App Attest key identifier in the iOS Keychain; and
• the App Attest private key managed by Apple.

Most local settings are removed when the app is deleted. However, iOS may preserve Keychain or system-managed security material. Uninstalling the app therefore does not delete the server-side account. Use Delete account in the app before uninstalling if you want the server record removed.

How we use information

We use the information described above to:

• register, authenticate, rename, and delete player accounts;
• keep usernames unique;
• generate, validate, and deliver words and clues;
• reduce recently repeated words;
• detect fake, automated, replayed, or abusive requests;
• operate, secure, troubleshoot, and improve service reliability; and
• comply with applicable legal obligations.

We do not sell or rent personal information. We do not use it for targeted advertising, marketing, behavioral profiling, or cross-app tracking.

AI-generated words and clues

Word Mystery uses OpenAI’s API to generate and review words and clues. Our instructions require age-appropriate, concise, and factual results, and an additional AI review checks generated content against the game’s rules. AI can still make mistakes, so a word or clue may occasionally be inaccurate or unsuitable.

The AI service receives only the gameplay details needed for generation or review, such as the category, candidate word, clue information, and recently used words. It does not receive the player’s username, account-security record, App Attest key identifier, or win streak from Word Mystery.

OpenAI states that data sent through its API is not used to train its models by default. OpenAI may retain API data in abuse-monitoring logs for up to 30 days under its standard controls, unless a different retention arrangement applies or a longer period is legally required.

Service providers and disclosures

We use service providers to run Word Mystery:

These providers process information under their own service terms and privacy commitments and may use limited information for security, abuse prevention, legal compliance, and service operation. We may also disclose information when reasonably necessary to comply with law, respond to valid legal process, protect players or the public, investigate abuse, or defend the security and rights of Word Mystery.

We do not disclose personal information to data brokers, advertising networks, or third parties for their own marketing.

Players of different ages

Word Mystery is intended for a general audience and is suitable for players of different ages. It is not directed specifically to children under 13. The app does not ask for a real name, email address, phone number, age, photo, precise location, contacts, or payment information. It has no advertising, chat, messaging, public profiles, or public leaderboards. Usernames are not shown to other players.

The app uses persistent app, device, and network identifiers only as needed to support internal operations such as authentication, delivering requested game content, maintaining security, preventing fraud or abuse, debugging, and protecting the service. We do not use these identifiers to contact a child, build an advertising profile, or track activity across other apps or websites.

If a parent or guardian believes a child entered personal information in a username or provided information beyond what is described in this policy, they can delete the account in the app or contact us so we can investigate and delete it as appropriate.

How long we keep information

• Username and account-security records: kept until the account is deleted, unless we must retain limited information for security, fraud prevention, dispute resolution, or legal compliance.
• One-time security challenges: expire after five minutes. Used challenges are deleted immediately; expired unused challenges are removed by automated cleanup.
• Microsoft Azure operational logs: currently retained for up to 90 days. Depending on the request, these logs may contain the gameplay parameters described above.
• OpenAI API abuse-monitoring logs: retained for up to 30 days under OpenAI’s standard controls, unless another approved control or legal requirement applies.
• Other operational and security logs: retained only for the period configured by the relevant provider or reasonably needed for security, troubleshooting, and legal compliance.
• On-device gameplay data: kept until it is replaced, deleted through the app, or removed by iOS. The recent-word list is limited to 20 words.

Deleting an account removes the active username and account-security record. Limited information already present in operational logs may remain until the normal retention period expires and may not be searchable by username.

Deleting an account

In Word Mystery, tap the username at the top of the game to open the Player screen. Tap Delete account, then confirm. This permanently removes the username and its account-security record from our active server database and removes that player’s streak and recent-word history from the device. The username may then become available for another person to register.

Deleting the app without first using Delete account does not delete the server-side account. Because Word Mystery does not collect an email address or verified real-world identity, we may be unable to confirm ownership if the player loses the device credentials. If you cannot use the in-app deletion control, contact us with the username and device details; we will explain what options are available without requesting unnecessary personal information.

Security

We use safeguards including HTTPS encryption in transit, Apple App Attest, Firebase App Check, short-lived one-time challenges, replay protection, and restricted server-side credentials. API secrets are held on servers and are not included in the client app. No security measure is perfect, and we cannot guarantee absolute security.

International processing

Usernames and account-security records are stored in Google Cloud Firestore in the United States. Our server functions run in Canada. Our providers may also process information in other countries where they operate. Privacy laws in those places may differ from the laws where you live.

Your privacy rights

Depending on where you live, you may have rights to request access to, correction of, or deletion of personal information, or to object to or restrict certain processing. You can rename or delete the account directly in the app. For another privacy request, contact us below.

Because the app intentionally does not collect a verified name or email address, we may need to verify requests through the app or may be unable to associate a request with a particular account. We will not collect unnecessary personal information solely to verify a request.

Changes to this policy

We may update this policy when the app, its providers, or legal requirements change. We will update the effective date above. If a change materially affects how information is handled, we will provide additional notice in the app or through the App Store listing when appropriate.

Contact us

Word Mystery is operated by:

Parents or guardians may use the same contact information for questions or requests concerning a child.