Privacy Policy

1. Scope of this policy

LetterRiot (“LetterRiot,” “we,” “us,” or “our”) operates the LetterRiot word-game service. This policy applies to the LetterRiot website and native applications, their local and online game modes, matchmaking, accounts, friend features, statistics, notifications, and related support requests.

This policy does not control the independent practices of websites or services that you visit through an external link.

2. Information we collect

The information we collect depends on which parts of LetterRiot you use:

• Account information. If you create an account, we receive and store your Clerk user ID, username, email address, and avatar.
• Social information. We store friend relationships and friend invite records so that invitations and friend-only profiles work.
• Game information. We may store scores, rankings, statistics, room display names, submitted words, results, matchmaking status, and other state needed to run local, shared-room, casual, and ranked games.
• Room and matchmaking credentials. We issue short-lived random credentials that let a browser or native app rejoin a room or check a matchmaking request. The server stores hashed or signed forms where appropriate rather than exposing the underlying credential in public game data.
• Native installation and notification information. If you enable notifications, we store an Expo push token, platform, app variant and version, notification preferences, and a hashed installation credential. An installation may be associated with an account while you are signed in and is detached from that account when you sign out.
• Abuse-prevention information. We derive identifiers from IP addresses to apply rate limits to actions such as word validation, scoring, and room creation.
• Local browser state. Session storage holds local setup and round state so a local game can resume during the same browser session.
• Analytics and performance information. Vercel provides aggregated information such as page views, device and browser type, referrer, approximate location, and performance measurements. LetterRiot does not use this information to reconstruct an individual’s browsing activity across different sites.

3. How we use information

We use the information described above to:

• create and maintain accounts, profiles, friend connections, and invitations;
• run rounds, validate words, calculate results, rankings, and player statistics;
• create rooms, reconnect players, coordinate matchmaking, and keep shared game state synchronized;
• deliver the friendship-accepted and match-found notifications you enable;
• secure the service, enforce rate limits, investigate misuse, and preserve competitive integrity;
• understand aggregate usage and improve reliability, accessibility, and gameplay; and
• answer privacy, support, and legal requests.

We do not sell your personal information.

4. Service providers

LetterRiot relies on a small group of providers to operate the service:

• Clerk provides authentication and account management.
• Turso hosts application and game data.
• Upstash supports rate limiting, abuse prevention, and signed notification-delivery jobs.
• Expo provides native build and push-delivery services. When notifications are enabled, LetterRiot sends the device’s Expo push token and the notification content needed for delivery.
• Free Dictionary API supplies on-demand word definitions. When you select a result word, LetterRiot’s server sends only that word to the provider for lookup—not your identity, score, board, or room information.
• Vercel hosts and delivers the site and provides aggregated web analytics and performance insights.

These providers process information for their service roles and under their own terms and privacy notices. They may process information in countries other than your own.

5. Necessary and optional technologies

Clerk-backed sign-in requires authentication cookies. According to Clerk’s cookie documentation, these cookies are required for Clerk to function and Clerk does not use them for cross-site tracking. Blocking them may prevent account features from working.

LetterRiot also uses first-party, HTTP-only room and matchmaking credentials so a browser can securely resume those interactions. Local game setup and round state use session storage and normally disappear when the browser session ends; starting over or using LetterRiot’s clear controls may remove them sooner.

A necessary first-party letterriot_theme cookie stores the system, light, or dark appearance choice for up to one year. The browser must be able to read it before the page appears so later visits use the right palette without a flash. Signed-in choices are also stored with the account and synchronized after sign-in; guests use their device setting.

Vercel Analytics and Speed Insights are optional. They do not load until you choose “Allow all.” A necessary first-party consent cookie records whether you chose necessary storage only or allowed these optional services.

Guests can change their choice with “Cookie settings” in the footer. Account holders can use the Settings page; their choice is also stored with the account and synchronized to each browser after sign-in.

The native apps use encrypted device storage for room, matchmaking, and installation credentials and local device storage for restorable local rounds, appearance, and dismissed prompts. Notification permission is requested only in context and can be denied without disabling polling or gameplay.

6. How long information is kept

• Shared rooms expire 24 hours after creation and are removed by scheduled cleanup.
• Local round state lasts for the browser session or until it is explicitly cleared.
• Disabled push tokens and notification-delivery records may remain for a limited period to prevent duplicate delivery, diagnose failures, and protect the service.
• Account, profile, statistics, ranking, and historical match records may remain while needed to operate and secure LetterRiot, resolve disputes, and preserve the integrity of game history.
• Some provider logs, backups, and security records may remain for limited periods under the provider’s own retention practices or where required by law.

7. Current account deletion behavior

Deleting an account removes authentication access. LetterRiot removes active friendships and invitations created by the account and marks the LetterRiot profile inactive.

Some profile fields, statistics, ranking information, and historical match records may remain. This preserves completed-game history, competitive integrity, and records needed to operate or secure the service. Account deletion therefore does not currently promise complete erasure of every application record.

To make a privacy request about retained information, email joshuaalevine3@gmail.com. We may need to verify that the request comes from the account holder.

8. Security practices

LetterRiot uses measures intended to protect information, including authenticated server-side operations, restricted credentials, hashed room tokens, signed matchmaking credentials, input validation, rate limiting, and encrypted connections provided by the hosting platform.

No online system can be guaranteed completely secure. Keep your account credentials private and contact us if you believe your account or a LetterRiot feature has been misused.

9. Children’s privacy

LetterRiot is not intended for children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child under 13 has provided personal information, contact us so we can review and address the situation. A parent or guardian must approve use where applicable law requires it.

10. Your choices and privacy rights

You can choose to play local or guest modes without creating an account, although some features require one.

• Update available account details through the account tools provided by Clerk.
• Clear local session storage through LetterRiot controls or your browser settings.
• Change native notification preferences in LetterRiot and notification permission in device settings.
• Block cookies in your browser, understanding that account, room, or matchmaking features may stop working.
• Delete your account, subject to the retention behavior described above.

Depending on where you live, you may have rights to request access, correction, deletion, restriction, portability, or information about how personal information is used. You may also have a right to object or appeal. Email us to exercise an applicable right. We will respond as required by applicable law.

11. Policy changes and contact

We may update this policy as LetterRiot changes. The effective date at the top identifies the current version. If a change is material, we may provide additional notice through the service when appropriate.

Questions and privacy requests can be sent to joshuaalevine3@gmail.com.