Privacy Policy for Word Merge

This Privacy Policy describes how NorthFrame ("we," "us," or "our") collects, uses, and shares information when you use the Word Merge mobile application (the "App") on iOS or Android.

By using the App, you agree to the practices described in this policy. If you do not agree, please do not use the App.

1. Information We Collect

1.1 Account information

When you use the App, we automatically create an anonymous account associated with a unique device identifier. If you choose to sign in with Apple Sign-In or Google Sign-In, we also collect:

• Your name (as provided by Apple or Google)
• Your email address (as provided by Apple or Google)
• A unique account identifier (UID) issued by Firebase Authentication

You are not required to sign in to play. If you do not sign in, you remain on an anonymous account tied only to a device-generated UID.

1.2 Gameplay data

We store information about your play to enable cloud sync, leaderboards, and progression. This includes:

• Your chosen display name
• Best scores per board size
• Words you have discovered (your "Wordex")
• Achievements you have unlocked
• Total games played, level, and experience points
• In-game currency ("Ink") balance and power-up inventory
• App settings (sound, music, haptics preferences, selected tile skin)
• Move history and game seed for individual completed games (used to validate scores submitted to the leaderboard)

1.3 Leaderboard information

When you submit a score to the global leaderboard, your display name, score, and best word are visible to other authenticated users. Anonymous users are shown with a "GUEST" indicator. You may change your display name at any time in the App's Profile screen.

1.4 Device and diagnostic information

To deliver, secure, and improve the App, we automatically collect:

• Device model, operating system version, and language
• App version
• Crash reports and stack traces (via Firebase Crashlytics)
• Performance and diagnostic events (via Firebase Analytics, if enabled)

1.5 Advertising information

The App displays advertisements from Google AdMob. AdMob and its partners may collect:

• Your Advertising ID (Apple's IDFA on iOS, Google's AAID on Android), unless you have opted out of personalized advertising in your device settings
• IP address (used for fraud prevention and approximate geolocation)
• Coarse device and app information (model, OS, language, time zone)
• Interaction data with ads (impressions, clicks)

You can reset or limit your Advertising ID at any time through your device settings:

• iOS: Settings › Privacy & Security › Tracking, and Settings › Privacy & Security › Apple Advertising
• Android: Settings › Google › Ads

1.6 Information we do NOT collect

We do not collect:

• Your precise location
• Microphone, camera, or contacts data
• Health, financial, or biometric information
• Photos, videos, or files from your device

2. How We Use Information

We use the information described above to:

• Provide core App functionality (gameplay, save progress, sync across devices)
• Operate the global leaderboard and validate submitted scores
• Display advertisements
• Diagnose crashes and improve App stability
• Detect fraud, abuse, or violations of our terms
• Communicate with you about App updates or issues, if you contact us

3. Third-Party Services

The App relies on the following third-party services. Each has its own privacy policy governing the data it collects.

4. How We Share Information

We do not sell your personal information.

We share information only in these limited cases:

• With the third-party service providers listed above, strictly to provide the services they operate (e.g. ad serving, crash reporting, account authentication)
• With other App users, only to the extent that your display name, score, best word, and rank are visible on the global leaderboard
• If required by law, in response to a valid legal process (subpoena, court order, or similar)
• In a business transfer, if our App or its underlying business is sold, merged, or otherwise transferred — in which case we will notify you and this policy will continue to apply to your information

5. Data Retention

We retain your account and gameplay data for as long as your account is active. If you request deletion (see Section 8), we remove your account and associated gameplay data from our active systems within 30 days. Backup copies are removed within 90 days.

Crash and diagnostic data are retained for up to 90 days, then deleted or anonymized.

Advertising identifiers are retained according to Google AdMob's policies (see their privacy policy linked above).

6. Security

We use industry-standard security measures, including encrypted connections (TLS) for all network traffic, Firebase security rules to restrict who can read or write your data, and Google Cloud's infrastructure security. While no online service can be guaranteed 100% secure, we take reasonable steps to protect your information.

7. Children's Privacy

The App is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If we learn we have inadvertently collected information from a child under 13, we will delete it promptly. If you are a parent or guardian and believe your child has provided us information, please contact us at the address below.

8. Your Rights and Choices

Depending on your location, you may have rights to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your information
• Object to or restrict certain processing
• Opt out of personalized advertising (via your device settings — see Section 1.5)

Account and data deletion

You may delete your account and all associated gameplay data directly inside the App: open the Profile tab, scroll to Privacy & Account, and tap Delete Account. Deletion is processed immediately and is irreversible.

If you are unable to access the App, you may also request deletion by emailing NorthFrameDev@gmail.com with the subject line "Delete my account" and the email address (or account UID) associated with your account. We will confirm receipt within 5 business days and complete deletion within 30 days.

European users (GDPR)

If you are in the European Economic Area, United Kingdom, or Switzerland, the legal bases for our processing are: (a) performance of our contract with you to provide the App; (b) our legitimate interests in operating, improving, and securing the App; and (c) your consent where required (e.g. for personalized advertising). You may also have the right to lodge a complaint with your local data protection authority.

California users (CCPA / CPRA)

California residents have additional rights under the CCPA and CPRA, including the right to know what personal information is collected, the right to deletion, and the right to opt out of "sale" or "sharing" of personal information. We do not sell personal information. To exercise these rights, contact us at the email address above.

9. International Data Transfers

The App is operated using Google Cloud infrastructure, which may store and process your information in the United States or other countries where Google operates data centers. By using the App, you consent to this transfer.

10. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this policy. For material changes, we will provide additional notice in the App or by email (where available). Your continued use of the App after changes take effect constitutes your acceptance of the updated policy.

11. Contact