Privacy policy

1. Controller

Controller within the meaning of the General Data Protection Regulation (GDPR):

Ahmet Eroglu
Jahnstraße 14
50389 Wesseling
Germany

Email: datenschutz@mathword.app

2. Competent supervisory authority

State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia
Kavalleriestraße 2-4
40213 Düsseldorf
Web: https://www.ldi.nrw.de

3. Collection of general data when visiting the website

When you access this website, server logs are automatically collected by our hosting provider Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). The following data is processed:

• IP address (truncated)
• Date and time of access
• URL accessed
• Referrer URL
• User-Agent (browser and operating system information)

This data serves exclusively for the stable delivery of the website and the detection of technical problems. No personal evaluation takes place. Logs are automatically deleted after 30 days.

Legal basis: Art. 6 (1)(f) GDPR (legitimate interest in stable delivery).

The transfer to the USA takes place on the basis of the EU-US Data Privacy Framework (adequacy decision of the EU Commission of 10 July 2023) and supplementary EU Standard Contractual Clauses (Art. 46 (2)(c) GDPR).

4. Cookies

This website does not set cookies that require consent. No tracking cookies or advertising cookies are used.

If logged-in admin areas are set up in the future, a strictly necessary session cookie (__session, HttpOnly, SameSite=Strict) may be used. This cookie does not require consent under § 25 (2)(2) TTDSG.

5. Reach measurement

This website does not use any reach analysis tools such as Google Analytics, Matomo or comparable services. No pseudonymous or anonymous profiling takes place.

6. Data processing in the MathWord app

The following sections 7 to 11 apply exclusively to the MathWord mobile app (Android/iOS). When using the app, additional personal data is processed that does not occur when merely visiting this website.

7. Account, anonymous sign-in and profile data

The app supports playing without registration via anonymous Firebase Authentication provided by Google Ireland Ltd. (Gordon House, Barrow Street, Dublin 4, Ireland). A random user ID (UID) is generated and stored locally on the device.

If you optionally register with email or sign in via a Google or Apple account, the following data is additionally processed:

• Email address
• Provider tokens (Google/Apple OAuth)
• Self-chosen username

The following game-state data is stored in Cloud Firestore (Google Ireland Ltd.):

• Username
• Diamond and energy balance
• Streak (consecutive playing days)
• ELO score (skill rating for duels)
• Leaderboard position
• Year of birth (for the 13+ age check, pursuant to Art. 8 GDPR)
• Theme and language preference
• Statistics about played rounds

Processing partially takes place on servers in the USA. The basis is the EU-US Data Privacy Framework and supplementary EU Standard Contractual Clauses.

Legal basis: Art. 6 (1)(b) GDPR (contract performance).

8. Advertising via Google AdMob

We use Google AdMob (Google Ireland Ltd.) to deliver advertising. Formats used:

• Banner ads (static, at the bottom of the screen outside active gameplay phases)
• Rewarded video ads (voluntary, in exchange for in-game currency)

AdMob processes the following:

• Device advertising ID (Android Advertising ID / iOS IDFA)
• Truncated IP address
• Device and app information
• Ad-interaction data

If you consent to personalised advertising, additional profiling data is processed. If you decline, you receive non-personalised advertising with reduced tracking.

Consent is obtained via the Google User Messaging Platform (UMP) consent dialog in compliance with IAB TCF v2.2. You may revoke it at any time via the app settings under "Consent settings".

Legal basis:

• For personalised advertising: Art. 6 (1)(a) GDPR (consent)
• For non-personalised advertising: Art. 6 (1)(f) GDPR (legitimate interest in financing the free app)

Further information: https://policies.google.com/technologies/ads

9. Firebase Analytics and Crashlytics

If you consent to advertising in the UMP dialog, the app collects pseudonymous usage data via Firebase Analytics (Google Ireland Ltd.):

• Screen views
• Game events (tutorial progress, round started/finished, ad shown, in-app purchases made)
• Device and language information

A random App Instance ID serves as a pseudonymous key. If you decline in the UMP dialog, Analytics is disabled and no events are transmitted.

Additionally, Firebase Crashlytics collects anonymised crash reports (stack trace, device model, OS version) to detect and fix stability problems. Crashlytics is also active without advertising consent, as the data is used exclusively for error diagnosis and no profiling takes place.

Legal basis:

• Firebase Analytics: Art. 6 (1)(a) GDPR (consent)
• Firebase Crashlytics: Art. 6 (1)(f) GDPR (legitimate interest in stability monitoring)

Firebase Cloud Messaging (push notifications)

If you consent to push notifications, we use Firebase Cloud Messaging (Google Ireland Ltd.) to send you e.g. duel alerts or reminders. A device-specific push token is processed for this purpose. You can disable notifications at any time in your device settings; the token is deleted on sign-out or deactivation. Legal basis is Art. 6 (1)(a) GDPR (consent).

10. In-app purchases

Once the app offers in-app purchases (Premium subscription, diamond packs, avatars), purchases will be processed exclusively via the platform providers Google Play Billing (Google Ireland Ltd.) and Apple App Store (Apple Distribution International Limited, Hollyhill Industrial Estate, Cork, Ireland).

On our side, we only process:

• Confirmation of the successful purchase
• Platform-specific purchase ID (to link with the user account and prevent double-allocation)
• Type of content purchased (Premium subscription, diamond quantity, avatar ID)

We have no access to payment data (credit card number, bank details, PayPal address). The processing of these sensitive details is performed exclusively by the platform providers under their privacy terms:

• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/

Legal basis: Art. 6 (1)(b) GDPR (contract performance).

11. Storage period and deletion

Personal data is only stored for as long as is necessary for the respective purposes:

• Server logs of the website: 30 days
• Anonymous app accounts: Until app uninstall or manual deletion
• Registered app accounts: Until deletion by the user (see section 12)
• Crash reports: Up to 90 days
• In-app purchase receipts: Statutory retention obligations (typically 10 years under German tax law, AO/HGB)

12. Your rights as a data subject

Under the GDPR you have the following rights:

• Right of access (Art. 15 GDPR) — what data we process about you
• Right to rectification (Art. 16 GDPR) — correction of incorrect data
• Right to erasure (Art. 17 GDPR, "right to be forgotten") — complete deletion of your data. Available at any time in the app via "Settings → Delete account".
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — export of your data in machine-readable format
• Right to object (Art. 21 GDPR) — against processing based on legitimate interests
• Right to withdraw consent (Art. 7 (3) GDPR) — e.g. UMP advertising consent
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — see section 2

To exercise these rights, please contact: datenschutz@mathword.app

We process requests within the statutory period of one month (Art. 12 (3) GDPR).

13. Changes to this Privacy Policy

This Privacy Policy will be adapted in case of changes to app features or legal requirements. The current version is always available at https://mathword.app/en/privacy.

As of: 02 May 2026