Privacy

Last updated: October 29, 2026

Oddword is a word game. It is built to work with as little information about you as possible. You can play every day without an account, and nothing below is sold, shared for advertising, or used to follow you around the web. There are no ads and no third-party trackers. To know how many people visit, we count page views with Vercel Web Analytics: it sets no cookies and keeps nothing that says who you are.

If you just play

You do not need an account to play. Your streak, scores and settings are saved in your own browser, on your own device.

So that the game can show how real players did, your browser sends us:

a random ID made by the game for this browser. It is not built from your phone or computer, and it is not your name;
for a daily puzzle: the puzzle number, the words you played, your score and the time;
for an Endless run: the day, your score, how many rounds you reached, how many words you found, how long it took, which rounds you cleared or missed, in how many of them you found a pangram, and how many times the game was hidden while you played (for example by switching to another tab or app). That last number is used only to help spot scores made with outside help; we do not record where you went. The same count is kept for a daily puzzle. The owner of the game can see these play records per browser (by a shortened form of its random ID), for the same reason.
for every game: which games were played in this browser on each day (for example Zen, Bank or Bust or a duel), so we can count how many people play. This is deleted after 12 months.
if you send a message with “Suggest an idea”: your message and when you sent it, stored with this browser’s random ID (and your account, if you are signed in). Only the developer reads these messages, and they are deleted after 12 months.

We add these to running totals (for example, how many players found each word). The individual plays and runs are deleted after 12 months. The totals are kept, and they do not point to anyone.

Three more things are counted, as totals only. They are not saved next to your random ID:

how many words into the daily puzzle players get before they stop;
the first time a browser opens Oddword, the name of the website it came from (for example "google.com"), or nothing if it came directly. Only the site's name, never the page;
how many times the game has asked our server for something this month.

If you turn on notifications

We store the address your browser gives us for sending you a notification (it belongs to Apple, Google, Mozilla or Microsoft, depending on your browser), the hour they are sent (7 in the morning), your time zone, and which kinds of notification are on. Notifications never contain your name, your score or anything personal. Turn notifications off in the game and all of this is deleted. It is also deleted automatically if the address stops working.

If you make an account

An account is optional. It lets you keep your progress across devices, play duels and add friends. There are two ways to make one: with Google, or with a link we email you.

With Google: we ask Google for the smallest thing it offers that includes a first name. We keep two things: Google's ID number for your account, and your first name. Your first name becomes your username to start with, so other players you duel or add as a friend can see it; you can change it to anything else in your profile at any time. If the first name does not pass our username rules, you are asked to type a username instead. We do not receive your email address from Google. Google also offers us your full name and the link to your profile picture as part of the same permission. We do not store your full name. Your picture is shown in your own avatar using a cookie that stays in your browser; we do not store its link, with one exception: if you turn on "Show my photo to other players" in Settings (it is off unless you turn it on), we keep the link to your picture, not the picture itself, so the other players in a duel, and your friends, can see it. Turn the setting off and the link is deleted. It is also deleted when you sign out or delete your account. Another player can report a photo; a reported photo is hidden until we have looked at it. Because the picture itself stays on Google's servers, a browser that shows it asks Google for it directly.
With an email link: you type your email address and we email you a link that signs you in. We do not keep your address. We keep a scrambled fingerprint of it: a long string of letters and numbers that lets us recognise the same address when you type it again, but cannot be turned back into the address. To deliver the link, your address passes through our email provider, Resend, and Resend keeps its own records of the emails it delivers.

If you signed in with an email link, you choose a username after you sign in. Whichever way you signed in, we also store:

your username and four-digit tag;
your saved progress (results, words found, tile finishes, best Endless scores, and whether you used the day's pangram hint), so it can follow you to another device;
the random IDs of the browsers you have signed in on (the last ten);
for each place you are signed in: a random sign-in number, a rough kind of device worked out from your browser (such as "iPhone" or "Windows computer"), and the days it was signed in and last used (the day only, not the time). This is what Settings shows under "Signed in on N devices", and it is how "Sign out" and "Sign out on every device" end those sign-ins. An entry is deleted when you sign out there, and all of them when you sign out on every device;
when you last opened the game while signed in (one time, updated as you play; not a history of visits);
how long you have played, as a total number of seconds for each of the last ten browsers you signed in on, plus one combined total for any older ones (totals, not a record of when);
any special tile we have given you as a gift, and when;
a mark if we have made you a playtester or a developer of the game, or let you wear every tile;
if someone reports a username as inappropriate, the report, until it has been looked at. A reported name is hidden from other players until then.
if the owner of the game pauses or bans an account for breaking the rules (for example, scores made with a program): when the ban started, when it ends, and the reason, which you are shown. If you send an appeal, we store the text you wrote until the ban ends or the account is deleted. Only the owner of the game can read it. If a banned account is deleted, we keep a scrambled fingerprint of its sign-in together with the ban until the ban ends (for a permanent ban, it is kept), so that a new account made with the same sign-in starts with the same ban.

Please do not use your real full name as a username.

Signing in uses one cookie. It only remembers that you are signed in. It is not used for tracking. Signing in with Google uses a second cookie for up to ten minutes, while you are on Google's page, and a third that holds the link to your Google profile picture so your own avatar can show it. Signing out removes it.

What we do with an email address

We use it for one thing: sending you the sign-in link you asked for. That is also how you get back into your account on a new device.
No newsletters, no marketing, no reminders by email. We could not send them if we wanted to, because we do not have your address.
It is never shown to other players, and it does not appear on our own admin page either.
The email contains the sign-in link and nothing else: no pictures, and nothing that reports whether you opened it.
A link works once and stops working after 15 minutes. While it is waiting we store a scrambled copy of the link (not the link itself) with the fingerprint and your browser's random ID. That record is deleted when the link is used, or by a daily clean-up if it never is.
To stop someone flooding an inbox, we count how many links were asked for per fingerprint and per browser. Those counts are deleted within two days.

If you play duels

A duel can have up to eight players. We store each duel: the accounts that played (up to eight), the kind of duel (Classic, Clash, Blitz, Hot Potato or Team Duel), the letters, the words each player found with their scores, and the result. In Hot Potato we also store whose turn it was and how many lives each player had left; in Team Duel, which team each player was on. Everyone in a duel can see the other players' usernames, and their photos if they switched that on. Duel records are deleted after 90 days. Room codes stop working after 24 hours.

If a friend invites you to a duel, we store the invite until it is answered or runs out (ten minutes at most): who sent it, which room and which kind of duel. If you say no, we remember that for that room for a day so you are not asked twice. Invites carry no message.

If you add friends

Friends are optional and need an account. Two players become friends only when both agree: one asks, by the other's exact username and four-digit tag or with an invite link, and the other accepts. There is no way to search for players or browse them, and there are no messages between players.

A friend can see your username and tag, your photo if you switched "Show my photo" on, your score on today's puzzle, your best word from today's puzzle (only after they have finished it themselves) and your streak in days, plus the "Online" mark described below. Nothing else: not your other words, your history, how you signed in or the time you were last here.
Friends can also see your best Endless run of the week: its score and the round it reached. We keep that for this week and last week (weeks run Monday to Sunday, US Eastern time), not the words you played or when in the week you played.
We store your list of friends, requests that are waiting, players you have blocked, and your invite code. A request that is not answered lapses after 30 days.
You can remove a friend, decline or block a request, or get a new invite code at any time. A blocked player is not told.

Your friends can see a green "Online" mark by your name while you have Oddword open, and for up to five minutes after. Only friends you have both agreed to can see it, and only if they show theirs too. You can turn this off in Settings ("Show friends when I'm online"): then you never appear online and you do not see who else is. To show it, we keep one time stamp of when you were last active; it is replaced as you play, deleted when you turn the setting off, and never shown to anyone as a time.

What we never store

Your email address itself (see above), last names, photos (only a link to your Google picture, and only if you switch that on), passwords or dates of birth.
Your location, your contacts, or advertising IDs.
Your internet (IP) address. To stop abuse we count requests under a scrambled form of it that changes every day; those counts are deleted within two days, and the address itself is never saved. The same scrambled form is used to count how many new players a single address adds to a day's puzzle, so that one machine pretending to be many players cannot change the word percentages; those counts are deleted within two days too. For the same reason we count how many requests each browser's random ID makes per minute and per day; those counts are deleted within two days too. Our hosting company, Vercel, sees it briefly in order to deliver the page, as every web host does.
Details about your browser or device model, beyond the rough kind of device for each sign-in described above.
Anything from other websites, apart from the name of the site that sent you here the first time (see "If you just play").

Who helps us run Oddword

The site is hosted by Vercel and the database is run by Supabase. They process the information above on our behalf. Notifications travel through your browser maker's own service (Apple, Google, Mozilla or Microsoft). Sign in with Google involves Google only if you choose it. Sign-in emails are delivered by Resend, and only if you choose to sign in by email: Resend receives your address and the email we send you, and keeps its own delivery records under its own privacy policy.

Deleting everything

Account: open your profile in the game, go to the Account tab and choose "Delete my account". This removes the account, your saved progress, your duels, your friends list and requests (they disappear from the other players' lists too), reports about your username, the link between the account and your plays, and, if you signed in by email, the fingerprint of your address and any sign-in links still waiting, straight away. Records that Resend holds of emails already delivered are Resend's own; write to us if you want help with those.
Notifications: turn them off in the game. The stored address is deleted.
This device: clear the site's data in your browser settings. That removes the random ID and everything saved on the device (your results, tiles and choices such as sound, dark mode, reduced motion and vibration). Settings also has "Download my data": it makes a file of what this device has saved, inside your browser; nothing is sent to us. Plays already sent can no longer be connected to you, and they are deleted within 12 months.
Or write to us at the address below and we will do it for you.

Children

Oddword is suitable for all ages, and playing never needs an account, an email address or any personal information. The daily puzzle, the archive and Endless all work without signing in.

An account is only needed to keep progress across devices, to play duels and to add friends. Making one means signing in with Google or with an email link. If you are under 13, do not make an account unless a parent or guardian has said yes and is with you when you do it. We do not ask for your age, and we do not knowingly keep an account for a child under 13 without a parent's or guardian's permission.

What an account holds is kept small on purpose: a username (your Google first name to start with, or one you choose), your game progress, your friends list, Google's ID number and your first name if you used Google, or a scrambled fingerprint of the email address if you used an email link (never the address itself). A Google profile photo is shown to other players only if you switch that on yourself.

If you are a parent, guardian or teacher, you can ask us to delete a child's account, or anything else of theirs, by writing to the address below. Tell us the username and four-digit tag if you can, and we will remove it. Anyone can also delete their own account from their profile, which removes everything stored with it.

Contact

Questions or requests: ejman123@icloud.com