Letter Storm Privacy Policy

Last updated: 2026-05-25. Effective immediately.

This Privacy Policy explains what data Letter Storm ("we", "us", "the app") collects, how we use it, and the choices you have. The app is operated by David Thompson. Contact: support@letter-storm.app.

1. What we collect

• Account info: email address, username, display name, optional avatar seed. Required to create an account and play multiplayer.
• Gameplay data: moves you make, words you play, your scores, win/loss record, ELO rating, achievements, and the games you participate in. This is what makes leaderboards and stats work.
• Chat content: in-game messages and direct messages you send. Stored so the recipient can see them and so we can review reports of abuse.
• Device info: when you use the app we receive your IP address (in server logs, kept for security purposes for up to 30 days), browser/device user-agent, and (if you opt into push notifications) a push notification token.
• Authentication tokens: we store a hashed password (using industry-standard hashing — never plaintext) and short-lived JSON Web Tokens for keeping you signed in.

2. What we DON'T collect

• We don't use any third-party advertising networks or analytics SDKs.
• We don't track you across other apps or websites. The Apple App Tracking Transparency status is "Not Tracking".
• We don't access your contacts, photos, microphone, camera, location, or health data.
• We don't sell your data to anyone. Ever.

3. How we use your data

• To authenticate your account and keep you signed in.
• To run the game — match you with opponents, store your moves and scores, deliver chat messages.
• To send push notifications (only if you've opted in) for game turns, messages, and friend activity.
• To investigate abuse reports and enforce our Terms of Service.
• To debug crashes and errors (we use Sentry for error tracking; only anonymized stack traces are sent, not user content).

4. Who we share it with

• Other players can see your username, display name, avatar, public stats, and any chat/DM messages you send to them.
• Our infrastructure providers (Fly.io for hosting, Upstash for caching) process data on our behalf strictly to deliver the service. They don't use it for their own purposes.
• Sentry receives anonymized error stack traces. No game content or personal data is sent.
• Apple / Google Play handle app distribution and (in v1.1) payment processing for in-app purchases.
• We will disclose data only if compelled by valid legal process or to investigate/prevent fraud or abuse.

5. Your rights

• Access: request a copy of all data we hold about you. Email support@letter-storm.app.
• Correction: edit your display name, avatar, bio in-app at any time.
• Deletion: open the app → Settings → Delete account. This permanently removes your account, in-progress games, chat history, friends list, inventory, and purchase records. Anonymized statistics linked to completed games are retained for leaderboard integrity. Deletion is final and cannot be undone.
• Opt out of notifications: Settings → Notifications.
• European, Californian and similar residents have additional rights (GDPR / CCPA). Contact us at support@letter-storm.app to exercise them — we'll respond within 30 days.

6. Children

Letter Storm is rated 12+ (Apple) / Teen (Google). The app is not directed at children under 13 (or under 16 in some EU jurisdictions). If you believe a child under that age has created an account, contact support@letter-storm.app and we'll delete it.

7. Security

All connections to our servers use TLS (HTTPS). Passwords are hashed using PBKDF2 with high iteration counts. Authentication tokens are JWT-signed and can be revoked. We undergo periodic security audits. No system is perfectly secure, but we take reasonable precautions.

8. Data retention

Account data: kept while your account is active. Deleted within 30 days of account deletion (some backups may persist for up to 90 days after).
Game data: kept indefinitely in anonymized form for leaderboards and stats.
Chat content: kept for 1 year, then automatically deleted unless flagged for abuse review.
Server access logs: 30 days.

9. Changes to this policy

If we make material changes we'll notify you in-app and update the "Last updated" date above. Continued use after notification constitutes acceptance.

10. Contact

Questions, complaints, requests: support@letter-storm.app

Back to Letter Storm · Terms of Service · Support