Privacy Policy

Who we are

Word Find, at wordfind.com, is run by White Urchin Ventures, Inc. (“we”). This policy explains what data the site collects, why, who else sees it and how long it is kept. Our GDPR notice adds the legal bases and rights that apply in the European Economic Area, the UK and Switzerland.

Send questions about your data through our contact form.

Searching without an account

You don’t need an account to use Word Find. When you search, the letters and filters you type travel in the page’s address (for example /unscramble/aeinrst/), so they reach our servers the way any web address does. We use them to answer the search. We don’t tie them to your name or email address.

Like every website, our servers receive your IP address, the address of the page you asked for, and what browser and device you use. Our host, Cloudflare, keeps request logs for 7 days so we can keep the site running and find faults.

Advertising

Word Find is free because it shows ads. Our advertising partner, Snigel, runs the ads and works with other ad companies, which may use cookies and similar technology to show ads, limit how often you see one, measure them and, where you allow it, tailor them to your interests. Snigel’s privacy and cookie policy explains what it does.

Snigel’s consent tool asks visitors from the European Economic Area, the UK and Switzerland for consent before personalised ads and their cookies are used. It follows the IAB’s Transparency and Consent Framework (version 2), and it lists every ad company it works with. You can change your choices at any time with Manage Consent at the foot of any page with ads, or here:

Pages with no ads load no ad code and no consent tool (the home page, the articles, the sign-in and account pages, the contact form and the Scrabble helper), so they show no Manage Consent button.

Analytics

We use Google Analytics 4 to count visits and see which pages are used. Google receives the pages you visit (including the letters in their addresses), your browser and device, and your approximate location from your IP address, and it sets its own cookies.

In the European Economic Area, the UK and Switzerland, Google Analytics starts with every kind of consent refused (Google’s Consent Mode, version 2). It sets no cookies until you agree in the consent tool. On a page with no consent tool, it stays refused unless you agreed on an earlier page. Everywhere else it is on by default, and you can turn it off with Manage Consent or Google’s opt-out add-on.

Accounts

An account is optional. It lets you sign in on any device and keeps your dictionary choice. There are no passwords: you sign in with a one-time link sent by email.

What an account stores

Your email address, and that you confirmed it, so we can send sign-in links.
Your dictionary (Scrabble US, Scrabble UK or Words with Friends), if you choose one.
Your sign-ins (sessions): when each started and ends, and the IP address and browser it started from, so you can see where you are signed in and we can spot misuse.
Sign-in links: while a link is waiting to be used we keep the email address it was sent to and a scrambled copy (a hash) of it, not the link itself. It works once and expires after 15 minutes.

Protecting sign-in

To stop people flooding inboxes or guessing, we count sign-in attempts per email address and per IP address. We store only a hash of the address or IP with the count, never the address itself. These counts last an hour or ten minutes, and we delete them once they are more than a day old (the clean-up runs as people sign in, so one can last a little longer).

The email sign-in form uses Cloudflare Turnstile to check that a person is asking. Turnstile looks at your IP address and signals from your browser; Cloudflare’s privacy policy covers it.

Sign-in emails

We email you only to send a sign-in link you asked for. No newsletters and no marketing. The emails are sent by Resend, from mail.wordfind.com.

The contact form

When you write to us through the contact form, we get your name, your email address and your message as an email, sent by Resend, so we can reply. The site itself doesn’t store them. The form uses the same Turnstile check, and counts messages per IP address (as a hash) for an hour to stop floods.

How long we keep it

Your account, as long as you keep it.
A sign-in lasts 30 days and is extended once a day while you use it. Signing out ends it at once.
An unused sign-in link, 15 minutes; a used one is deleted when it is used.

Export or delete your account

On your account page, Download your data gives you everything the account holds as a JSON file. Delete your account removes your account, email address, dictionary, every sign-in and any unused sign-in links at once, and signs you out everywhere. Our database host keeps a restore history for 30 days, so deleted data is gone from it within 30 days. If you can’t sign in, write to us through the contact form with the account’s address; we’ll confirm by email to that address and do it for you.

Cookies and browser storage

Word Find itself sets no cookies unless you sign in. It keeps a few small values in your browser:

Your dictionary choice (wf.edition, local storage), so searches stay in the dictionary you picked. It stays until you clear it.
Where you came from (wf.origin and wf.from-results, session storage), so a Words with Friends search stays in that dictionary and a word page can lead back to your results. They go when you close the tab.

When you sign in, we add:

The session cookie, which keeps you signed in for up to 30 days. Page scripts can’t read it.
wf_signed_in, which only tells the page to show your account menu. It holds nothing about you, is cleared when you sign out, and lasts at most 400 days.

Ad companies and Google Analytics set their own cookies, as described above, subject to your consent choices. The sign-in form’s Turnstile check may also store data in your browser.

Cloudflare hosts the site, its database and its storage, and runs Turnstile. Every request passes through it.
Snigel and the ad companies it works with, for advertising, as your consent choices allow.
Google, for analytics.
Resend, to send sign-in emails and the contact form’s messages.

We never sell or share your account data. We may disclose data when the law requires it, to protect the site or its visitors, or to a buyer if the site changes hands.

Where data is processed

We are in the United States, and our providers process data in the United States and other countries. Where data leaves the European Economic Area, the UK or Switzerland, we rely on the safeguards the law provides, such as the European Commission’s standard contractual clauses or the provider’s certification under the EU-US Data Privacy Framework.

Security

The site is served only over HTTPS. There are no passwords to steal: sign-in links are stored only as hashes, and session cookies can’t be read by page scripts. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

Children

Word Find is a general-audience site and doesn’t knowingly collect personal data from children under 13. Accounts are not for children under 16 in the EEA and the UK, or under 13 elsewhere. If you believe a child has given us personal data, tell us through the contact form and we’ll delete it.

Your choices and rights

Change your ad and analytics choices at any time with Manage Consent (on any page with ads).
Clear Word Find’s cookies and storage in your browser’s settings.
Download or delete your account on your account page.
Ask us to see, correct or delete your data, or object to how we use it, through the contact form. We answer within one month.

In the European Economic Area, the UK and Switzerland, the GDPR notice sets out your rights in full.

US state privacy notice

This part is for residents of California and other US states with privacy laws, such as Colorado, Virginia and Connecticut.

What we collect: identifiers (IP address, cookie and device identifiers, and your email address if you have an account), internet activity (pages visited and searches), and approximate location from your IP address. The sections above give the sources and purposes.
Sale and sharing for ads: letting ad companies use cookies on our pages to show you ads tailored to your interests may count as “selling” or “sharing” personal information, or “targeted advertising”, under these laws. Account data is never sold or shared.
Opting out: California visitors see a “Do Not Sell My Personal Information” link at the foot of each page with ads; it opens the opt-out in Snigel’s consent tool. Anywhere in the US you can also use Manage Consent at the foot of any page with ads, and choose to opt out of the sale and sharing of your personal information and of targeted advertising. Opting out doesn’t stop ads; you may still see ads, including some based on data collected before you opted out or from other sources.
Global Privacy Control: wherever you live in the US, you can opt out by turning on Global Privacy Control (GPC) in your browser or with a browser extension. On every page with ads, Snigel’s consent tool reads the signal and records that you opt out of the sale and sharing of your personal information and of targeted advertising. It passes that choice to the ad companies it works with, so you don’t need to do anything else. GPC applies to the browser you turn it on in, so turn it on in each browser you use.
Your rights: to know what we hold about you, to get a copy, to correct it and to delete it. Use your account page or the contact form; an authorised agent may ask for you. We check requests by email before we act on them, and we won’t treat you differently for using these rights.
How long we keep it: as set out under Accounts and Searching above.

Changes to this policy

When we change this policy we post the new version here with a new effective date. If a change is significant, we’ll say so on the site, and email account holders if it affects their account.