Privacy Policy

1. Overview

WordShuttle ("we," "us," or "our") is operated by FlyDaddyDevelopments. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use the WordShuttle mobile application ("App") and associated website.

By using the App, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the App.

2. Information We Collect

2.1 Information You Provide Directly

• Display name — chosen by you during account setup. Must be 2–20 characters and unique across all players.
• Email address — provided when signing in via Google Sign-In or Email sign-in, or when contacting support. Not required for Apple Sign-In (you may hide your email via Apple's relay service).
• Profile picture — optionally uploaded to personalize your profile.
• Feedback & support messages — content you submit through the in-app feedback form or via email.

2.2 Information Collected Automatically

• Game statistics — scores, games played, best scores, win/loss records, streaks, and timestamps associated with your gameplay.
• Daily play counts — we track how many solo games you play per day to enforce free-tier limits (3 per day).
• Device information — iOS version, device model, and app version, collected for crash reporting and compatibility.
• Authentication tokens — secure tokens issued by Apple, Google, Firebase (for Email sign-in), or Game Center to authenticate your session.
• Game Center ID — if you link Game Center, your Game Center identifier is stored to enable leaderboards and achievements.
• Advertising identifier (IDFA) — used to serve personalized ads via AdMob. You may opt out of personalized ads through your iOS privacy settings (Settings → Privacy & Security → Tracking).
• Crash and performance data — crash logs, stack traces, and device state at the time of a crash, collected via Firebase Crashlytics to help us identify and fix bugs.
• Subscription status — your Premium subscription state is managed through RevenueCat, which syncs purchase receipts with Apple to verify entitlements. RevenueCat does not receive your payment details.

2.3 Information We Do Not Collect

• Location data
• Contacts or address book
• Camera or microphone access (unless you choose to upload a profile picture)
• Browsing history or data from other apps
• Payment card details (purchases are handled entirely by Apple)

3. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain the App and its features
• Authenticate your identity and manage your account
• Track and display your gameplay statistics
• Enable real-time multiplayer (Score Challenge) by matching you with opponents
• Maintain leaderboards and Daily Challenge rankings
• Enforce fair-play limits (e.g., 3 free solo games per day)
• Respond to your support and feedback requests
• Detect and prevent fraud, abuse, or violations of our Terms of Service
• Improve the App through crash reporting and performance monitoring
• Send transactional messages (e.g., email confirmation, support replies)

We do not sell your personal information. We do not use your data for targeted advertising.

4. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA) or United Kingdom, we are required under GDPR and UK GDPR to identify a lawful basis for processing your personal data. We rely on the following bases:

• Performance of a contract — the primary basis for most processing. We need your email address, display name, and account information to create your account and deliver the App's features (multiplayer, leaderboards, synced stats). Without this data, we cannot provide the service you signed up for.
• Legitimate interests — for purposes such as fraud detection, abuse prevention, security monitoring, and improving the App through crash reporting. We only rely on this basis where our interests are not overridden by your rights.
• Legal obligation — where processing is required to comply with applicable law (e.g., responding to a valid legal request).

We do not rely on consent as our lawful basis for routine processing. Where we do seek consent (e.g., optional marketing communications, if introduced in future), you may withdraw it at any time without affecting the lawfulness of prior processing.

5. International Data Transfers

WordShuttle is operated by FlyDaddyDevelopments in the United States. If you access the App from outside the United States, your personal data — including your email address, display name, profile picture, and gameplay statistics — will be transferred to and stored on servers located in the United States.

The United States may not provide the same level of data protection as the laws in your country. We ensure appropriate safeguards are in place for these transfers as follows:

• EU-US Data Privacy Framework (DPF) — Google LLC (Firebase) participates in the EU-US Data Privacy Framework, which has been recognised by the European Commission as providing adequate protection for personal data transferred from the EEA to the US.
• Standard Contractual Clauses (SCCs) — our agreement with Google/Firebase incorporates EU-approved Standard Contractual Clauses as an additional transfer safeguard. These contractually require Google to protect your data to EU standards regardless of where it is processed.
• UK International Data Transfer Agreement (IDTA) — for users in the United Kingdom, equivalent transfer mechanisms apply under the UK GDPR framework.

By using the App, you acknowledge that your information will be transferred to and processed in the United States. You can withdraw from use of the App at any time if you do not wish your data to be transferred internationally.

For more information on the safeguards Google applies to international transfers, see: firebase.google.com/support/privacy.

6. Third-Party Services

WordShuttle integrates with the following third-party services. Each has its own privacy policy.

6.1 Firebase (Google)

We use Firebase for authentication (Firebase Auth), database storage (Firestore), and file storage (Firebase Storage). Your user data, game records, and profile information are stored in Firebase infrastructure operated by Google LLC.

Firebase Privacy: firebase.google.com/support/privacy

6.2 Google Sign-In

If you sign in with Google, we receive your Google Account ID, email address, and display name from Google. We do not receive your Google password or access to other Google services.

Google Privacy Policy: policies.google.com/privacy

6.3 Email Sign-In (Firebase Auth)

If you sign in with Email, we collect your email address and store it securely within Firebase Authentication. Your password is hashed and never stored in plain text. We do not have access to your raw password. Email sign-in is powered by Firebase (Google LLC).

6.4 Sign in with Apple

If you sign in with Apple, we receive your Apple ID, name (if shared), and email address (or Apple's private relay address). Apple may provide an anonymized email address on your behalf.

Apple Privacy Policy: apple.com/legal/privacy

6.5 Game Center

If you link Game Center, your Game Center alias and player ID are used to power leaderboards and achievements. Apple's Game Center terms apply.

6.6 AdMob (Google)

We use Google AdMob to display ads within the App for free-tier users. AdMob may collect your Advertising Identifier (IDFA), device information, and interaction data to serve relevant ads. Premium subscribers do not see ads.

AdMob Privacy: support.google.com/admob/answer/6128543

6.7 RevenueCat

We use RevenueCat to manage Premium subscriptions and in-app purchases. RevenueCat processes your Apple purchase receipts to verify and sync your subscription status across devices. It does not receive your payment card details.

RevenueCat Privacy: revenuecat.com/privacy

6.8 Firebase Crashlytics

We use Firebase Crashlytics to collect crash reports and diagnostic data. This includes crash logs, stack traces, device model, OS version, and app state at the time of a crash. Crashlytics data is used solely to identify and fix bugs.

Firebase Crashlytics Privacy: firebase.google.com/support/privacy

6.9 Apple App Store & In-App Purchases

All Premium purchases are processed by Apple through the App Store. We do not receive or store your payment information. Billing is governed by Apple's Terms of Sale.

7. Data Retention

We retain your personal information and game data for as long as your account is active. If you delete your account, we will permanently delete your data within 30 days, except where retention is required by law.

Anonymous aggregated statistics (e.g., total games played across all users) may be retained indefinitely as they do not identify any individual.

8. Your Rights

Depending on your location, you may have the right to:

• Access — request a copy of the personal data we hold about you.
• Correction — request that we correct inaccurate information (you can update your display name and profile picture directly in the App).
• Deletion — request that we delete your account and all associated data.
• Portability — request your data in a structured, machine-readable format.
• Objection / Restriction — object to or request restriction of certain processing activities.

To exercise any of these rights, contact us at privacy@wordshuttle.app. We will respond within 30 days.

9. Children's Privacy

WordShuttle is not directed at children under the age of 13 (or 16 in the EU/UK). We do not knowingly collect personal information from children under these ages. If you believe a child has provided us with personal information, please contact us immediately at privacy@wordshuttle.app and we will delete it promptly.

10. Security

We implement industry-standard security measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Firebase Security Rules to restrict unauthorized database access
• Authentication tokens with short expiry periods
• No storage of passwords (authentication is delegated to Apple/Google)

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated through an in-app notification or, where appropriate, by email. Your continued use of the App after changes are posted constitutes acceptance of the revised policy.

12. Contact Us

If you have questions or concerns about this Privacy Policy or how we handle your data, please reach us at:

• Email: privacy@wordshuttle.app
• Developer: FlyDaddyDevelopments