Wyrdflow

Privacy at a glance

• Wyrdflow stores your game account, progress, statistics and settings on your device and through Unity services.
• Your display name, leaderboard results and some gameplay replays can be seen by other players. Choose a nickname that does not reveal personal information.
• Your Account ID is a private login credential. Anyone who has it may be able to access your account. Keep it secret.
• The mobile game includes advertising and in-app purchases. Advertising providers can process device, network and advertising information.
• Wyrdflow is intended for all ages, but currently has no age-checking or parental-consent process.
• For privacy questions, support or a data request, email support@grobb.info.

1. Who is responsible for your information

Wyrdflow is developed and operated by Scott Robb, an independent developer based in the United Kingdom. Scott Robb is the controller of the personal information processed to operate Wyrdflow. In this policy, “we”, “us” and “our” mean Scott Robb as the operator of Wyrdflow.

This policy covers the iOS and Android versions of Wyrdflow, the WebGL browser game and its game page at grobb.dev/projects/wyrdflow, and communications sent to our support address. It does not cover unrelated parts of the portfolio website or third-party destinations opened from the game.

Contact for all enquiries: support@grobb.info.

2. Information we process

We receive information from you, your gameplay and device, other players interacting with your account, and the service providers used by the game.

Account identity, names and recovery

Wyrdflow uses Unity Authentication to create an account, including anonymous sign-in and linked username-and-password authentication for recovery. Account information includes a persistent Unity PlayerID, your chosen display name, internally generated recovery credentials, your private Account ID and locally cached authentication tokens. Creating a game account does not require an email address or telephone number.

The Account ID encodes recovery credentials; it is not a public friend code. Interrupted account linking or transfers can leave temporary recovery and retry information so the operation can finish safely.

We save name drafts and confirmation state during setup, check name availability and suitability, normalise names to uppercase, and associate a reserved unique name with a PlayerID on Unity's backend. An authenticated player can search for a name to find the account for an in-game friend request.

A randomly generated account/device ownership identifier, save revisions and consistency markers help associate saves with the correct account, prevent accounts' cached data being mixed, and manage account transfers. This ownership identifier is separate from an advertising identifier.

Progress, statistics and rewards

We store account level and experience; gold and gems; owned and upgraded specials and their use counts; loadouts; unlocked and selected themes, keyboard skins and titles; achievements; tutorial and onboarding progress; redeemed reward codes; and purchase, pass and starter-pack entitlements.

Gameplay records include playing time, submitted words and word-use frequency, scores and personal bests, highest levels, long-word counts, specials used, bosses completed, modifiers selected, and daily challenges completed. Multiplayer records include match results and summaries, Casual and Ranked counters, rating and season information, victories and streaks, private and practice matches, attacks and letters sent, replay-viewing progress, and recent opponents used for matchmaking preferences.

We also store login dates and streaks, daily challenge dates and versions, completion and best scores, pending submissions, daily reward claims, limited-mode choices and monthly best scores, and rewarded-ad claim counts. Local progress is cached for offline play and synchronised to Unity cloud storage when an authenticated connection is available.

Friends, presence and multiplayer

We process friend relationships, requests and removals; account identifiers; public appearance information; online/offline availability; battle invitations and responses; and invitation, session and connection identifiers. Friends are added through in-game name searches, rather than by importing your phone's address book.

Unity's multiplayer services, including session/lobby and Relay services, process the information needed to connect players. This includes network and connection information and relevant gameplay information such as names, titles, themes, ratings, account levels, loadouts, rules, board states, letters, word submissions, choices, scores, attacks, results, rematches and in-game emoji events. Relevant information is exchanged with your opponent. Matchmaking can use ratings, friendship relationships and recent opponents.

Replays and public results

Replays are structured gameplay recordings. They can contain PlayerIDs, display names and public appearance, opponent details, ratings, loadouts, account levels, rules and settings, random seeds, timestamps, duration, scores, levels, submitted words and typed-input events, board snapshots, selections, modifiers, attacks, mistakes, word statistics, emoji events and pause/resume or result information.

Replay recording does not require recording your camera or microphone. It records input and events within Wyrdflow, rather than typing in other apps.

Setup, preferences and privacy choices

We save the current setup step, name draft, policy acknowledgement and version, scroll position, completion state, Account-ID copy confirmation and transfer notices so interrupted setup can resume. We also store audio, graphics, vibration and interface preferences, cached friend information, unread attention markers, replay indexes, pending work and retry markers, and SDK-managed consent information and caches.

Acknowledging this policy is different from consenting to advertising or granting an operating-system permission. Reading, scrolling through or acknowledging the policy does not give blanket consent to every use of information.

Technical information and support

Unity services and integrated SDKs can process IP addresses, device or application identifiers, software and connection information, service/session activity and operational or diagnostic logs. Advertising SDKs also process their own interaction, analytics and performance information, as described in section 4. These records support service operation, reliability, troubleshooting, advertising and fraud prevention, depending on the service.

When you email us, we receive your email address, any name you provide, your message and attachments, and information needed to handle the request. This may include account details, screenshots, transaction information or diagnostic logs you choose to supply. Our support mailbox is hosted by IONOS. Please avoid sending unnecessary personal information or your full Account ID in an ordinary email.

3. What other players can see

Your display name is public. Leaderboards can show your score or rating, rank, selected title and its appearance, theme artwork, daily challenge or streak information, and a replay reference. A title may indicate an achievement, a developer/playtester designation or a purchase entitlement, such as a Supporter title. Underlying service responses and replay records can include a technical PlayerID even where the interface does not show it as a friend code.

Friends and invitation recipients can see information needed for social features, such as your name, title, theme and availability. Opponents receive relevant profile and match information.

Local recent replays and privately saved cloud replays are different from public copies published for leaderboard playback. Other players can access public leaderboard replays. A multiplayer replay can include both participants' information, and an opponent may retain their own copy.

Avoid putting your real name, school, address, contact details or sensitive information in your display name or gameplay input. Information included in a public result or replay is not private merely because it originated in a game.

4. Mobile advertising

The iOS and Android game integrates Google AdMob/Google Mobile Ads and Unity Ads mediation. Depending on the advertising configuration enabled for the mobile release, ads may be supplied by Google, Unity Ads or both. This section applies when the relevant advertising service is used. The WebGL game currently bypasses the mobile advertising and Google consent integrations.

Mobile ads include interstitials at eligible game-entry points and optional rewarded ads. Advertising services can process IP addresses and approximate location inferred from them; advertising, device or application identifiers; device/software information; app and ad interactions; ad impressions and video views; and diagnostic or performance information. Providers use this information to deliver and measure ads, analyse advertising performance, and detect invalid traffic or fraud. Available data depends on the platform, SDK, configuration, permissions and privacy choices.

Google's User Messaging Platform handles applicable advertising privacy messages and choices. On iOS, App Tracking Transparency is the operating-system permission for tracking where applicable. Advertising may be personalised, non-personalised or limited depending on the applicable settings and choices. Non-personalised or limited advertising does not necessarily mean that no information is processed.

Where consent is legally required for non-essential device access, advertising personalisation or tracking, valid consent is the basis for that processing. An operating-system permission does not replace any additional consent required by law. You can use the choices in advertising privacy messages and any privacy-options control provided, change the relevant device settings, or contact us for help with your choices.

Rewarded-ad claim counts and the resulting gold or gem rewards are linked to your account, including their separate daily limits. Ad content can be preloaded and cached. Purchasing No Ads does not remove every advertising-related operation: optional rewarded ads remain available, and Google's privacy-status checks can still occur.

See Google's privacy policy, Google's explanation of data collected through partner sites and apps, and Unity's Game Player and App User Privacy Policy.

5. Purchases

In-app payments are processed by Apple or Google through the relevant store, with Unity IAP supporting purchasing and restoration. Wyrdflow processes product and transaction identifiers, receipts supplied by the store or purchasing SDK, purchase and restoration status, entitlement flags and currency grants linked to your game account. We do not collect your payment-card number through Wyrdflow.

Deleting your Wyrdflow account does not delete Apple or Google's purchase records or issue a refund. Store-backed purchases may subsequently be restorable under the store's rules. Manage payment and refund questions through the relevant store, or contact us for game-entitlement support.

6. Device and browser storage, typing and notifications

The game stores credentials, progress, statistics, settings, replays, cached information and pending operations on your device. WebGL uses browser-backed storage, including IndexedDB and Unity's preferences/files, to maintain the game between visits. Essential storage supports login, saves, setup, preferences and reliable operation. Advertising SDKs have separate storage and privacy controls as described above.

Clearing browser storage or uninstalling the app can remove local data. It does not automatically delete the cloud account. Recovery depends on the Account ID you have retained and information already synchronised to Unity; unsynchronised progress can be lost.

Copying your Account ID places a sensitive login credential on the clipboard. The game can offer saving/autofill through a supported browser password manager or Apple's Shared Web Credentials on iOS, associated with grobb.dev. Saving and any synchronisation depend on the platform and password manager. There is currently no equivalent native Android credential-manager integration. Logout, transfer or deletion does not automatically clear clipboard contents or independently saved password-manager entries; transferred credentials may need updating.

On iOS, the keyboard uses Apple's local word-checking API to process the current partial game word and obtain completions that help improve typing accuracy. The game's completion bridge does not make its own network request for these lookups or read typing in other apps. Game-word statistics and replay input are separate records described above.

Mobile reminders and badges are scheduled locally using game state, reset dates, reward and challenge progress, recent activity, device time and time zone. They can remind you about challenges, streaks, rewards, seasons, limited modes or returning to play. You can disable notifications and badges in device settings. Notification content may appear on your lock screen. Wyrdflow does not currently use a remote push service for these reminders or promise delivery of friend/battle notifications while the app is completely closed.

7. Why we use information and our lawful bases

Where UK GDPR or EU GDPR applies, our processing relies on the following bases, according to the activity:

We use gameplay and account records to save and display your progress and statistics, award achievements and rewards, enforce claim limits, restore entitlements, run challenges and matches, and provide leaderboard and replay features. Setup records preserve your place in onboarding; preferences and notification state support the choices and reminders described above.

Legitimate interests must be balanced against players' rights and interests, with particular attention to children. A legitimate-interest basis does not replace consent or parental consent where the law requires it.

Account and connection information is needed to operate online features. If it is unavailable, we may be unable to provide login, synchronisation, friends or multiplayer. Purchases require the relevant transaction information. Supplying a real name, email address or telephone number is not required to create a game account; sending a support email is your choice.

Rating, recent-opponent and gameplay rules are automated game features. They are not used to make decisions about credit, employment or comparable matters outside the game.

8. Providers and other recipients

Information is shared with recipients relevant to the feature you use:

Some providers process information on our behalf; others act as separate controllers for their own services, such as store transactions or certain advertising operations. Their privacy notices explain those separate activities. We may also disclose information where a binding legal obligation requires it or where necessary and lawful to establish, exercise or defend legal claims.

Relevant notices: Unity, Google, Apple, Netlify and IONOS.

9. International processing

These services operate internationally. Information can be processed outside the UK, including in the United States and other countries where providers and their subprocessors operate. We do not promise UK-only storage.

Applicable provider data-processing arrangements include international-transfer safeguards, such as standard contractual clauses and the UK Addendum, where required for the transfer concerned. An applicable adequacy arrangement can be used where its conditions are met. Unity and Netlify publish their data-processing arrangements: Unity DPA and Netlify DPA. Contact support@grobb.info for information about the safeguards applicable to your information or to request a copy, subject to necessary redactions.

10. How long information is kept

Public replay cleanup is scheduled and eventual, rather than guaranteed at an exact deadline. A replay referenced by more than one leaderboard remains until all applicable retention reasons expire. Removing a private saved replay does not necessarily remove a separately published public copy. Older snapshots and archived leaderboard records can require separate cleanup rather than following the current automatic replay cycle.

The game's cached advertising objects are normally discarded after approximately 55 minutes or earlier when invalidated. This is not a deletion deadline for the advertising provider's information.

Provider security/service logs, backups, consent records and store purchase records follow their applicable retention arrangements, legal obligations and purposes. They can outlast an active game account. Their notices above explain their own practices. You can contact us about information that remains associated with you after an in-game deletion.

11. Account transfer, logout and deletion

Logout clears account-specific local data and the session on that device. The server account remains available for recovery using valid credentials.

Account transfer preserves the cloud account and PlayerID, changes device ownership and invalidates the previous Account ID. The previous device clears the account's local data after reconnecting and reliably detecting that it no longer owns the account. An offline device cannot discover a transfer immediately, so its cached data can remain until that check occurs.

Delete All Data is the in-game control for permanent account/data deletion. It deletes the active Authentication account, cloud account data and private files, friend relationships, name reservation, live leaderboard entries, registered public replay data and retention records, and account-specific local progress, credentials, replays and caches. It also clears scheduled account notifications. A failed or interrupted deletion can preserve limited credentials and retry information until the deletion can be completed; an unfinished attempt is not the same as completed deletion.

The automatic process does not necessarily erase archived leaderboard entries, older snapshots or a multiplayer replay retained by another participant. Contact us to request review of residual information and any further erasure or restriction required by applicable law. A technical limitation does not by itself remove your privacy rights.

Deleting the game account does not automatically erase store records, advertising-provider information, independently saved password-manager entries, clipboard contents, or device-level tracking/notification permission settings. Those involve separate services or controls. Legally required records and applicable provider backups or logs may also remain for their relevant retention periods.

To request deletion without using the app, email support@grobb.info with the subject “Wyrdflow account deletion”. Include your display name and enough non-secret information to explain the request. We will arrange appropriate account-control verification before acting. Do not send your full Account ID or authentication tokens in an ordinary support message. Uninstalling or clearing browser storage is not a substitute for requesting account deletion.

12. Your choices and privacy rights

Depending on the law that applies, you can request access to your personal information; correction of inaccurate information; deletion; restriction of processing; and a portable copy of eligible information. You can withdraw consent at any time where processing relies on consent, without affecting processing that was lawful before withdrawal.

Right to object: You can object to processing based on legitimate interests, including relevant profiling, for reasons relating to your situation. Where applicable, you can object to direct marketing at any time. We will consider your request under the applicable legal rules.

Email support@grobb.info to exercise a right or ask for help. We may need proportionate information to verify your identity or authority, particularly before disclosing account data or deleting an account. We will respond within the period required by applicable law and explain any lawful limitation or refusal.

You can change notification permissions and, on iOS, tracking permission through device settings. Android advertising-identifier controls are available in the relevant device settings. Use available advertising privacy choices to change consent preferences. Removing an account does not automatically reset those independent choices.

You may complain to the UK's Information Commissioner's Office at ico.org.uk/make-a-complaint. Where another jurisdiction applies, you may also have the right to complain to its relevant data-protection authority. You do not have to contact us first to exercise a legal complaint right.

13. Children and parents

Wyrdflow is intended for an all-ages audience. The game does not currently ask for a player's age, verify a parent's identity, obtain parental consent or apply a separate child-specific advertising flow. A store age rating, acknowledgement of this policy, an advertising dialogue or a device permission is not a verified parental-consent process.

The account, public-result, replay, advertising and other practices in this notice therefore matter to younger players as well as adults. Parents and guardians should be aware that display names and some match/replay information can be visible to other players. Children should use a nickname and keep their Account ID secret.

Parents or guardians can contact support@grobb.info about a child's information, request help understanding the game, or exercise applicable rights to review, delete or prevent further processing. We will use appropriate verification of account control and the requester's authority. Where applicable law requires parental consent, this notice does not supply or replace it.

14. Security

We use the account authentication and access-control features of our providers, separate private account information from information intended for other players, and use account-ownership and save-consistency checks. Providers support secure transport for their services. These measures reduce risk but cannot guarantee that information will never be lost, accessed without permission or misused.

The Account ID is stored in the game's local preferences, rather than being guaranteed an encrypted or hardware-protected secret. Protect your device and treat the Account ID like a password. Optional password-manager storage is separate from the game's own local storage. Contact support@grobb.info if you believe your account or information has been compromised.

15. External links

The game can open external destinations such as YouTube, Instagram and other pages on grobb.dev. Visiting them can expose request and device information to the destination and its providers. Their own privacy and cookie practices apply; a social link does not mean Wyrdflow uses that service for account login.

16. Changes to this policy

We will update this policy when our practices change and show the updated date and version. Material changes will be highlighted through the game or the Wyrdflow game/policy page. Where a new use requires consent, we will seek the consent required before that processing. A policy update or continued play does not itself substitute for that consent.

For any question about this policy or Wyrdflow, email support@grobb.info.