Privacy policy

Overview

Anagram Heist is a multiplayer word game. This policy explains what information the app uses to run accounts, host matches, provide safety tools, respond to support requests, and honor deletion requests.

Information we collect

Account information may include your Firebase Authentication identifier, email address if you choose email sign-in, sign-in provider, display name, and basic account settings. Google sign-in may be offered on supported platforms outside iOS.

Gameplay information may include your display name, room code, player state, words, scores, match events, connection state, preferences, stats, and achievements. Multiplayer safety information may include moderation reports, reported display names, target account identifiers, reasons, notes you provide, blocked-player lists, timestamps, and room context.

Screen recordings on our website

On our website, but never in the iOS or Android apps, we may record visits across the website, from the home page and game menus through tutorials, gameplay, results, settings, account, friend and shop pages, so we can see where players get stuck. A recording shows the pages as you saw them, including player names and what you type, except passwords, email addresses and anything typed into a phone or card field, which are masked. Player safety reports are never recorded.

Recordings are not linked to your account, though they can show your player name. They are stored by our analytics provider, PostHog, and deleted automatically within 90 days. We do not record visitors whose device is set to a European time zone. You can turn recordings off with the Game analytics switch in Settings › Privacy & data, or by using a browser that sends the Global Privacy Control signal.

How we use information

We use information to authenticate players, run multiplayer rooms, preserve account identity, keep gameplay and settings working, investigate bugs, prevent abuse, review reports, enforce safety rules, and respond to privacy or support requests. We do not sell personal information.

Sharing

We use service providers to operate the app. They process information on our behalf so Anagram Heist can function:

• Hosting and accounts: Google Firebase (sign-in, the game database and cloud functions) and the hosts of the website and multiplayer server.
• Sign-in providers: if you choose, Google or Apple signs you in, and we receive the account identifier and email address the provider shares.
• Payments: purchases on the web are processed by Stripe, and purchases in the apps by the Apple App Store or Google Play. We receive what we need to grant what you bought, such as a purchase identifier, the product and its status. We never see your full card number.
• Game analytics, only with your Game analytics choice on: Google Analytics counts things like rounds played and screens opened, and PostHog stores the website screen recordings described above.
• Measurement and advertising, only with your Advertising choice on: ad platforms (Meta, TikTok and Reddit) can measure whether their ads led to a visit or an install, and may show you the game again. In the apps, Tenjin measures which ad led to an install; on iPhone, only if you also allow tracking when asked.

Other players in a room may see your display name, words, score, and gameplay actions. Reports and blocks are not shown to the reported or blocked player as a public message.

Notifications

If you turn on notifications, your device’s push token is stored with your account so we can send the notifications you chose, such as friend requests and game invites. Turning notifications off, or signing out, removes this device’s token.

Friends and your profile

Your display name, handle, avatar and whether you are online are visible to friends and to players you play with. You can turn off profile discoverability in Settings › Privacy & data. Blocking a player hides you from each other.

Security and retention

Information is transmitted using secure connections where supported. Account data is retained while your account is active or as needed to operate the service, comply with legal obligations, resolve disputes, enforce safety rules, and prevent abuse. Temporary gameplay room state may be kept only as long as needed to run a match and related diagnostics.

Moderation reports and block records may be retained as needed to investigate safety issues and protect multiplayer play, even if some gameplay records expire sooner.

Zen reviews are kept for two years and multiplayer round logs for 400 days; deleting your account removes both. Website screen recordings are deleted within 90 days.

Your choices

You can change your display name in the app, sign out, report or block opponents during multiplayer play, and request access to, correction of, or deletion of account information. Signed-in players should use the in-app account deletion control when available.

Settings › Privacy & data has two switches: Game analytics and Advertising. In Europe both start off until you turn them on; elsewhere they start on, and you can turn either off at any time. A choice you make always wins.

Account deletion information is on the Account deletion page.

Children

Anagram Heist is not designed primarily for children under 13. If the app is offered to younger audiences in the future, this policy and the app’s data practices will be updated accordingly.

Contact

For privacy questions, support, or deletion help, email joshuasash@gmail.com.