Privacy Policy

What WordRails stores

To run games, WordRails stores the details you give us and the records a game creates:

• Your name, email address, chosen avatar, and alert preferences.
• Your game memberships, boards, moves, scores, and invitations, including the email address an invitation is sent to.
• Lifetime statistics and records against individual opponents, kept separately from completed boards.
• Notifications and whether you have read them.
• Sign-in sessions, including the browser's user agent and last activity.
• If you turn on browser alerts, the browser push endpoint and subscription keys.

Like most web services, WordRails may also produce operational logs, such as IP address, browser, and request details, used to run and protect the service.

How we use it

Email addresses are used to send sign-in links, game invitations, and game alerts. Email game alerts start on for new accounts and can be turned off in Settings. Hosting, email, and browser push providers process the data needed to deliver these features.

Who can see what

Signed-in players can look each other up by searching a name or an email address, including an email prefix. Search results show names and avatars, not full email addresses. The two players in a game can see that game's moves, scores, and shared chat. Chat is limited to those two accepted players, but it is not end-to-end encrypted.

Live chat rows are removed from the active database when a game finishes or is deleted. That does not erase copies a recipient saved, screenshots, or any existing backups. Board and statistics retention is described below.

Cookies and staying signed in

WordRails uses only the cookies it needs to run the service:

• An essential, encrypted, HttpOnly good_words_session cookie keeps your browser signed in. It has a rolling one-year expiry that is renewed at most once a day while you are active.
• A Rails _good_words_session cookie holds security and session navigation state and lasts for the browser session.
• When you move between WordRails addresses, a short-lived cookie continues your sign-in safely.

Removing cookies in your browser, or using Sign out, ends access for that browser. Other devices can stay signed in. Browser cookie controls can stop sign-in and other features.

A small browser preference remembers where you last read each game’s chat. It contains a message number, not message text, and is not shared across your devices.

WordRails does not use advertising or analytics cookies. Optional browser alerts use your browser's notification permission. You can turn alerts off in Settings or in your browser, and change email alerts in Settings.

How long things stay

Your latest 20 completed boards are available to revisit. Older completed games, including their moves and boards, are removed from the active database once they fall outside both human players’ latest 20. Lifetime and head-to-head statistics remain after those games are removed. Chat is removed when a game finishes. Canceling an unaccepted invitation removes its waiting board, if any. These removals do not erase existing backups. Account records have no automatic expiry; contact us to request removal.

Sign-in emails contain a single-use link that works for 20 minutes. WordRails stores a digest of the link rather than the raw sign-in token.

Your choices and requests

For access, correction, or removal, email apps@adam-goodman.com from your account address and use the subject “WordRails account/data removal”. Requests are handled manually, and there is no self-service account deletion yet.

We may verify that a request comes from the account holder. Please do not send passwords, sign-in links, or government IDs. We may need to keep limited shared game history, security, and legal records, and we will discuss what can be removed for your request.

You can change alert preferences yourself in Settings when you are signed in.