By WordRaid Team

Privacy Policy

This Privacy Policy explains how WordRaid collects, uses, shares and protects your personal data, wherever you are. We aim to comply with the main data protection laws, including the GDPR (European Union and United Kingdom), the LGPD (Brazil), the CCPA/CPRA (California, USA) and other applicable laws. By using the game, you confirm that you are aware of this Policy.

Who the controller is

The controller (or "business", depending on the applicable law) of the data processed in WordRaid is the WordRaid Team, the team responsible for operating the game. For any question about privacy or about exercising your rights, use the email [email protected]. For WCoins purchases, the payment data you provide to Xsolla is processed by Xsolla as controller, under the Xsolla privacy policy (https://xsolla.com/privacypolicy).

Data we collect

  • Account and identification data: nickname and player identifier; when you sign in with Discord or with Google, the data provided by that platform, such as identifier, username, avatar image and, if authorized, email; and, when you sign up with an email and password, your email and the password, stored only in an irreversible form (hash), never as readable text.
  • Content you create: room, match and private chat messages, nicknames and uploaded avatar images.
  • Voice recordings: in the Say It Backwards mode, the short voice recordings made for the match (see the "Voice recordings in Say It Backwards" section).
  • Game data: matches, statistics, achievements, credits, history, rankings and preferences.
  • Technical and connection data: IP address, access and application logs, date and time, device and browser type, collected also for security and to meet legal obligations.
  • Cookies and local storage: session identifiers, preferences and, with consent where required, measurement and advertising cookies (see the "Cookies" and "Advertising" sections).
  • Payment data: WCoins are bought on the Xsolla checkout page, which receives and processes the payment data (card, PIX and the other methods). We receive from Xsolla only what is needed to deliver the purchase: the order number and status, the amount, the currency and the reason for any refund or dispute. We never receive card numbers or bank details.

How and why we use your data

We process your data for the purposes below, always based on an applicable legal basis (for example, performance of a contract, consent, legitimate interest or compliance with a legal obligation):

  • To allow registration, sign-in and the operation of matches and social features (performance of a contract).
  • To keep the service secure, prevent fraud, cheating and abuse, and ensure fair play (legitimate interest and security).
  • To process purchases and confirm payments (performance of a contract).
  • To comply with legal obligations, such as keeping access logs (compliance with a legal obligation).
  • To show advertising and measure audience, based on consent where the law requires it, or on legitimate interest for non-personalized ads.
  • To send communications and service improvements; optional features may depend on your consent.

Voice recordings in Say It Backwards

In the Say It Backwards mode the game is played with your voice: the round leader records a word and each player records an imitation of what they heard backwards. The microphone is only requested when you record, never when the page opens, and you can play without it, just listening and guessing.

  • What is sent: the leader's recording, because the room needs to hear it, and your imitation, when the room chose the reveal with recordings. The microphone test never leaves your device. Before sending, your own device trims the silence and turns the recording into a short file of up to 3 seconds.
  • What it is for: to be played to the people in the same room, during the match (in the attempt and in the round reveal). A leader's recording that a player reports is also used by the moderation team to listen to it and decide the report.
  • How long: recordings stay only in the memory of the match server and are deleted when the next round starts or when the match ends. They do not go to the database, to backups or to file servers, with a single exception: the reported recording, explained in the next item.
  • Reported recording: anyone who hears the leader's recording can report it with the button next to the "Leader's recording" title. In that case, a copy of that recording is sent with the report and kept in our database for 30 days, available only to the moderation team. After that period the copy is deleted automatically, and the database backups that still contain it are replaced within 14 days. The report record remains, without the audio, like the other moderation records.
  • What we never do: transcribe, analyze, identify who is speaking, use them to train systems or keep the voice for any other purpose.
  • The round video, when you download it, is put together on your own device and does not go through our servers.
  • Legal basis: performance of a contract (the operation of the mode you chose to play). The copy of a reported recording is kept based on the legitimate interest of keeping the community safe. You can stop sending your voice at any time by playing without a microphone.

Cookies and similar technologies

We use cookies and the browser's local storage for different purposes. Where the law requires prior consent (such as in the European Economic Area and the United Kingdom), non-essential cookies are only enabled after you allow them in the consent banner, and you can review that choice at any time.

  • Essential cookies: needed to keep the session, security and the game working. They cannot be disabled.
  • Preference cookies: remember choices such as language and interface settings.
  • Measurement/analytics cookies: help us understand how the service is used, in aggregate.
  • Advertising cookies: used by advertising partners, including Google, to show and measure ads (see the "Advertising" section).

Advertising and Google AdSense

WordRaid may show ads through Google AdSense and other advertising partners.

  • Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this website or to other websites.
  • Google's use of advertising cookies, such as the DoubleClick cookie, enables Google and its partners to serve ads to you based on your visits to this and other websites.
  • You can opt out of personalized advertising in Google's Ads Settings, at https://www.google.com/settings/ads. You can also opt out of personalized ads from other vendors at https://www.aboutads.info/choices and https://www.youronlinechoices.eu.
  • For users in the European Economic Area, the United Kingdom and other regions that require consent, personalized ads depend on your choice in the cookie consent banner; you can accept, decline or change that choice at any time.
  • Learn more about how Google uses data when showing ads at https://policies.google.com/technologies/partner-sites.

Sharing data

We do not sell your personal data. Data is shared only when necessary to operate the service or when required by law, with:

  • Discord and Google, when you choose to sign in through one of these platforms.
  • Xsolla, the official reseller of WCoins: the account identifier, nickname, email (if any), country and IP address, to process the purchase, prevent fraud and deliver the WCoins.
  • Google and advertising partners, to show and measure ads, as described in the "Advertising" section.
  • An email delivery provider, for account messages such as password resets.
  • Hosting, infrastructure and security providers (such as bot protection) that keep the service online.
  • Public authorities, upon a legal request or court order.

International data transfers

WordRaid is available worldwide, and some providers we use, such as Discord, Xsolla, Google and infrastructure services, may process data in countries other than yours. In these cases, we seek adequate protection safeguards, such as standard contractual clauses or equivalent mechanisms recognized by the applicable law.

How long we keep data

  • Access and security logs are kept for the periods required or allowed by the applicable law.
  • Account data is kept while the account is active and, after deletion, for the periods needed to meet legal obligations.
  • Payment and tax data is kept for the periods required by the applicable law.
  • A leader's recording reported in Say It Backwards stays 30 days in the database and up to 14 more days in backups; other voice recordings are not kept.

What remains after the account is deleted

Deleting the account removes your profile, your access and your personal identification data. Some records, however, do not belong only to you: deleting them would rewrite other people's history or destroy evidence. These records remain, unlinked from your account.

  • Matches you played remain in the history of the other participants, with the nickname you used at the time, so that their scoreboard stays complete.
  • Messages sent in rooms and the log of moves remain with the nickname used at the time, as part of that match's history.
  • Financial records (payment orders, WCoins transactions and coupon redemptions) remain without a link to the account, for accounting obligations and to reconcile chargebacks.
  • Moderation records (reports, penalties and appeals) remain, so that the community's safety history is not erased.
  • The record of acceptance of the legal documents is kept for 5 years: which document, which version, the date and the account identifier. It is kept as proof of consent and does not contain your name, email or any other contact data.

Your rights

Depending on the law that applies to your country or region (such as the GDPR, the LGPD or the CCPA/CPRA), you can, at any time and free of charge:

  • Confirm whether your data is being processed and access it.
  • Correct incomplete, inaccurate or outdated data.
  • Request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law.
  • Request the portability of your data and information about who it is shared with.
  • Withdraw consent, object to certain processing and request the deletion of your account, subject to mandatory legal retention.
  • For California residents: opt out of the "sale" or "sharing" of data and not be discriminated against for exercising your rights. WordRaid does not sell personal data.

Information security

We adopt reasonable technical and organizational measures to protect your data against unauthorized access, loss or alteration, including secure connections and access controls. No system is completely free of risk, so we also count on your help to protect your account. To exercise your rights, send a request to [email protected]; we may ask for information to confirm your identity before responding.

Children and teenagers

WordRaid is intended for users aged at least 13, or the minimum age of consent that applies in your country, whichever is higher. The processing of minors' data follows their best interest and, when required, depends on the consent of at least one parent or legal guardian.

If we identify minors' data processed without the proper consent, we will take steps to delete it. We do not show personalized ads to audiences identified as children.

Changes to this Policy

This Policy may be updated to reflect changes in the service or in the law. The current version, with its update date, will always be available on this page.

Data protection contact

For questions, requests or complaints about privacy and data protection, contact the WordRaid Team at [email protected]. You can also file a complaint with the data protection authority of your country.