Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data Letterbrawl uses, why, and what rights you have. We keep it short and plain. It covers the website letterbrawl.com and the game on it.

It is written to meet the Swiss Federal Act on Data Protection (FADP / nDSG), the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is responsible

Letterbrawl is a free hobby project run by a private individual in Switzerland:

Jason Brownbridge, Switzerland
Email: privacy@letterbrawl.com

This person is the "controller" of your personal data. In this policy, "we" and "us" mean this person. Please use the email address above for every privacy question or request.

Letterbrawl is free. It shows no ads and takes no payments. We do not sell your data.

2. What data we use and why

We only use data that we need to run the game. Below is each purpose, the data it uses, and the legal basis under the GDPR. (Swiss law does not require a legal basis for each purpose, but we follow the same rules for everyone.)

2.1 Playing the game (with or without an account)

Data: the display name you choose (up to 16 characters), your guesses, game results, room codes, your rating (Elo), power-up inventory, and win and loss streaks.
Why: to run live games, match you with other players, show results, and keep your rating and power-ups.
Who can see it: other players see your display name, guesses and results in games you play together. Your rating may be shown to them too.
Legal basis: to provide the service you asked for (GDPR Art. 6(1)(b)).

Please do not use your real full name or other personal details as your display name.

2.2 Guest profile

Data: a random ID that our server creates and keeps in the signed lb_session cookie. It does not contain your name or email.
Why: so you can keep a rating and power-ups without creating an account.
Legal basis: to provide the service (Art. 6(1)(b)). Storing it on your device is strictly necessary for the game, so no consent is needed for it.

2.3 Accounts (optional)

Data: your email address, display name, friends list, daily puzzle results, and, if you choose to paste them, results from other daily puzzles such as Wordle or Connections (game, puzzle number, score and emoji grid). We keep only the emoji lines, not other text you paste.
Why: to let you sign in on any device, keep your progress, add friends and compare results.
Legal basis: to provide the service you asked for (Art. 6(1)(b)).

You do not need an account to play.

2.4 Signing in

Data: your email address (to send a one-time sign-in link) and a signed session cookie called lb_session.
First email: the first email to a new address asks you to confirm it. If the link is not used, we send nothing more to that address for 30 days. To know this, we keep a scrambled code of the address (a keyed hash), not the address itself, and delete it after 30 days.
Why: to check that it is really you and keep you signed in.
Legal basis: to provide the service (Art. 6(1)(b)). The session cookie is strictly necessary, so no consent is needed for it.

2.5 Puzzle reminders (only if you turn them on)

Data: the games you want reminders for, the times you chose, your time zone, the channel (email or WhatsApp), your WhatsApp phone number if you link it, and a record of what you agreed to and when.
Why: to remind you before a puzzle resets, only on days when you have not logged it yet. Reminders contain no answers, only a link to the game.
Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time with the link in every email, by replying STOP on WhatsApp, or in Settings.
WhatsApp: you link your number by sending us a message from it. We never add a number you did not send from. Messages go through Meta's WhatsApp Business Platform.

2.6 Hosting, security and server logs

Data: your IP address, the date and time, the page or API address requested, browser type, and error information.
Why: to deliver the website, keep it secure, stop abuse and fix errors.
Legal basis: our legitimate interest in running a safe and working service (Art. 6(1)(f)).
Page speed (Vercel Speed Insights): when a page loads, your browser reports how fast it loaded (Core Web Vitals) with the page address, device type, browser, operating system and country. It sets no cookies, stores nothing in your browser, uses no visitor ID and does not count visits, so it cannot follow you. We use it only to find and fix slow pages, on the same legal basis.

2.7 Visit statistics (Vercel Web Analytics, only if you agree)

Data: the page you view, the page you came from, your country, your device and browser type. Vercel combines your IP address and browser details into a code (a hash) that changes every day, so a visit can be counted once without tracking you over days or across websites. No cookies, no IDs in your browser, no full IP addresses stored.
Why: to count visits and see which pages people use.
Legal basis: your consent (Art. 6(1)(a) GDPR). It is off until you click "Accept", like Google Analytics, and stops when you withdraw consent in "Cookie settings".

2.8 Analytics with cookies (only if you agree)

Data: pages viewed, game features used, device and browser type, approximate location (country or city level), and a random analytics ID stored in cookies. Google Analytics 4 does not log or store full IP addresses.
Why: to understand how many people play and which features they use, so we can improve the game.
Legal basis: your consent (Art. 6(1)(a) GDPR, and the consent rules for cookies). Analytics is off until you click "Accept". You can withdraw consent at any time with "Cookie settings" at the top of this page or on Settings in the game.

We use Google Consent Mode. Before you decide, all Google storage is set to "denied", and the Google Analytics script is not loaded at all.

2.9 When you contact us

Data: your email address and what you write to us.
Why: to answer you and handle privacy requests.
Legal basis: our legitimate interest in answering you (Art. 6(1)(f)), and our legal duties when you use your privacy rights (Art. 6(1)(c)).

2.10 What we do not do

We do not sell or rent your data.
We do not show ads or use advertising cookies.
We do not make automated decisions that have legal or similarly important effects on you. Matchmaking uses your rating only to find fair opponents.

3. How long we keep data

Data	How long
Live game state (rooms, guesses, players in a room)	Deleted automatically 6 hours after the last activity in the room.
Ratings, power-ups and streaks	Guest profiles: deleted automatically 90 days after they last change (for example after a ranked game). Accounts: until you delete your account. You can ask us to delete them at any time.
Account data (email, display name, friends, results)	Until you delete your account. Then it is deleted from the live database. Backup copies are overwritten within a short period.
Reminder settings and phone number	Until you turn reminders off or delete your account.
Record of your reminder consent	3 years after you withdraw it, so we can show that you agreed.
Pasted puzzle results	Until you delete your account.
Sign-in links	Valid once, for at most 24 hours. Using one link ends all other open links for the same address. Deleted one day after they expire.
Scrambled code of an unconfirmed email address	30 days. In that time the address gets at most 3 confirmation emails, and a new one only after the last link expired.
Scrambled code of an address whose owner chose "Never email this address again"	Until the owner undoes it with the link in our email, or confirms the address. We keep it so we can respect the choice; we never store the address itself.
Session cookie `lb_session`	About 30 days, or until you sign out.
Server logs (Vercel)	Short-term only, as set by our hosting provider's log retention.
Google Analytics data	Event data is kept for 2 months, then deleted by Google. Analytics cookies last up to 2 years unless you withdraw consent or clear them.
Emails you send us	As long as needed to answer you, and at most 2 years after the matter is closed.
Data in your own browser (local storage)	Until you clear it in your browser settings.

4. Who we share data with

We use a small number of service providers ("processors" or "subprocessors") to run Letterbrawl. They may only use your data to provide their service to us. Each is bound by a data processing agreement.

Vercel: web hosting, server functions and visit statistics (Vercel Web Analytics, only with your consent). We also set up and pay for our databases through the Vercel Marketplace.
Upstash: fast database for live games, ratings and power-ups, and the scheduler that starts reminder runs (set up through Vercel).
Neon (part of Databricks): database for accounts (set up through Vercel).
Resend: sends sign-in emails and reminder emails.
Meta (WhatsApp): sends WhatsApp reminders, only if you link WhatsApp.
Google: Google Analytics (only with your consent).
Cloudflare: DNS (it answers lookups for the name letterbrawl.com) and email forwarding: emails you send to an @letterbrawl.com address pass through Cloudflare to our mailbox. It does not handle your game traffic.
Google (Gmail): hosts the mailbox that receives emails you send to us.

The full list, with company names, locations and safeguards, is on the Subprocessors page.

Other players see your display name, game play and results, as described in section 2.

We may disclose data to authorities if the law requires it, or to protect our rights or the safety of players.

5. Transfers outside Switzerland and the EU

Letterbrawl is run from Switzerland. The EU recognises Switzerland as giving adequate protection, and Switzerland recognises the EU and EEA in the same way. The UK also recognises Switzerland as adequate.

We choose European data centres where we can. Our main servers and databases are set up in Frankfurt, Germany.

Some providers are US companies, and some data does go to the United States (for example Resend account data and email logs, Google Analytics data, and provider support and operations). For these transfers we rely on:

the EU-U.S. Data Privacy Framework, its UK Extension, and the Swiss-U.S. Data Privacy Framework, where the provider is certified; and
Standard Contractual Clauses approved by the European Commission, with the changes needed for Swiss and UK law, which are part of the providers' data processing agreements.

The Subprocessors page shows which safeguard applies to each provider. You can ask us for a copy of the relevant safeguards.

6. Cookies and local storage

We use:

Strictly necessary storage: the lb_session cookie (sign-in or guest ID), and local storage items for your name, room seats, which help screens you have seen, and your cookie choice. The game cannot work without these, so they do not need consent.
Analytics cookies: _ga and _ga_<ID> from Google Analytics, only if you click "Accept".

See the Cookie policy for the full list. You can change your choice at any time: .

7. Your rights

You have the right to:

Access: get a copy of your personal data and information about how we use it.
Rectification: have wrong data corrected.
Erasure: have your data deleted.
Restriction: ask us to limit how we use your data.
Portability: get your data in a common, machine-readable format.
Objection: object to uses based on our legitimate interests.
Withdraw consent: at any time, for analytics. This does not affect what happened before.
Complain to a data protection authority.

Do it yourself: if you have an account, you can download your data and delete your account in Settings in the game.

Ask us: email privacy@letterbrawl.com. We answer within 30 days. We may ask you to prove who you are, for example by writing from your account's email address. If you played only as a guest, we cannot link the data to you: it has no name or email, and it is deleted after 90 days without play. To delete it at once, clear this site's cookies in your browser.

Complaints: in Switzerland, contact the Federal Data Protection and Information Commissioner (FDPIC / EDÖB). In the EU or EEA, contact the data protection authority in your country (list of EU authorities). In the UK, contact the Information Commissioner's Office (ICO). We would be glad if you contact us first, so we can try to fix the problem.

8. Children

You must be at least 13 years old to use Letterbrawl.

In some countries a higher age applies for agreeing to online services on your own. In the EU and EEA this age is between 13 and 16, depending on the country. If you are under that age where you live, you may only create an account or accept analytics with the permission of a parent or guardian.

If you think a child under 13 has given us personal data, please email us and we will delete it.

9. Security

We protect your data with encrypted connections (HTTPS), signed session cookies that scripts cannot read, one-time sign-in links instead of passwords, and access controls at our providers. No system is perfectly safe. If a breach is likely to put you at risk, we will tell you and the authorities as the law requires.

10. Changes to this policy

We may update this policy when the game or the law changes. We will change the "Last updated" date at the top. The same applies to our list of service providers: we may change it at any time and keep the Subprocessors page up to date. If a change is important, we will tell you in the game or by email (if you have an account) before it takes effect. If we ever want to use your data for a new purpose that needs consent, we will ask first.

11. Contact

Jason Brownbridge, Switzerland
Email: privacy@letterbrawl.com

See also: Terms of Use · Cookie policy · Subprocessors