Privacy policy

Last updated 26 September 2026. Published by WordJax.

This policy explains what The Golden Rule by WordJax collects, why, who else sees it, and what you can do about it. It covers the iPhone and Android app and the website at wordjax.com/goldenrule. We've tried to write it the way we'd explain it to a friend. If anything here is unclear, email us and we'll answer in plain words.

1. Who we are

WordJax is a trade name of Jordan Axelrod, an individual based in Florida, USA. When this policy says "we" or "us", that's who it means. We decide how your information is used, which makes us the "controller" under European and UK data protection law.

You can reach us about anything in this policy at jordan@wediorknot.com.

2. The short version

• You can play without an account. If you never sign in, we don't know your name or your email address.
• If you do sign in, we hold your email address (through our sign-in provider), your profile, and your social activity, such as who you follow and which groups you're in.
• We record your game results and anonymous gameplay events. Words you type into the puzzle are never sent to us.
• The game is paid for by ads from Google AdMob. Google collects device information to show and measure those ads.
• You can delete your account inside the app at any time.
• We don't sell your information for money.

3. What we collect

Your player ID and recovery code

The first time you open the app, it makes up a random player ID and keeps it on your phone. Your game results are filed under that ID, so it isn't tied to your name. We also store when the ID was first seen and last seen, and a copy of your streaks so they can follow you to a new phone.

Settings also shows a six-character recovery code you can use to move your streak to another phone. We don't store the code itself on our servers, only a scrambled one-way version of it that can check a code but can't be turned back into one. Failed attempts to use a code are recorded for 24 hours to slow down guessing.

Account information, if you sign in

Signing in is optional. You can sign in with Apple or with Google. When you do, our sign-in service (Supabase Auth) receives and stores:

• your email address. If you use Apple's "Hide My Email", that's a private relay address Apple gives us, not your real one;
• the account ID Apple or Google uses for you, so we recognise you next time;
• your name, if Apple or Google shares it. The app only uses it to suggest a handle when you first set up your profile;
• technical records of sign-in activity, such as when you signed in.

Your email address stays with the sign-in service. It isn't copied into the game's own tables and it's never shown to other players. The app keeps your sign-in session in your phone's secure keychain or keystore.

Your profile

Once you're signed in you can set up a profile with:

• a handle (your unique @name) and a display name;
• an optional photo, or one of twelve built-in pictures. A photo you choose is cropped to a small square (256 by 256 pixels) and saved as a JPEG of no more than 512 KB. The app asks for access to your camera or photo library only when you choose to add a photo, and it only sends the one photo you pick;
• a short bio, up to 140 characters;
• whether your profile is public or private.

Other signed-in players can see your handle, display name and photo. On a public profile they can also see your bio and your game stats. On a private profile, those are only visible to people who follow you and whom you follow back. Profile photos are stored so that anyone who has the exact web address of the photo can load it, so please don't use a photo you'd want to keep private.

Social activity

• who you follow, who follows you, and who you've blocked;
• cheers you give on other players' highlights;
• groups you create or join, the group names, invite codes and your role in each group;
• reports you make about another player, with the reason you picked and the time;
• highlights in the feed. Our server creates these from your results (for example "solved the six-letter in 3" or "hit a 30-day streak"). They contain numbers only, never text you typed;
• short-lived counters we use to stop spam, such as how many people you followed today.

Game results and stats

When you finish a daily puzzle, the app sends us the result: which game and date it was, the puzzle number, whether you solved it, how many guesses it took, how long it took, whether you used a hint, and whether it was a catch-up from the archive. Your stats (played, solved, streaks, guess counts, points in groups) are worked out on our server from these results. Practice rounds in Fun play don't create results.

Gameplay events

The app also sends us small events about how the game is used, such as "a puzzle was started", "a hint was used", "an ad was shown", "you signed in", "you followed someone" (never who), or which answer was given on the privacy and tracking prompts. Each event carries your random player ID, the game, the app version, whether you're on iPhone, Android or the web, and the time. The events only hold counts, times, fixed choices and IDs the app made up. They're built so that they can't carry a word you typed, a guess, your handle, your bio, a group name or a search.

Device and advertising information (collected by Google)

The ads in the app come from Google AdMob. Google's software in the app collects information such as your IP address, device type, operating system, app information, rough location worked out from your IP address, and how you interact with ads. On Android it can use your device's advertising ID. On iPhone it can only use your advertising identifier (IDFA) if you allow tracking when Apple asks. We don't receive your advertising ID ourselves. Google's own use of this information is explained at policies.google.com/technologies/partner-sites.

Your privacy choices

The choices you make on the consent screen and on Apple's tracking prompt are stored on your phone, so the app knows which kind of ads it may ask for. As mentioned above, the app also tells us which answer you gave, as a simple yes or no event.

Reminders

If you turn on reminders, your phone schedules them itself. There's no push server and no device token: we never receive a notification address for your phone.

Support emails

If you email us, we'll have your email address and whatever you choose to write, which we use to answer you.

What stays on your phone

The app keeps your settings, streaks, progress on today's puzzles, a copy of the daily schedule, your recovery code, reminder preferences, ad frequency counters, and a cached copy of your own profile in the phone's storage. Deleting the app removes them.

4. Why we use it, and our legal basis

If you're in the European Economic Area or the UK, the law asks us to name a legal basis for each use. Here's how they line up:

• To run the game you asked for (saving results, keeping streaks, running your account, profile, feed, follows and groups, and letting you move to a new phone): performance of our agreement with you, which is our terms of use.
• To keep things safe and fair (spam limits, blocked words, reports, moderation, preventing abuse and cheating, and keeping records of reports as evidence): our legitimate interest in running a safe community.
• To understand and improve the game using gameplay events: our legitimate interest in making the game better. The events are kept to numbers and fixed choices so this has very little effect on you.
• To show ads that pay for the free game: where the law requires consent to store or read information on your device, or for personalised ads, we rely on the consent you give on the consent screen. Otherwise we rely on our legitimate interest in funding a free game with non-personalised ads.
• To answer your emails and handle requests about your data: our legitimate interest in helping you, and our legal obligations.

5. Ads, consent and tracking

The app shows three kinds of ads: a banner on list screens such as Home, Stats and the archive (never on the puzzle board), an occasional full-screen ad between Fun play rounds (never during a daily), and short videos you choose to watch in return for a hint or to unlock older puzzles in the archive.

Before any ads load, where it's required (for example in the EEA, the UK and Switzerland, and in US states with their own privacy laws), Google's consent screen asks for your choices about ads. On iPhone, after you finish your first puzzle, a short screen from us explains Apple's tracking question, and then Apple asks whether we may track you. Saying no to either doesn't change the game at all.

Personalised ads are only ever requested if you've agreed on the consent screen and, on iPhone, allowed tracking. In this version of the app, we go further than that and ask Google for non-personalised ads for everyone. Non-personalised ads are chosen from things like the app you're using and your rough location, not your browsing history, but Google still uses device information to limit how often you see an ad, to count views and clicks, and to fight fraud.

How to change your choices later:

• Your ad choices can be changed at any time in the app, in Settings > Manage privacy choices.
• On iPhone, open the Settings app, then Privacy & Security, then Tracking, and turn tracking off for The Golden Rule.
• On Android, open your phone's Settings, find Google, then Ads (on some phones it's under Privacy), and delete or reset your advertising ID.

6. Who we share it with

We don't sell your personal information for money. We share it only with these services, each for the reason given:

• Google AdMob and its advertising partners, to show, measure and protect ads, as described in section 5. Google decides how it uses this information for its own purposes, under its own privacy policy at policies.google.com/privacy.
• Supabase, which hosts our database, sign-in service and photo storage. Supabase processes the data on our behalf and under our instructions. Our Supabase project is hosted in the United States (the us-east-1 region).
• Apple and Google as sign-in providers, if you choose to sign in with them. They confirm who you are to us. What they collect when you use their sign-in is covered by their own privacy policies.
• Vercel, which hosts the wordjax.com website. Like any web host, it handles your IP address and basic request details when you visit the site.
• Other players, who see what section 3 says they can see on your profile, in the feed and in groups.
• Authorities or others, if the law requires it, or if we need to protect someone's safety, our rights, or the game from fraud or abuse.

If WordJax is ever transferred to a new owner, for example into a company, your information would move with it under the same promises made here.

7. International transfers

We're based in the United States and our servers are in the United States. If you use the game from somewhere else, including the EEA or the UK, your information is transferred to and stored in the US. Where the law requires it, we rely on the safeguards our providers offer for these transfers, such as the European Commission's standard contractual clauses in their data processing terms, or the provider's certification under the EU-US Data Privacy Framework and its UK extension.

8. How long we keep it

• Your account, profile, photo, follows, blocks, cheers, groups you own, group memberships, feed highlights, the reports you've made and your milestone records: kept until you delete your account, then removed.
• Spam-limit counters: cleared automatically, most after about two days, sign-in link records after about 40 days, and handle-change records after about 13 months.
• Failed recovery code attempts: about 24 hours.
• Game results, your streak copy and gameplay events: these belong to your random player ID rather than your account, so deleting your account doesn't delete them. They stay attached to that ID with no name or email connected to them. We don't yet delete them on a fixed schedule. If you'd like them deleted, email us and we'll do it. It helps to include your recovery code from Settings so we can find the right records.
• Reports other players made about you: kept after your account is deleted, together with the handle you had at the time, so we can deal with repeat abuse.
• Records of accounts being linked to player IDs: kept, as IDs only, so a mistaken or hijacked link can be undone.
• Support emails: kept in our mailbox. Ask us and we'll delete them.

Our hosting provider may also keep backup copies for a short period after something is deleted, until those backups are overwritten.

9. Deleting your account

In the app, open Settings, tap Account at the top, then tap Delete account and confirm with Delete for good. This removes your sign-in account, profile, photo, follows, blocks, cheers, feed highlights, group memberships and any groups you own (those groups close for their members), and the reports you've made. Your games and streaks stay on your phone, and your results stay on our server under your random player ID with no account attached, just like before you signed in. If the photo couldn't be removed at that moment, the app tells you. Email us and we'll remove it by hand.

10. Your rights

Everyone

Wherever you live, you can email us to ask what we hold about you, to get a copy, to correct it, or to delete it, and we'll do our best to help. You can edit your profile yourself at any time in the app.

If you're in the EEA, the UK or Switzerland

You have the right to access your personal data, to have it corrected, to have it erased, to restrict how we use it, to object to our use of it where we rely on legitimate interests, and to receive the data you gave us in a portable format. Where we rely on your consent, you can withdraw it at any time (see section 5), which doesn't affect what happened before. You also have the right to complain to your local data protection authority. In the UK that's the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to sort things out first, so please email us.

If you're in California or another US state with a privacy law

You have the right to know what personal information we collect, use and share, to delete it, to correct it, and to opt out of the "sale" or "sharing" of your personal information, including for targeted advertising. We won't treat you differently or give you a worse game for using any of these rights.

We don't sell personal information for money. Letting an ad network use device information for personalised ads can count as "sharing" or a "sale" under some state laws. In this version the app only asks for non-personalised ads, but to make sure, you can opt out by:

• choosing not to consent to personalised ads on the consent screen when it appears, or later in Settings > Manage privacy choices;
• turning off tracking on iPhone, or deleting or resetting your advertising ID on Android, as explained in section 5;
• emailing us with "Do Not Sell or Share" in the subject line.

The website has no ads and no tracking, so there's nothing to opt out of there. We don't collect sensitive personal information as these laws define it.

In the last 12 months, the categories of personal information we've collected are identifiers (player ID, account ID, email address, IP address and advertising ID through Google), profile and social content you create, internet or app activity (game results and gameplay events), and rough location worked out from an IP address by Google for ads. We collect them from you and your device, and from Apple or Google if you sign in with them. We use them for the purposes in section 4 and disclose them to the recipients in section 6.

How to make a request

Email jordan@wediorknot.com from the address you'd like us to reply to. So we don't hand your data to someone else, we may ask you to confirm something only you would know, such as your handle while signed in or your recovery code. You can also have someone you've authorised make a request for you. We'll reply within one month, or sooner where the law requires it. If we can't do what you ask, we'll tell you why, and you can ask us to look again.

11. Children

The Golden Rule isn't made for children and isn't directed at them. You need to be at least 13 years old to use it. In some countries, you need to be 16 to give consent to personalised ads yourself. If you're younger than that where you live, please don't agree to personalised ads on the consent screen. We haven't marked the app as child-directed with Google, because it isn't meant for children. If you think a child under 13 has given us personal information, email us and we'll delete it.

12. Security

Everything the app sends to our servers is encrypted in transit. Our database refuses direct access to its tables. Every request goes through functions that check who's asking and what they're allowed to see. Your sign-in session is kept in your phone's secure storage, and your recovery code is only stored on our side in scrambled form. No system is perfectly secure, though. If something goes wrong that affects your information, we'll tell you and any authority we're required to tell.

13. The website

You can play the daily puzzle in your browser at wordjax.com/goldenrule without an account. The website:

• saves your progress and settings in your browser's local storage, which never leaves your device. Clearing your browser data removes it;
• has no ads, no cookies, no analytics and no tracking pixels today, and loads nothing from any other company's servers;
• asks search engines not to list its pages;
• is hosted by Vercel, which handles your IP address to deliver the pages, as any web host does.

14. Changes to this policy

If we change how we handle your information, we'll update this page and the date at the top. If a change is significant, we'll also tell you in the app before it takes effect.

15. Contact

WordJax (Jordan Axelrod), Florida, USA.
Email: jordan@wediorknot.com