WordlingoPrivacy Policy
Includes the KVKK Information Notice · Effective: 2 November 2026
This notice explains how your personal data is processed when you use the Wordlingo: Passaparola mobile app (the “App”) and when you visit the wordlingoapp.com website. It also serves as the information notice required by Article 10 of the Turkish Personal Data Protection Law No. 6698 (“KVKK”).
This is an English translation of the Turkish privacy policy. If the two versions differ, the Turkish version prevails.
1. Data controller
Your personal data is processed by Tunç Akkoyun (independent app developer) as the data controller.
Contact: support@wordlingoapp.com
2. What data do we process?
| Data category | What? | From where? |
|---|---|---|
| Identity and account | Username, account ID (a random number), password (only as an irreversible, encrypted hash) | From you, when you sign up |
| Contact | Email address. Used for sign-up verification and password reset codes; never shown to other players. | From you, when you sign up |
| Game progress | The rounds you play, level and topic, correct / wrong / passed counts, point movements (earned, spent on hints, from rewarded videos and point packs), your word progress, your Daily ring records and your stats | While you use the App |
| Leaderboard | Your username and score are visible to other players on the leaderboards | From your game progress |
| Shared results (optional) | When you tap share at the end of a round, a summary of that round (your username, level, time, score, correct / wrong / passed counts, and the words and results of the letters you reached) becomes visible on wordlingoapp.com through a link. Only the people you share the link with can open it; it is closed to search engines. Clues, Turkish meanings and the answers you typed are not shown. | When you tap the share button |
| Word search | The words you search for and how many searches you make (for the daily free search allowance and to prevent abuse). When you tap “Request this word” for a word that isn't in the word bank: that word, your username, the app version, platform and language | From you, when you search and send a request |
| Reports and feedback | Your reports of wrong questions and your feedback messages, together with the app version, platform (iOS / Android) and language | From you, when you send them |
| Purchases | Wordlingo Plus subscription status (plan, start and end date), point pack purchases, store transaction IDs. We never see your card or payment details. | From the App Store / Google Play, through RevenueCat |
| Advertising and device | Advertising ID (IDFA on iOS, advertising ID on Android; only if you allow it or your device settings allow it), IP address, device model and operating system, ad interactions, crash and error data | From your device, by the Google AdMob SDK |
| Voice (optional) | The word you say when you press the microphone button in the game. The audio is turned into text by your phone's own speech recognition service (Apple on iOS, Google on Android); the resulting word only goes into the answer boxes. We don't keep recordings, and the audio never reaches us. | From your device, when you allow the microphone and press the microphone button |
| Request security | IP address and attempt counts for sign-up and password reset requests, and when someone tries to open a shared result link with a wrong key (to limit abuse) | From server logs |
| Website visits | The page you open on wordlingoapp.com, where you came from (the referring site), your country, device type, operating system and browser. No cookies are used; no lasting ID that recognises you is created, and your IP address is not written into the statistics (the hash used to tell visits apart is deleted after 24 hours). Shared result pages are not measured. | From your browser, when you visit the site, through Vercel Web Analytics |
What stays on your device only: your saved words and your settings (language, round length, vibration, daily reminder) are not sent to the server. The daily reminder is set up as a local notification on your device; we don't collect a notification token.
We don't collect location, contacts, photos or health data. The microphone opens only when you press the microphone button in the game, and only for that one word; you can take the permission back any time in your phone's settings, and the game plays just the same with the keyboard.
3. Purposes and legal grounds
| Purpose | Legal ground (KVKK Art. 5) |
|---|---|
| Creating your account, signing you in, resetting your password, verifying your email | Establishing and performing a contract (Art. 5/2-c) |
| Running the game, keeping your score, stats and the leaderboard | Performing a contract (Art. 5/2-c) |
| Letting you answer by voice (optional) | Performing a contract (Art. 5/2-c) |
| Granting your Wordlingo Plus subscription and point packs, handling refunds | Performing a contract (Art. 5/2-c); legal obligation (Art. 5/2-ç) |
| Showing ads to free users, verifying rewarded videos and granting their points | Performing a contract (Art. 5/2-c) and legitimate interest (Art. 5/2-f); your explicit consent (Art. 5/1) for personalised ads and for using the advertising ID for tracking |
| Moderating usernames and reports, preventing abuse and cheating, keeping the service secure | Legitimate interest (Art. 5/2-f); legal obligation (Art. 5/2-ç) |
| Reading your feedback and word requests, fixing bugs, improving the word bank, answering support requests | Legitimate interest (Art. 5/2-f) |
| Measuring which pages of the website are read and improving the site | Legitimate interest (Art. 5/2-f) |
| Requests from authorities and possible disputes | Legal obligation (Art. 5/2-ç); establishing, exercising or protecting a right (Art. 5/2-e) |
Your data is collected by automated means (the App, our servers and third-party SDKs). We don't sell your data.
4. Ads and the advertising ID (Google AdMob)
Free users see ads through Google AdMob (at the end of a round, banners, on the results screen and optional rewarded videos). Wordlingo Plus members see no ads apart from rewarded videos.
- iOS: Before the advertising ID (IDFA) is used, Apple's App Tracking Transparency (ATT) permission is requested. If you choose “Ask App Not to Track”, the IDFA isn't shared and ads are shown non-personalised. You can change this any time in Settings → Privacy & Security → Tracking.
- Android: You can reset or delete your advertising ID in Settings → Google → Ads (or Privacy → Ads).
- In regions where Google's consent form is required, the App shows a consent form at launch; you can change your choice again in Profile → Ad privacy choices.
- Rewarded videos: When a video is completed, AdMob sends a signed verification to our server. It contains your account ID and a transaction number and is used only to add the points to your account.
How Google uses data: policies.google.com/technologies/partner-sites · Google Privacy Policy: policies.google.com/privacy
5. Purchases (App Store, Google Play, RevenueCat)
Wordlingo Plus and point packs are bought through the Apple App Store or Google Play. The store takes and processes the payment; your card details never reach us.
We use RevenueCat to verify the status of your purchases. RevenueCat receives your account ID (a random number; not your email or username) and the purchase details reported by the store (product, date, transaction ID, renewal / cancellation / refund status, country and currency). RevenueCat reports these events to our server so that your Plus access and points are applied to your account.
RevenueCat Privacy Policy: revenuecat.com/privacy · Apple: apple.com/legal/privacy · Google: policies.google.com/privacy
6. Who we share data with and transfers abroad
Your personal data is shared only with the service providers below, for the purposes above and only as far as needed:
| Party | Role | Data shared |
|---|---|---|
| Supabase Inc. | Database, authentication and server functions (server region: European Union, Frankfurt) | Account, game progress, searches, reports, feedback and word requests, purchase status |
| Vercel Inc. | Hosting wordlingoapp.com and its visit statistics (Vercel Web Analytics) | The page you open, IP address (only to serve the request and work out the country), browser and device information |
| Resend Inc. | Sending verification and password reset emails | Email address, the code sent |
| RevenueCat Inc. | Subscription and purchase management | Account ID, purchase details |
| Google LLC (AdMob) | Showing and measuring ads | Advertising ID, IP, device information, ad interactions, account ID for rewarded videos |
| Apple Inc. / Google LLC (speech recognition) | Turning the word you say into text (your phone's own service; on the device or on these companies' servers) | The short audio recorded while you press the microphone button |
| Apple Inc. / Google LLC (stores) | App distribution and payment | The purchases you make with your store account (subject to the store's own policy) |
| Competent public authorities | Legal requests | Only the requested data, and only when legally required |
Some of these providers are based outside Türkiye (in the European Union and the United States) or may process data there. Transfers abroad are made in line with Article 9 of KVKK: under standard contracts with the providers and other appropriate safeguards, and where these are not available, based on your explicit consent.
7. Where and how long data is kept
Your account and game data are stored on Supabase servers in the European Union (Frankfurt) region, encrypted in transit and at rest.
- Account, game progress, points, purchase status: as long as your account exists; deleted right away when you delete your account.
- Verification and password reset codes: valid for 15 minutes; expired records are cleaned up regularly.
- Daily ring records: up to 90 days.
- Shared result links: 5 days; after that the link no longer opens and the record is deleted. If you delete your account or the round, the link is deleted right away. IP records of failed link attempts are kept for 1 day.
- Search records (which words you searched on which day, your hourly search count): up to 2 days; deleted on your next search. Deleted right away when you delete your account.
- Question / player reports, feedback and word requests: kept to improve the content and as an audit record; your username is removed from these records when your account is deleted.
- Backups: deleted data may remain in the provider's automatic backups for a limited time and is permanently deleted when the backup cycle completes.
- Third parties: AdMob, RevenueCat, Vercel, Apple and Google keep the data they hold for the periods set out in their own policies.
Data whose retention period has ended, or whose purpose no longer applies, is deleted, destroyed or anonymised.
8. Deleting your account
You can delete your account in the App at any time: Profile → Delete my account → Delete account. Your account, round history, points, stats, leaderboard place and subscription link are permanently deleted; this can't be undone. The saved words on your device are deleted too.
If you can't get into the App, write to support@wordlingoapp.com from your registered email address. Step-by-step: Delete account page.
Important: Deleting your account doesn't cancel your App Store or Google Play subscription. To stop being charged, cancel the subscription in the store.
9. Your rights under KVKK
Under Article 11 of KVKK, by applying to the data controller you have the right to:
- learn whether your personal data is processed,
- request information about it if it has been processed,
- learn the purpose of processing and whether it is used in line with that purpose,
- know the third parties in Türkiye or abroad to whom it is transferred,
- ask for it to be corrected if it is incomplete or wrong,
- ask for it to be deleted or destroyed under the conditions in Article 7 of KVKK,
- ask for the third parties it was transferred to be notified of any correction, deletion or destruction,
- object to a result against you that arises solely from analysis by automated systems,
- claim compensation if you suffer damage because of unlawful processing.
For processing based on your explicit consent, you can withdraw your consent at any time (for example by turning off tracking permission on iOS or changing your ad privacy choices).
How to apply: So that we can verify your identity, send your request from the email address registered to your account, including your username, to support@wordlingoapp.com. Depending on its nature, your request is concluded free of charge within 30 days at the latest. If you are not satisfied with our answer, you can file a complaint with the Turkish Personal Data Protection Board (Kişisel Verileri Koruma Kurulu).
10. Children
The App is designed for users aged 13 and over. We don't knowingly collect personal data from children under 13. If you notice such an account, write to us and we will delete it.
11. Security
Your data is encrypted with TLS in transit. Your password is stored only as an irreversible hash; nobody (including us) can see it. Database access is limited by row-level security rules; each player can access only their own data. Admin access is restricted and logged.
12. Changes and contact
We may update this notice from time to time. If there is an important change, we will announce it in the App or on this page; the effective date at the top always shows the latest version.
Questions: support@wordlingoapp.com