1Information we collect
WordShift is built so that the daily puzzle works for anyone, with or without an account. What we collect depends on how you use the site:
- Guest play (no account): your daily progress, guesses, and hint usage are stored locally in your browser so the puzzle picks up where you left off. This data never leaves your device and is not visible to us.
- Account features: if you create an account, we store a username, a securely hashed password, an internal player identifier, and the gameplay statistics needed to power leaderboards (games played, total guesses, hint usage, win streaks).
- Race mode: when you create or join a race room, your username and live game progress (letters locked in, completion state) are temporarily broadcast to the other player in that room so the match can function. This is not stored permanently once the race ends.
- Technical information: like most websites, our hosting and backend providers automatically log basic technical data (such as request timing and error logs) needed to keep the service running and secure.
2Local storage on your device
WordShift stores some information directly in your browser's local storage rather than on our servers. This includes your current puzzle progress, your selected theme, whether you've completed the first-time walkthrough, and a locally generated player identifier used to sync your account if you choose to sign in. Clearing your browser's site data will remove this information from your device; if you're signed in, your account data itself remains stored on our servers until you request deletion.
3Passwords
We do not store your password in readable form. When you create or log in to an account, your password is hashed before it is ever compared or saved — meaning we never see or keep a copy of the plain-text password itself. We do not sell, publish, or otherwise disclose password data, hashed or otherwise.
4Usernames and account data
Your username is visible to other players on public leaderboards and, if you use race mode, to whoever you're matched against. Choose a username you're comfortable displaying publicly. We do not currently require an email address to create an account; if that changes in the future, this policy will be updated to describe how it's used.
5How your information is used
The information we collect is used strictly to operate and improve WordShift:
We do not use your gameplay or account data for advertising, and we do not sell any of it to third parties.
6Third-party services we rely on
WordShift is a small, independently run project, and like most modern web apps it relies on a few third-party infrastructure providers to function:
- Supabase — stores account records, gameplay statistics, and leaderboard data.
- Render — hosts the backend service that brokers configuration between the site and Supabase.
- GitHub Pages — hosts the static site you're browsing right now.
- Dictionary lookup services — used only to validate whether a submitted guess is a real word; the word you type is sent to perform that check but is not linked to your account or stored by us afterward.
Each of these providers processes data only as necessary to deliver their service to us, and each maintains its own privacy and security practices independent of WordShift.
7Data retention and deletion
Account and leaderboard data is retained for as long as your account exists, so that your stats and rankings remain accurate and available to you. If you'd like your account and associated data deleted, contact us using the details below and we'll remove it. Locally stored data (guest progress, theme preference, device identifiers) can be cleared at any time directly from your browser's settings.
8Children's privacy
WordShift is a general-audience word game and is not directed at young children. We do not knowingly collect personal information from children. If you believe a child has created an account and provided information to us, please contact us so we can address it.
9Your choices
You are never required to create an account to play the daily puzzle — guest play is fully supported and keeps your data on your own device. If you do create an account, you can request access to, correction of, or deletion of your data at any time. You can also log out at any point, which clears your locally stored session while leaving your account and its stats intact for next time.
10Security
We take reasonable, industry-standard measures to protect the information we store, including password hashing and row-level access controls on our database. That said, no method of storage or transmission over the internet is completely secure, and we can't guarantee absolute security. If you become aware of a security issue affecting WordShift, we'd appreciate a report through the contact method below.
11Changes to this policy
WordShift is actively developed, and this Privacy Policy may be updated as features, data practices, or legal requirements change. The "Last updated" date at the top of this page always reflects the current version. We encourage checking back periodically if you have ongoing concerns about your data.
12Contact
For privacy questions, data access or deletion requests, or anything else related to this policy, please reach out through the contact method associated with the WordShift website or your account.