1. The short version
You can play every game on LettersSay without an account, without giving us your email, and without telling us who you are. We do not sell your personal information. We show ads through Google AdSense, and we send email only to people who ask for it.
This policy explains exactly what happens to the data that does pass through the site. It applies to letterssay.com and all games and tools hosted on it.
2. Data nutrition label
A plain-language summary of our data practices. The detail is in the sections below.
LettersSay Data Facts
3. What we collect
3.1 If you just play — no account, no email
Your game inputs and results are processed in your browser. Your progress and streaks are stored in your browser's local storage on your own device. We do not receive that data unless you submit a score to a leaderboard.
Our host, Cloudflare, processes standard server request data on our behalf — IP address, user agent, requested URL, timestamp, and approximate country. This is ordinary web-server logging, used for delivering the site, rate limiting and abuse prevention.
3.2 If you give us your email
We collect the email address you type in, the game or page the form appeared on, and the date. That is the entire record. We never require a name.
3.3 If you create an account
Email address, a securely hashed password (we never see or store the plaintext), your chosen display name, verification status, and your game history — scores, streaks, and leaderboard placements.
3.4 If you subscribe to Pro
Our payment processor handles your card details directly. We receive only a subscription status and a processor reference. We never see or store your full card number.
4. What we never collect
- Payment card numbers, CVV codes, or bank details
- Precise or GPS location
- Your contacts or address book
- Your browsing history on other websites (note: Google may do this for ad personalisation — see section 6)
- Biometric data, government ID numbers, or health data
- Microphone, camera, or file-system access
5. How we use it
- To run the games — validate words, calculate scores, maintain streaks.
- To operate leaderboards — verify scores server-side and rank them. Cheated or implausible scores are rejected.
- To send email you asked for — word of the day, streak reminders, new game announcements.
- To prevent abuse — rate limiting, bot detection via Cloudflare Turnstile, and spam filtering.
- To understand what is popular — aggregate, non-identifying traffic statistics.
- To show ads — see section 6.
We do not use your data to build advertising profiles ourselves, and we do not sell or rent personal information to anyone.
6. Advertising and Google AdSense
LettersSay is free because it carries advertising. We use Google AdSense (publisher ID ca-pub-7824034001593033).
You should understand the following:
- Google and its partners use cookies and similar technologies to serve ads based on your prior visits to this and other websites.
- Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to our sites and/or other sites on the Internet.
- This means a third party is processing data about you that we do not control and cannot see. We receive only aggregate earnings and performance reports.
- You can opt out of personalised advertising by visiting Google Ads Settings.
- You can opt out of some third-party vendors' use of cookies at aboutads.info or youronlinechoices.com.
Where required by law, we ask for your consent before non-essential advertising cookies are set, and you can change or withdraw that choice at any time.
Pro subscribers see no ads.
7. Email and MailerLite
Email is opt-in only. We never add you to a list because you played a game or created an account — you have to submit the form.
Our email is sent through MailerLite, which stores your address and engagement data (opens, clicks) on our behalf as a processor. Every email carries a one-click unsubscribe link, and unsubscribing is honoured immediately and permanently.
If we launch another site and want to tell you about it, that announcement goes to the list you already joined. We do not transfer your address into a separate company's list without telling you.
8. Third parties that process data
| Provider | What it does | What it can see |
|---|---|---|
| Cloudflare | Hosting, CDN, security, rate limiting, analytics | Request data: IP, user agent, URL, country |
| Google AdSense | Advertising | Ad interaction and cookie data it sets itself |
| Supabase | Accounts, scores, leaderboards database | Account and game data you submit |
| MailerLite | Email delivery | Email address and engagement |
| Behind the Name | Name meaning lookups | The name you look up (not who you are) |
| Free Dictionary API | Word definitions, fetched when the site is built | Nothing about you — this runs at build time, not in your browser |
Each provider acts under its own privacy policy. We choose providers that commit to appropriate safeguards for international transfers.
9. How long we keep it
- Server logs — retained by Cloudflare on a rolling short-term basis for security and diagnostics.
- Email subscriptions — until you unsubscribe, then suppressed permanently so we cannot re-add you by accident.
- Accounts and scores — until you delete your account.
- After deletion — we keep aggregate, non-identifying statistics (for example "12,000 games played this month"). Those cannot be traced back to you.
- Local storage on your device — under your control; clearing your browser data removes it.
10. Your rights and choices
Depending on where you live, you may have the right to access, correct, delete, port, or restrict the processing of your personal data, and to object to it. You also have the right not to be discriminated against for exercising these rights.
If you are in the EEA or UK, our legal bases are: consent (email marketing, non-essential cookies), contract (running your account), and legitimate interests (security, abuse prevention, aggregate analytics).
If you are in California, we confirm that we do not sell personal information and do not knowingly share it for cross-context behavioural advertising beyond the AdSense processing described in section 6.
To exercise any right, email privacy@letterssay.com. We respond within 30 days. You can also complain to your local data protection authority.
Fast options that need no request: unsubscribe using the link in any email; clear local storage in your browser to wipe streaks and progress; use Google Ads Settings to turn off ad personalisation.
11. Children's privacy
LettersSay is not directed at children under 13, and we do not knowingly collect personal information from them. In the EEA and UK the minimum age is 16 unless local law sets it lower. If you believe a child has given us personal information, contact privacy@letterssay.com and we will delete it.
12. Security
We use HTTPS everywhere, hashed passwords, row-level security on our database, server-side score validation, rate limiting, and bot protection. No system is perfectly secure, and we do not claim otherwise. If we discover a breach affecting your personal data, we will notify affected users and regulators as required by law.
13. Contact
Privacy questions and data requests: privacy@letterssay.com
Everything else: legal@letterssay.com
Last updated: 4 August 2026. We post changes to this page and update the date above. Material changes are announced by email to subscribers.