Word Hurdle — Privacy Policy

Effective: 28 August 2026 · Last updated: 28 August 2026

Word Hurdle ("the app", "we", "us") is published by RopoLabs. Questions about this policy: privacy@ropolabs.com.

This policy describes the Word Hurdle app for iOS (bundle id com.wordlehurdle.prod). It is written against what the app actually does. Where a thing is commonly collected by games of this kind and we do not collect it, we say so, because that is as much a part of an honest policy as what we do collect.

1. The short version

We do not ask for your name, email, address, or date of birth in order to play.
An anonymous account is created for you the first time you open the app, so your progress and purchases survive. You never have to sign in.
We store how you play — including the words you guessed — because scores are verified on our server rather than trusted from your phone.
Your display name and scores are public, readable by anyone.
We show ads through Google AdMob, and we ask for tracking permission on iOS.
We do not collect your location, contacts, photos, microphone, camera, health data, or browsing history. We hold no payment details and no email address on our own servers.
You can delete your account from inside the app. Section 9 says exactly what that removes and what it does not.

2. Your account, and the one we make for you

We create an account before you do anything. The first time you open Word Hurdle, the app creates an anonymous account with our identity provider, SendoraCloud, so that your progress, streaks and purchases have somewhere to live. This happens without a sign-up screen and without any personal information.

The credential for that account is stored in the iOS Keychain, which — unlike the app's other storage — survives deleting the app. If you delete Word Hurdle and reinstall it, you return to the same account, not a fresh one. If you want a genuinely clean break, use the account deletion in Section 9 rather than deleting the app.

You may optionally link:

Sign in with Apple — we request your name and email address. If you use Apple's Private Relay, we receive the relay address, not your real one. Your email is held by SendoraCloud; our own servers never store an email address.
Email and password — held by SendoraCloud.
Game Center — Apple sends us a signed Game Center identity. Note that this can happen automatically: on a new install, a guest account with no progress is linked to Game Center shortly after launch without you tapping anything.

We store, on our own servers: your account identifier, when the account was created, when it was last seen, your public display name, and a normalised form of that name used to keep names unique. That is the whole of it. No email, no phone number, no date of birth, no real-name field.

Your public display name

New accounts are given an assigned handle (for example, BraveOtter42). You can change it at any time in Account.

However — if you link Apple or Game Center, the name from that account is adopted as your public display name automatically, without asking you. For Sign in with Apple that is the full name you gave Apple; for Game Center it is your Game Center alias. For many people this is their real name, and it will appear on a leaderboard that anyone can read. You can replace it at any time in Account, and we would encourage you to check it if this matters to you.

If you previously played the older version of Word Hurdle, your name may also have been imported from that app (Section 8).

3. How you play

Scores in Word Hurdle are verified on our server, not accepted from your phone. That is what keeps the leaderboards meaningful, and it is why we hold more than a score.

For each finished game we store: the mode, the puzzle or level, whether you won, how many attempts you took, your score, and the ordered list of words you guessed. Our server replays those guesses against the same puzzle to work out the honest result. For Cascade runs we also store the cell paths of the words you traced.

We also store: your Cascade campaign progress, daily-challenge history and streaks, milestone claims, XP, level, games played and won, and your in-game currency balances and the ledger of every change to them.

Challenges. If you create a challenge, the word you chose and your own solve are stored and shown to the players you challenge. If you play someone else's challenge, your attempt — including your guesses — is stored and your result is shown to the challenge's creator and other players on its board.

Automated fair-play checks. We run automated checks over play records for signs of impossible or manipulated results. An account the checks flag is removed from all public leaderboards. This is an automated determination with a visible consequence; if you believe it is wrong, contact us at privacy@ropolabs.com and a person will look at it.

4. What is public

The following are shown to other people, and the leaderboard and challenge boards can be read without an account and without signing in:

your display name
your XP, level, and games won
your best Cascade score and move count, and your position on any level's board
your daily-challenge results on the daily board
challenges you created and results on them

We never publish your account identifier, your email, or your purchase history.

5. Purchases

Purchases are made through Apple. We never see your card, your Apple ID, your billing address, or what you actually paid. Apple handles the transaction and tells us it happened.

We store: the Apple transaction identifier, which product was bought, whether it was a production or sandbox transaction, and for subscriptions the expiry date. We keep these records to deliver what you bought, to restore purchases on a new device, and to prevent the same transaction being redeemed twice. We hold no price and no currency; the app's own price list is used wherever a value is needed.

If you dispute a charge or ask Apple for a refund

When a customer disputes a purchase of a consumable item, Apple may ask the developer for information to help it decide. When Apple asks us, we respond, and the response tells Apple whether you have consented to that sharing.

What we send is deliberately coarse — Apple's own banded categories, never exact figures:

how much of the purchased item you had used (one of four states)
roughly how long your account has existed (one of eight ranges)
roughly how much time you have spent playing (one of eight ranges), estimated from how many games you have played rather than measured
roughly how much you have spent in the app in total, and how much has previously been refunded (Apple's US-dollar bands)
whether the item was delivered, whether the account is in good standing, and the platform

We do not send Apple your account identifier — the field that would link the transaction back to your Word Hurdle account is deliberately left empty. We do not tell Apple whether we think the refund should be granted.

This happens only when a purchase is disputed or refunded. It is not routine and it does not happen while you play.

6. Advertising

Unless you have bought Remove Ads or Pro, Word Hurdle shows ads supplied by Google AdMob. You can also choose to watch a rewarded ad in exchange for in-game gems.

What Google receives. Google's advertising SDK is part of the app and sends Google its own device identifiers, the ad slots requested, and whether ads were shown, clicked, or failed. Google also infers your approximate location from your IP address — we want to be exact about this: the app never asks iOS for your location and could not read it if it wanted to, and there is no location permission in the app at all. The approximation is Google's, made from the network connection.

Rewarded ads share your account identifier with Google. When you watch a rewarded ad for gems, we pass your Word Hurdle account identifier to Google so that Google can tell our server which account to credit when the ad completes. This is the one place your account identifier reaches an advertising company.

Tracking permission (ATT). On iOS we show Apple's tracking prompt. Word Hurdle's own code never reads your advertising identifier (IDFA) — granting the prompt permits Google's SDK to read and transmit it, which is what allows personalised ads. Declining is entirely fine: you get non-personalised ads and the game is identical.

In the EU/EEA and UK we show Google's consent form before any of this, and you can reopen your choices at any time from Settings → Ad privacy settings.

Please note: the advertising SDK still starts up, and the tracking prompt may still appear, even if you have bought Remove Ads or Pro. No ads are shown to you, but we would rather state this than imply the ad code is switched off for subscribers.

Word Hurdle does not use any other advertising network, and no ad mediation partners.

7. Crash reports and app analytics

Crash reporting — Sentry. When the app crashes or hits an error we handle, we send a report to Sentry containing the error, its message, the stack trace, the app version, and recent diagnostic breadcrumbs (which can include console output and the addresses of requests the app made). We do not attach your account identifier, and we have deliberately disabled screenshots, screen recording, session replay and view-hierarchy capture. Sentry's own SDK attaches a random identifier that is unique to your installation of the app, so multiple reports from the same install can be grouped.

App analytics — SendoraCloud. Our identity provider's SDK records basic lifecycle events: when a session starts, when the app is opened, and when it moves to and from the background, along with how long the session lasted. These carry a per-installation identifier, your account identifier once you have one, your device model, your iOS version, and the app version. We use this only to understand how often and how long the app is used. The per-installation identifier is replaced whenever you sign out or delete your account.

Our servers. Our own operational logs record account identifiers and Apple transaction identifiers for a small number of events, such as a refund being processed. They do not contain your name, your guesses, or your IP address.

Networking. Our API sits behind Cloudflare, which terminates the secure connection and therefore sees the IP address your device connects from, under Cloudflare's own terms. We do not store IP addresses. The only use of an IP address in our own code is an in-memory counter, held for sixty seconds, that stops any one connection making too many requests.

8. If you played the older Word Hurdle

Word Hurdle was previously a different app that stored its data with Google Firebase. If you update in place from that version, the app will — once, automatically, at launch — read your existing session and import your progress: games played and won, your hint balance, your name, and your daily puzzle history. This is how your old account survives the rebuild.

We permanently keep the Firebase identifier from that old account. It is the only thing that stops the one-time import running twice and granting the same rewards again, so it is retained even after account deletion.

The older app collected considerably more than this one does — it used Firebase Analytics, Firebase Crashlytics, a Firestore database, and a second advertising network. None of that is in the current app. If you are still running the old version, that version's behaviour is what applies to you until you update.

9. Keeping and deleting your data

Retention. We keep your data for as long as your account exists. We do not currently operate an automatic deletion schedule; deletion happens when you ask for it.

Deleting your account. In the app: Account → Delete account. This is a real deletion, not a deactivation, and it runs immediately.

It deletes:

your entire play history, including every stored guess sequence
your Cascade campaign progress and daily milestone claims
your imported daily history from the older app
your XP, level, streaks, currency balances and the whole currency ledger
your public display name
your identity record with SendoraCloud, including your email address if you had linked one

It deliberately keeps, and we would rather tell you than not:

Your purchase records. Apple transaction identifiers and what was bought are kept indefinitely, so that a transaction cannot be redeemed a second time on a new account. This is the reason a minimal account row (your identifier and its dates) also survives.
A normalised copy of your display name, held under a uniqueness index. Your visible name is removed; this internal form is not.
The Firebase identifier from the older app, if you migrated, for the reason in Section 8.
Challenges you created and attempts you made on other people's challenges, including their guesses — because other players' results depend on those records. Your name is removed from them.
A single record of how much of your purchased currency had been spent, for refund handling.
Internal records of account holds, merges, and device-takeover reports.

Deletion does not reach crash reports already sent to Sentry (they carry no identifier of yours) or analytics events already recorded.

Your rights. Depending on where you live, you may have the right to access, correct, export, restrict, or object to our use of your data, to withdraw consent, and to complain to a data protection authority. Write to privacy@ropolabs.com and we will respond.

For California residents: our sharing of advertising identifiers with Google for personalised advertising may be considered "sharing for cross-context behavioural advertising". You can opt out by declining the App Tracking Transparency prompt, or by turning off "Allow Apps to Request to Track" in iOS Settings.

10. Children

Word Hurdle is not directed to children, and we do not knowingly collect information from children under 13 (or the equivalent age in your country). The app does not ask your age. Ad content is limited to a general-audience rating. If you believe a child has created an account, contact privacy@ropolabs.com and we will delete it.

11. Where your data goes

The companies that process data on our behalf, and what each receives:

Who	What they get	Why
SendoraCloud	Account identity, email if you linked one, app lifecycle events	Sign-in, accounts, app analytics
Google (AdMob & UMP)	Advertising identifiers, IP-derived approximate location, ad interactions; your account identifier on rewarded ads	Serving ads, consent management
Apple	Purchase transactions; Game Center identity; the banded refund information in Section 5	Payments, Game Center, refund adjudication
Sentry	Crash reports and diagnostics with a per-install identifier	Fixing crashes
Cloudflare	Your IP address, in transit	Secure delivery of our API
Google Firebase	Only on the one-time import for players of the older app	Migrating your old progress

Our servers are located in the United States (Phoenix, Arizona). If you are in the EEA or UK, your data may be transferred outside it; where that happens we rely on the appropriate safeguards, including standard contractual clauses.

12. Security

Your sign-in credential is stored in the iOS Keychain, encrypted at rest by the operating system. All communication with our servers uses TLS. Access to production systems is limited to the people who operate them. No system is perfect, and we do not claim otherwise.

13. Changes

If we change this policy in a way that materially affects you, we will update the date at the top and note the change in the app before it takes effect.

14. Contact

RopoLabs privacy@ropolabs.com