$word privacy notice
$word is a strategy game in closed alpha, run by its two developers (Parted Productions). This page lists every piece of information about you that the game and its servers collect, why, where it goes, who can see it and how long it stays. It describes the code as it is today. Things that are planned but not yet switched on are marked as planned.
Contact for privacy questions and deletion requests: noahjohnson0@gmail.com
In short
- You sign in with a Google account. We keep your email address, your account id and the commander name you choose, so that only invited people can play and so that you get your own kingdom back after a reload.
- Other players can see the commander name you chose while you are in a match. Your Google name is never used as your commander name.
- The multiplayer server keeps a log of joins, leaves and the kind of each order, and a full replay of every online match, including private chat and trade terms between players.
- During multiplayer your game sends the server a small performance sample (frame rate, memory, platform, browser engine family, window size) every 30 seconds. It is on by default and you can turn it off in the pause menu.
- Problem reports are sent only when you press SEND REPORT, and the reporting service is not switched on in the current build.
- There are no adverts, no analytics or tracking scripts, and nothing is sold or shared for marketing.
- Several things have no automatic deletion yet. They are listed plainly under How long.
Signing in and the invite list
Google sign-in (Firebase Authentication)
The sign-in page uses Google sign-in through Firebase Authentication, a Google service. Google tells the game your email address, whether Google has verified it, your Google account id for this game, and the name on your Google account. Firebase keeps its own account record for you (email, name, profile photo address, account id, and when you signed up and last signed in). Only the two operators can see that record, in the Firebase console.
Invite check
The alpha is invite only. Your email address is compared with the
invite list: either a list set in the web server's configuration, or
an invites record in our Firestore database (also a Google
service). An invite record holds your email address, which operator
invited you and when. The server also keeps an index of invites whose
document names are a keyed hash of the email address rather than the
address itself. The invite is checked again on every page load and
every join, so removing an invite takes effect on your next request.
Your account record
When an invited account signs in, the server writes a
players record in Firestore under your account id. It
holds your account id, email address, commander name, when you first
and last signed in, and how many times you have signed in. The first
and last sign-in times and the count are shown to the operators in the
invite console; they are not used for any decision.
If loading or saving your commander name fails at the database, the server writes one line about it to the web host's function log: your account id and the database's error, with your email address, names and sign-in token removed. The operators use it to find and fix the failure.
Session cookie and join tickets
After sign-in the server sets one cookie, sword_session.
It contains your account id, email address and commander name, signed
so it cannot be forged (it is signed, not encrypted). It is
HttpOnly and Secure, lasts at most 12 hours,
and is removed when you sign out. It is the only cookie the game sets.
When you join a multiplayer match, the web server gives your browser a join ticket containing your account id and commander name. It is valid for two minutes and is not stored by the server.
Abuse limits
To stop anyone hammering the sign-in, join and name endpoints, the server counts requests per account and per IP address in Firestore. The counter's name is a keyed hash of the account id or IP address, so the record itself does not contain either; it holds only a count and the start of a short time window.
Your commander name, and who sees it
Your commander name is only ever a name you type yourself. The game never takes it from your Google account: a new account has no name until you choose one right after your first sign-in, and the name you choose cannot be the name on your Google account. You cannot join a multiplayer match until you have chosen one. You can change it at any time in SETTINGS on the title screen. Names are 1 to 18 characters and do not have to be unique.
While you are in a multiplayer match, your commander name and your kingdom are shown to the other players in the match (lobby, roster, war log messages such as who holds the rival crown).
The game server also has a public status address (/status
on the realm host) that anyone on the internet can request. It shows
which kingdoms are taken, whether they are ready, the campaign clock and
the match phase. It does not show commander names, email addresses,
account ids or connection details.
Your commander name is also written to the server's log and to match replays (see below). Your email address and account id are never shown to other players.
Playing multiplayer
Multiplayer runs on our game server ("the realm"), a virtual private server rented from Hostinger, located in the United States. There are two realms, staging and production, each with its own storage. Single-player campaigns run entirely in your browser and send nothing to the realm.
What your game sends the realm
Your game sends exactly three kinds of message: the join handshake (protocol version, join ticket, commander name, and the kingdom you picked, if you picked one), the kingdom you choose in the lobby, and your orders (for example marches, recruitment, market trades, diplomacy offers and private chat messages to another kingdom). Performance samples, described next, travel on the same channel as orders. While you are connected, and for 180 seconds after you disconnect, the realm holds your account id in memory so it can give your kingdom back to you if you rejoin. That is not written to disk.
Performance samples
During multiplayer, and only once the realm has said it accepts them, your game sends the realm one performance sample every 30 seconds. A sample holds exactly these ten values: frames per second, frame time, memory use, platform (web or desktop), the graphics rendering method (not your graphics card's name), the browser engine family (Chromium, WebKit, Gecko or other; not your browser's full identification string), window width and height, and the game's build and protocol version. The realm checks each sample, discards anything that does not have exactly that shape or arrives more often than once every 10 seconds, and writes the rest to its log tagged with your kingdom and connection number, next to its own measurements. Samples are not recorded in replays and do not affect the match.
Sharing is on by default. Turn it off with Share performance data in the pause menu (Esc, under SETTINGS). The choice is saved on your device and applies from the next sample. Single-player games send nothing.
The realm's log
The realm writes a session log. For players it records:
- joins and leaves, with kingdom, commander name and a connection number;
- refused joins and refused orders, with the reason;
- each order as the kingdom and the kind of order and how many fields it had, not what was in it. Private chat and trade offers are written as
[private diplomacy]; - each private trade between kingdoms as it is offered, accepted, declined, canceled or expires: the two kingdoms, what was offered and asked for, what was held in escrow, and what each kingdom's stores actually gained or lost. Chat text is never part of these lines;
- each public market listing as it is posted, filled, canceled or removed: the kingdoms involved, the resource, quantity, price, fee and refund. Public listings are already visible to every player;
- war log messages, which can name a commander (for example who holds the rival crown), battles, captures and resource totals for each kingdom;
- the server's own performance (memory, frame time, number of players), and how many performance samples it accepted or discarded;
- your game's performance samples, unless you turned them off (see Performance samples).
The log does not record IP addresses, email addresses or account ids. The same lines are also printed to the server's console output, which the container host keeps. The web proxy in front of the realm sees your IP address when you connect but is not configured to keep an access log.
Match replays
Every online match is recorded by the realm as a replay so that we can re-run it for balance work. A replay contains each kingdom's commander name, every order each kingdom gave and when, including the full text of private chat messages and the terms of private trade offers between players, and the state of the match over time. It does not contain email addresses, account ids, IP addresses or connection numbers. If you would rather not be recorded, play single player: single-player games are not recorded.
Problem reports
REPORT A PROBLEM on the title screen and in the pause menu builds a report on your device. Nothing is sent unless you press SEND REPORT, and in the current build the reporting service is not switched on, so the screen says reporting is unavailable and nothing leaves your device.
When it is switched on, a report contains your description, the game's build identity, the ids of up to three recent sessions, and up to 256 KiB of your recent session logs. Before sending, the game removes player names, email addresses, account identifiers, sign-in tickets and other credentials, IP addresses and server addresses, your computer's account folder name, private diplomacy and the terms of private trades, from both the logs and your description. The report goes to a small relay we run on Cloudflare Workers, which counts reports per IP address for one minute to limit abuse and passes the report on to a private report channel in our Discord server. Only the two operators can read that channel. The relay does not store the report.
On your device
The game stores these in your browser. Clearing the site's data removes them.
- Firebase keeps you signed in to Google for this game in the browser's storage until you sign out.
- Your settings (commander name, sound and display settings, and whether to share performance data) in the game's save area.
- If account sync fails while choosing a name, an unsynced name draft tied to your account id, removed when it syncs or you sign out.
- The game's session logs, the same kinds of line as the realm log above, from your own point of view, except that the terms of private trades are written as
[private trade]. They stay on your device unless you send a problem report, and are deleted 30 days after their last write, the next time the game starts. - A cache of the game's own files so the next visit loads faster. It holds no personal information.
Planned changes that will affect this notice
None at present.
Who can see your information
- The two operators can see everything described here: invites, account records, sign-in history, realm logs, replays and problem reports.
- Other players see your commander name, your kingdom and what you do in the match. Private chat and trade offers are shown only to you and the kingdom you sent them to.
- Anyone can read the realm's status address, which shows which kingdoms are taken in the current match but no names.
- Service providers that host the game process data on our behalf: Google (Firebase Authentication and Firestore, and the Google sign-in screens), Vercel (serves this website and runs the sign-in, invite, name and join-ticket endpoints, so it sees every page request including your IP address), Hostinger (hosts the realm and its logs and replays), Cloudflare (runs the report relay) and Discord (holds the report channel). Each keeps its own service logs under its own policy. Where it is stored: Firestore in Google's United States multi-region (nam5); Vercel's functions in Washington, D.C., United States (iad1); the realm on Hostinger in the United States. Firebase Authentication is a global Google service.
We do not sell or share any of this for advertising or marketing, and the site loads no analytics or tracking scripts.
How long it is kept
| What | Where | How long |
|---|---|---|
| Session cookie | Your browser | At most 12 hours; removed on sign out. |
| Join ticket | Your browser, then the realm's memory | Valid for 2 minutes; not stored. |
| Account id held for rejoining | Realm memory | While connected and 180 seconds after; lost when the realm restarts. |
| Firebase account record | Google Firebase | No automatic deletion. Kept until an operator deletes it. |
Account record (players) | Firestore | No automatic deletion. Removing an invite does not delete it; an operator deletes it by hand. |
| Invite record | Firestore | Until an operator removes the invite. |
| Abuse-limit counters | Firestore | No deletion: the database rules forbid deleting them. They hold only a count, a time and a keyed hash. |
| Realm session logs | Realm storage | Deleted once their last write is more than 30 days old, checked when the realm process next starts. A realm that runs for a long time without restarting keeps older logs until it restarts. |
| Realm console output | Realm container host | [To be confirmed: no rotation is configured in the repository.] |
| Match replays | Realm storage | No automatic deletion. Kept until an operator deletes them. |
| Logs and replays from before 9 September 2026 | An older storage volume on the realm server | No automatic deletion. [To be confirmed whether this volume still exists.] |
| Problem reports (when enabled) | Discord | No automatic deletion. Kept until an operator deletes the message. |
| Session logs on your device | Your browser | 30 days after their last write, removed the next time the game starts; or when you clear site data. |
Your choices and deletion
- Pick any commander name you like, other than your Google name; it does not have to be your real name. Change it in SETTINGS.
- Play single player if you do not want to appear in multiplayer logs or replays.
- Turn off Share performance data in the pause menu if you do not want your game's performance samples sent to the realm.
- Do not press SEND REPORT if you do not want to send a report.
- Sign out from the title screen to remove the session cookie and the stored Google sign-in from your browser.
- Ask us to delete your data using the contact above. We can delete your invite, your account record and your Firebase account, and the Discord messages of any reports you sent. Realm logs and replays are not indexed by account: they name you only by commander name, so tell us the name you used and roughly when you played, and we will find and delete what we can.
Changes to this notice
When the data the game collects changes, this page changes with it and the version and date at the top move on. Version 1 is the first notice. Version 2 describes client performance samples, which were planned in version 1 and are now part of the game. Version 3 describes the terms of private trades and public market listings in the realm's log, which were planned in version 2.