Privacy Policy

Last updated 12 September 2026

What stays on your device

Your run in progress, your records — best word, longest word, deepest level, daily streak — which tips you have already been shown, the date the app last offered you the rating prompt, the first day the app was opened and the most recent day it reported being opened, and whether you have gameplay data switched on are saved on your device by the app. They are not transmitted anywhere, and they are removed when you delete the app.

There is no retention period to state for any of that, because we are not the ones keeping it: deleting the app deletes the lot. The gameplay numbers described next are the one thing that does not live on your device, and they have a retention period of their own.

Gameplay data

Lexicove is tuned by one person with no way to watch anyone play. Every difficulty number in it started as an educated guess, and the only honest way to correct those guesses is to see how the game actually goes for the people playing it. That is what this is for, and it is the whole of what it is for.

What is sent. Eight things happen worth reporting. Five are about how the game plays: a level is cleared, a run ends, a shuffle or hint is bought, a board with no words left is redealt, and the app takes a moment to do something you are waiting on. The first four carry numbers about the game — the level, the score, how many words were used against the budget, how much a word was worth against what the difficulty curve assumed it would be worth. The fifth is a number of milliseconds, so we can tell whether the app is slow on real phones rather than on the one it was written on. It travels with no description of your phone, which means we learn that something was slow somewhere and never whose it was.

Two are about sharing: you tap Share on a Daily result, and a link to a Daily board opens the app. The first says only where the button was. The second says only whether the link was for today’s board, an earlier one, or one too old to play. Never what was shared, who it went to, or who sent the link.

The last is that the app was opened today. It is sent at most once a day, and carries only the date and whether this is the first day the app on this device has sent it. It is how we count how many phones play on a given day. The app remembers the last date it sent, so it knows not to send it twice; that is a date, not an identifier, and it never leaves your phone.

All eight carry which version of the app was being played, since a number is meaningless without knowing which build produced it.

What is not sent. No name, no email, no account, no device identifier, no advertising identifier, and no identifier of our own — not for you, not for your install, not even for the session. Never the words you play, and never anything you type. Our server receives an IP address with every request, as any server does, and does not record it. Events travel in small batches, and the batch is not recorded either, so nothing in the stored data groups events by phone. Two limits on that, written here rather than left for you to find. Every event carries the day and which version of the app sent it: on a version’s first day, when very few phones are running it, the events sharing a day and a version may in fact be one player’s. And our host keeps a rolling recovery copy of the database, described below. Neither yields a name, an account, or any way to reach you. There is no profile here because there is nothing to build one from.

Where it goes. To a Cloudflare Worker we run ourselves, on Cloudflare’s infrastructure, covered by Cloudflare’s Privacy Policy. The code that sends these numbers is about eighty lines and it is ours; nothing is passed on to anyone after that.

How long it is kept. Rows are deleted after 400 days by a job that runs every night, rather than kept until somebody remembers to prune them. Separately, Cloudflare’s database service keeps a rolling 30-day history that can restore the database to any minute within that window. It cannot be switched off. It is a backup rather than a second copy anyone reads, but for those 30 days it can show which rows arrived together.

Turning it off. Records → Share how the game went. Off means off immediately: nothing further is sent, and anything the app had queued but not yet sent is discarded rather than held.

Deleting it. We cannot, and the reason is the point. Nothing in the data identifies you, so there is no row we could find and remove on your behalf even if you asked — and there is nothing in it that describes you rather than the game. If you would rather we had never had it, the switch above is the whole of the remedy.

Game Center

Game Center is the other thing Lexicove sends over a network, and only if you are signed in to it.

When a run ends, Lexicove submits your score to Apple’s Game Center leaderboards. Apple handles that data, not us: it is governed by Apple’s Privacy Policy, which affords it protection equal to or greater than this policy describes, and your Game Center nickname is shown on the leaderboard rather than your real name. We receive nothing back beyond what any player can see on the public board, and we do not store it.

If you would rather not take part, turn Game Center off in Settings → Game Center on your device. Lexicove is fully playable without it. Nothing is submitted, and no feature other than the leaderboards is affected.

Because we never receive or store a score, we cannot delete one for you. A submitted score sits on Apple’s leaderboards under your Game Center identity, so removing it is something only Apple can do — requests about data Apple holds go through Apple’s Data and Privacy page.

Rating the app

Once in a long while, after a run that went well, Lexicove asks iOS to consider showing Apple’s standard rating prompt. It is Apple’s, not ours. We hand iOS the request and that is the end of our involvement: the system decides whether to show it at all — it allows at most three a year, and we ask far less often than that — and it never tells us whether the prompt appeared, what you rated, or whether you wrote anything.

A rating or review you leave goes to Apple and appears on the App Store under your App Store nickname, governed by Apple’s Privacy Policy. We can read a published review the same way anyone can, and we receive nothing else.

The only thing the app records here is the date it last asked, kept on your device so that it does not ask again for months.

Sending feedback

The “Feedback” links on the home screen and in Records open a message in your own mail app, addressed to [email protected]. Nothing is sent unless you send it, and you can read, edit or delete every word first — including the single line of version and device information at the bottom, which is there so a bug report can be acted on.

There is no feedback form anywhere, and nothing of ours sits in the path between your mail app and our mailbox. If you do write, we then have your email address and whatever you chose to say, in an ordinary mailbox. It is used to answer you and for nothing else: no mailing list, no profile, and it is not connected to anything you do in the game, because there is nothing on our end to connect it to.

This website

lexicove.app is a handful of static pages. It sets no cookies of its own, and every image and stylesheet on it comes from this domain.

One thing on it does come from elsewhere: Cloudflare Web Analytics, which counts visits to the site. A small script loads from static.cloudflareinsights.com and reports back through this site’s own address, at /cdn-cgi/rum, which Cloudflare answers. It records the page you landed on, the page that sent you, your browser and device type, the country you are in, and how quickly the page drew. It sets no cookie and stores nothing on your device — it cannot, and we checked rather than took the word for it — so it does not follow you between visits or to any other site. There is no identifier in it, so two visits by you are not knowably the same person.

It measures the website only. Nothing it sees is connected to the app, to the numbers described above, or to anything you do while playing, and it is not affected by the app’s own opt-out. To block it, any content blocker or a browser’s tracker protection will; the site works exactly the same without it.

The site is hosted on Cloudflare Pages, alongside the Worker described above. Like any host, Cloudflare receives the IP address and request details of every visitor and processes them to serve the page and to protect the site from abuse; it may also set a cookie of its own to tell visitors from bots. That is Cloudflare’s infrastructure rather than ours, and it is covered by Cloudflare’s Privacy Policy. Nothing it does there is connected to anything you do in the app.

Changes

If this policy changes, the date at the top changes with it.

Contact

Lexicove is made by Kim Manis. Questions about this policy: [email protected]