Privacy

Wanderwort needs very little about you. Nothing we keep identifies you unless you create an account.

Without an account

Your game progress, including streak, scores, atlas, badges, display name and avatar, is saved in your browser's local storage on your own device, under the keys ww and ww_how. It is not sent to us. Clearing your browser's site data deletes it.

The one exception is the leaderboard: when you finish a day's game without an account, your first score that day is posted to the leaderboards with the nickname you chose (or one we make up, like “Curious Nomad”) and a random ID for your device, stored as ww_pid. The ID is never shown to anyone; it only lets your device find and rename its own entry. If you sign in later on that device, those scores move to your account. Scores are kept for 60 days.

With an account

If you sign up, we store your email address, a salted scrypt hash of your password (never the password itself), your game progress as above and when the account was created and last updated. When you sign in we set one cookie, ww_session, holding a random token. It is marked HttpOnly and Secure, is only sent to this site and expires after 90 days. We keep a hash of the token, not the token itself.

When you play a friend’s challenge while signed in, you both become friends in Wanderwort, so you can send each other challenges and see each other’s results.

If you report a mistake, we keep what you wrote so we can check it and fix the game.

If you are signed in, your first score of each day appears on the leaderboards with the name and emblem you chose in the game. Your email never does. Scores are kept for 60 days.

If you ask for a password reset, we store a hash of a one-time reset token for up to an hour and send the link to your email address through our email delivery provider. Using the link signs out every other device.

To slow down password guessing, we briefly record failed sign-in and sign-up attempts, keyed by IP address or email address. These records are discarded after 15 minutes.

Anonymous daily results

When you finish a day's game, we record which five words you played, how many tries each took and your total score, with the date. Nothing identifies you: no account, cookie, name or IP address is stored with it. We use these counts to show lines like "top 10% today" and to publish each day's percentages. Results are deleted after 40 days.

The daily-word email

If you ask for the daily word by email, we store your email address, your time zone and whether you ticked the box for Spillpoint's daily case. If you play after signing up, we also store your display name and a little of your game progress, such as your streak and when you play, to personalise the emails. Every email has a one-click unsubscribe, and unsubscribing deletes your address. If you ticked the Spillpoint box, your address is also added to Spillpoint's daily-case list, which you can leave the same way.

Ads for our sister sites

Our ads also promote our sister sites (Aursee, Spillpoint and Windrift). They are served from this domain, set no cookie, and we count views, clicks and time on the next site without identifying you.

To do that counting, each event we record holds only the time, the site, the kind of event, which ad, the ad format, the type of device, the page path and a visitor code. That code is a one-way hash of your IP address and browser type mixed with a secret that changes every day and is deleted when the day ends, so it cannot be linked across days or back to you. These records are kept for 400 days. In your browser the ad code keeps today's ad counts (loop_d), your visit if you arrived from a sister site (loop_s, cleared when you close the tab) and the ad-blocker notice count (loop_ab).

If an ad blocker hides these ads, we may show a notice asking you to allow them on this site, at most once a day. You can always close it and keep playing. It never appears on this page or the terms.

If you arrived from one of our ads

We tell the ad provider when that visit leads to a first game, an account or Plus, using only its own click reference.

Wanderwort Plus

If you subscribe, payment is handled entirely by Stripe on its own pages; your card details never reach us. We store the Stripe customer and subscription references for your account, the subscription's status and when it renews or ends. Stripe keeps its own records of the payment, as the law requires.

What we do not do

Apart from Google Analytics and Google AdSense, described below, there is no third-party script or cookie: fonts, images and video are served from this site. We do not sell your data.

Server logs

Like any website, our web server records standard request details, such as IP address, browser, time, page requested and the page you came from, to keep the service secure and working. Log files are deleted after 30 days.

From those logs we keep daily totals only: page views, an estimate of visitors, the most visited pages, referring sites and countries. No cookie is involved, the totals cannot be traced back to you, and they are counted the same way whatever you choose about analytics below.

Analytics

We also use Google Analytics to understand how the game is played: the pages you open, how you arrived, rough location, device and browser, and a few game moments with no personal details in them (finishing the day's five with your score, sharing a result, starting a Plus checkout, signing up). Google keeps this under cookies whose names start with _ga, which last up to 13 months, and stores the data for up to 14 months. Google Analytics does not store your IP address. Google signals and ad personalisation are switched off in Analytics.

In the EU, EEA, UK and Switzerland, Google Analytics and ads load only if you accept. Elsewhere they load by default. Wherever you are, Privacy choices at the bottom of every page changes your answer; we keep it in this browser for 12 months, and rejecting deletes the _ga cookies.

Ads

Free play is supported by ads from Google AdSense. Google and its partners use cookies to show ads, limit how often you see them and measure them, and may use them to tailor ads where the law allows. In the EU, EEA, UK and Switzerland, ads load only if you accept, and are not tailored to you. Plus members see no ads. You can see how Google uses this information at policies.google.com and turn off personalised ads at adssettings.google.com.

Your rights

You can export your progress from your profile at any time using the transfer code. Forgot your password? Use Forgot password on the sign-in form and we will email you a link that works once, for one hour. To have your account and all its data deleted, write to hello@wanderwort.app from the email address on the account.

Who is responsible

The data controller for Wanderwort, and the seller of Wanderwort Plus, is NEXTIN Media Limited, Grafton Building, 34 Grafton Street, Dublin 2, Ireland. Registered in Ireland, company number 554885. VAT number IE3329768FH. Please write to us through the address above rather than by post.

Last updated 27 September 2026.