Privacy Policy
Spellwell: Word Magic (“Spellwell”) is a free word game for iOS and Android, made by Luca Tescari in Switzerland. This policy explains what data the game and its online leaderboard handle.
In short: one optional purchase, Spellwell Plus, sold through the App Store or Google Play and managed by RevenueCat; no analytics and no tracking across apps, and no account or login. There are two optional third-party SDKs: Google’s ad SDK, which the app only starts when you choose to watch a vision for an extra ranked run or open Settings → Privacy & ad choices; the app never starts it when it opens; and RevenueCat’s purchases SDK for Spellwell Plus (see Spellwell Plus). The only other third-party code is Google’s Play Integrity library on Android, used for the leaderboard’s device check (on iOS the check is Apple’s App Attest, part of the operating system). The game plays offline. Apart from Google’s ad SDK when you choose to watch a vision (or open Privacy & ad choices), the only data that leaves your device is what the optional online leaderboard needs: a random install key, the device check for ranked runs and, once you choose one, your leaderboard name and your verified scores, plus, if you use Spellwell Plus, what is described under Spellwell Plus.
Who is responsible
Luca Tescari, Switzerland, is responsible for this data (the “controller”). Contact: luca@tescari.dev.
Data that stays on your device
Your settings, the spells you have found, the words you have cast, your best score, your tutorial progress and any runs waiting to be posted are stored only in the app’s private storage on your device. They are never sent anywhere, except that a waiting run is sent to the leaderboard once it can be posted (see below). Deleting the app deletes all of this.
The online leaderboard
The leaderboard is optional. Your scores are only posted after you choose a leaderboard name. Opening the highscores screen downloads the boards; that request stores nothing on the server.
Install key. On first launch the app creates a random 32-byte key and keeps it on your device. It is not derived from your device, your hardware or any advertising ID. The app sends it over HTTPS with each leaderboard request. The server never stores the key itself, only its SHA-256 hash (the “install id”), which ties your name and scores together. If you delete the app, the key is gone and your old scores can no longer be linked to a new install.
What the server stores once you choose a name and post scores:
- Your leaderboard name (3–16 letters or digits, chosen by you), linked to your install id, with the time it was first set and last changed.
- Each verified run: score, level, number of words, game length, game rules version, the puzzle seed, the board (the single ranked board), your local date, the week and the time. The server replays every run to check the score; the full record of the run’s moves, together with your install id and your name at the time, is kept for audit.
- Your best scores on the ranked board, for each day, each week and all time.
- Tickets: each ranked run starts with a ticket from the server, which records your local date, the puzzle seed the server chose, the kind of run (your free run or an extra one), when it was issued and which run used it.
- Grants: extra ranked runs for a date, with where they came from and the ticket that used them.
- Rejected submissions: install id, the reason, the claimed score, the rules version and the time. These are used for rate limiting and to spot cheating.
- The device check (see below), linked to your install id: the platform (iOS or Android). On iOS also the App Attest key id and its public key, a counter that goes up with each check, Apple’s environment (development or production), and when the key was made and last checked. On Android only that a check passed and when.
- Vision requests: when you choose to watch a vision, a random one-time code, your install id, your local date, the times it was created and expires, and, once Google confirms the ad was watched, Google’s transaction id, the time, and the extra run it unlocked.
- Challenges: one-time random values the app asks for before a check, linked to your install id. Each is deleted when it is used and expires after 5 minutes.
- Plus: if you use Spellwell Plus, your purchase id, until when Plus runs and when the server last checked it, the link between your install id and your purchase id, and the dates on which you had Plus (used for streak freezes). See Spellwell Plus.
Your local date and time zone. A ranked day is your local calendar day, so the app sends your date and your UTC offset (for example +60 minutes) when it asks for today’s runs (/v1/today) and for a ticket (/v1/tickets). The offset is only used to check the date and is not stored. Your daily streak is not stored either; it is worked out from your runs each time.
What is public. The leaderboards show your name with your rank, score, level and word count to anyone who opens them. If you prefer, choose a name that doesn’t identify you.
What we don’t collect. No email address, real name, location, contacts, photos, device identifiers or advertising IDs (the device check’s key is made for this install of the app only; Google’s ad SDK may, see Optional ads). No cookies and no tracking across apps or websites. We sell nothing. Apart from Google’s ad SDK (see Optional ads), nothing is shared for advertising.
The device check: Apple App Attest and Google Play Integrity
To keep the leaderboard fair, a ranked run’s ticket and its score only count from the real Spellwell app on a real device. The app proves this with each of those two requests, using a service of your phone’s platform. The device check uses no advertising ID, and neither Apple nor Google tells us who you are.
iPhone and iPad: Apple App Attest. The app asks iOS for a key that stays in your device’s secure hardware and has Apple’s App Attest service (part of iOS’s DeviceCheck; no extra code from Apple is in the app) certify that the key belongs to a genuine copy of Spellwell on a genuine Apple device. The app then signs each ticket and score with that key. We store the key’s id and public key (see above), not anything from Apple about you or your device. Apple processes the data for this check under its own privacy policy: https://www.apple.com/legal/privacy/.
Android: Google Play Integrity. The app asks Google Play for an integrity token for each ticket and score. To make it, Google Play processes information about the app (package name, version, signing certificate, whether it was installed from Google Play) and about the device (whether it passes Google’s integrity checks), together with a fingerprint of the request. Google Play does this under its own terms, the Google Play Terms of Service and Google’s privacy policy (https://policies.google.com/privacy); Google describes the data it handles here: https://developer.android.com/google/play/integrity/terms#data-safety. Our server sends the token to Google, which decodes it and returns the integrity verdict to us: whether this is the app from Google Play and whether the device passes. We use the verdict for that request only and keep only that a check passed (see above).
If the check doesn’t pass, ranked runs are not available on that device; practice and everything else still work.
Spellwell Plus (RevenueCat)
Spellwell Plus is an optional purchase (a monthly or yearly subscription, or a one-time lifetime purchase). It gives you three extra ranked runs a day without watching visions, a second stored streak freeze on days you have Plus, and a Plus mark next to your name on the boards. It never changes how a score is worked out.
Payment is handled by Apple (App Store) or Google (Google Play). We never see your payment details.
Purchase id. The app makes a random purchase id, kept on your device. It is not your install key and not a device id. “Forget me” does not delete it, so you don’t lose Plus.
RevenueCat. RevenueCat, Inc. (USA) processes on our behalf your purchase id, the store’s transaction and receipt data (product, dates, price and currency, store country, renewal status), the app version, and the device’s OS version and IP address in its requests. Transfers outside Switzerland and the EU rely on its Data Processing Addendum and the EU Standard Contractual Clauses. Its privacy policy: https://www.revenuecat.com/privacy.
Our server asks RevenueCat whether a purchase id has Plus, and stores the purchase id, until when Plus runs and when it last checked, the link between your install id and the purchase id, and the dates on which you had Plus (for streak freezes). Next to your name, the boards show the Plus mark.
Legal basis: contract (GDPR Art. 6(1)(b)). The stores keep their own accounting records under their own terms.
Deletion. “Forget me” deletes the link and the Plus dates. The purchase record stays with Apple or Google and with RevenueCat for as long as the purchase is valid and the law requires. You can ask us (luca@tescari.dev) to delete the RevenueCat record; that ends Restore for that purchase id until your next Restore from the store account.
Optional ads (Google AdMob)
After your free ranked run you can choose to watch a rewarded video, a “vision”, for one more ranked run (up to 3 a day). There are no other ads in the game. The app starts Google’s ad SDK only when you choose to watch a vision or open Settings → Privacy & ad choices, never when the app opens.
In the EEA, the UK and Switzerland, Google’s consent form asks first. Google, as its own controller, processes your IP address (and the rough location it implies), device identifiers (on Android the advertising ID and app set ID; on iPhone not the advertising ID, because the app never asks for tracking permission), ad interactions and diagnostics. On iPhone Google’s SDK may still use other device identifiers (such as the identifier for vendor) and collects diagnostics and performance data, as Google describes in its SDK disclosure. On iPhone ads are never personalised; on Android only with your consent where it is required. More: https://policies.google.com/technologies/partner-sites and https://policies.google.com/privacy.
Google tells our server that the ad was watched, using a random one-time code. We store that code, your install id, the date, the times and Google’s transaction id, and the extra run it unlocked (see “Vision requests” above).
Legal basis: your consent (GDPR Art. 6(1)(a)) for Google’s use of data where consent is required, and contract (Art. 6(1)(b)) for the extra run. You can change your choice any time under Settings → Privacy & ad choices; “Forget me” (Delete) doesn’t reset it.
Hosting: Cloudflare
The leaderboard runs on Cloudflare (Workers, D1 database and R2 storage), which processes the data on our behalf. The leaderboard code does not store IP addresses. Like any web host, Cloudflare processes your IP address and request details (such as time, address requested and app or browser type) to deliver the service and protect it from abuse. We have switched off Cloudflare’s per-request logs for the leaderboard; the leaderboard only logs errors, kept for a few days, and those logs never contain your install key, only a short fragment of its hash. Cloudflare operates worldwide, so data may be processed outside Switzerland and the EU under Cloudflare’s safeguards for international transfers. See Cloudflare’s privacy policy: https://www.cloudflare.com/privacypolicy/.
Why we process it
To run the leaderboard you chose to join, and in our legitimate interest in keeping it fair, free of cheating and secure (GDPR Art. 6(1)(b) and (f)); for ads, see Optional ads; for Spellwell Plus, see Spellwell Plus.
How long we keep it
Apart from the daily cleanup (expired challenges, name holds and vision requests, described here), nothing is deleted automatically. Your name, runs, best scores, run records, tickets, grants, vision requests, rejected submissions and your device check record (the App Attest key, or that a Play Integrity check passed) are kept for as long as the leaderboard exists, unless you delete them in the app or ask us to. Challenges expire after 5 minutes, and vision requests are deleted about a week after they expire (a daily cleanup). Purchase checks that are no longer linked to any install are removed after 30 days. Your Plus dates are kept until you delete them with “Forget me”; your Plus link is kept until “Forget me” or removed after 30 days without use. When you delete your data, your name is held for 7 days so nobody (you included) can take it again at once; for that the server keeps only a hash of the name (not the name, not your install id), deleted after those 7 days. Error logs are kept for a few days.
Your rights
Under the Swiss Federal Act on Data Protection (revFADP) and, if you are in the EU or EEA, the GDPR, you can ask for access to your data, a copy of it, its correction or its deletion, and you can object to its processing. You can change your name at any time in the app under Settings → Name.
Deleting your data. In the app, open Settings → Leaderboard data → Delete. This deletes, right away and for good, your leaderboard name, every run and best score (day, week and all time), your tickets, grants and vision requests, your rejected submissions, your device check record (the App Attest key or the Play Integrity pass) and open challenges, the stored records of your runs, and the link to your purchase id and your Plus dates; your streak goes with your runs. The purchase record itself stays with Apple or Google and RevenueCat (see Spellwell Plus). The purchase check we cached (purchase id and Plus-until) is not removed by “Forget me”; it is deleted within 30 days once no install is linked to it. Your name then stays reserved for 7 days (only a hash of it is kept, without your install id), so it can’t be taken again right away. On your phone, the app forgets your name and makes a new install key, so nothing links your phone to the old entry. Your spellbook, dictionary and best score stay on your device. You can also email luca@tescari.dev with your leaderboard name and we will delete it for you; there are no accounts, so the name is how we find your data, and we may ask for a detail only you would know (such as a recent score) to make sure the data is yours. After deletion you can keep playing; if you choose a name again, you start a fresh entry.
For anything else (access, a copy, a correction or an objection), email luca@tescari.dev.
You can also complain to a data protection authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority in your country.
Children
Spellwell is not directed at children under 13, and we don’t knowingly collect personal information from them. The leaderboard only asks for a self-chosen name, which is checked for rude words. If you are a parent and want a name removed, use Settings → Leaderboard data → Delete on the device, or email luca@tescari.dev with the name and we will delete it.
Security
All traffic to the leaderboard is encrypted (HTTPS). The server keeps only a hash of your install key, and there are no passwords to leak.
Changes
If this policy changes, we will update this page and its effective date.