Privacy Policy

1. Who is responsible

The data controller is Founder Panda, address: Turkey. For anything about your personal data, write to privacy@guessclash.com.

2. What we collect

2.1 What you give us

• Display name and username. Creating an account takes a single field: a name. A username is derived from it. Both are visible to other players.
• Email address and password (optional). Only if you secure your account so you can sign in on another device. Passwords are stored as salted hashes, never in readable form.
• Google or Google Play Games sign-in (optional). If you use it, we receive an account identifier and, for Google sign-in, your email address. We never receive your Google password.
• Profile photo (optional). It is cropped and resized in your browser before it reaches us, and it is checked before other players can see it.
• Messages. The text messages, photos and voice messages you send to other players in Messages, so the conversation can be shown to its participants.
• Comments. Comments you post on blog articles and dictionary entries, together with your display name.
• Reports and support requests. What you write when you report a player or contact support, including any screenshot you attach, plus your account details so we can reply.
• Sponsor word applications. If you apply for a sponsored word: the word, brand name, link and contact details you provide.

2.2 What is created as you play

• Game results: scores, words solved, wins, losses and draws, and your progress in single-player modes.
• ELO rating, XP, level, title, badges, trophies and medals, your inventory (jokers and gifts) and any ad-free time.
• League standings (daily, monthly, yearly and all-time), kept separately for each language you play in.
• Friend connections, the private labels you give your friends, blocked players and gifts sent and received.
• Invitations: who invited whom, the invite code used and the status of any reward.
• The notifications we send you and your notification preferences.

2.3 Technical data

• Sign-up IP address. Stored when you create your account, to enforce a per-IP account limit and to stop abuse of invitation rewards. It is erased when you delete your account. We do not keep a log of every request you make.
• Invitation device key. A random identifier saved on your device when you arrive through an invite link. It is used only to stop the same device from claiming invitation rewards again and again.
• Platform and activity. Whether you use the app, a mobile browser or a desktop browser (one of those three values, not a device fingerprint), when you were last active and whether you are online right now.
• How you found us. A short summary of the link that brought you to sign up — for example an invite, a search engine or a campaign tag. Never your browsing history.
• Language. The language you play in, so that pages, notifications and leagues use it.
• Push token (optional). Only if you allow notifications, so we can deliver them to your device.
• Daily visit counters. One number per day per platform, with no IP address, user agent or identifier attached.

3. Why we use it

• To run the game: match you with opponents in your language, score rounds and keep your progress.
• To show leaderboards, profiles, match history and live matches that other players can watch.
• To deliver messages, gifts, invitations and their rewards.
• To send the notifications you asked for.
• To answer support requests and handle reports.
• To keep the game fair and safe: detect abuse, cheating, offensive or impersonating names and invitation fraud.
• To understand, in aggregate, roughly how many people use the game.
• To show ads, so the game can stay free.

4. Legal bases

• Performance of a contract. Everything needed to provide the game itself: your account, progress, matchmaking, messages and invitations.
• Legitimate interests. Keeping the service safe and fair (including name checks and abuse prevention), aggregate usage counts and basic product improvement.
• Consent. Push notifications, personalised ads, ad measurement and visit statistics (Google Analytics, Meta, TikTok) and microphone access. You can withdraw consent at any time; the game keeps working.
• Legal obligation. Where we must keep or disclose data under applicable law.

5. Information that is public

Because this is a multiplayer game, some information is visible to anyone: your display name and username, avatar or profile photo, level, title, badges, trophies and medals, league positions and match history. Public matches can be watched live by other players. Your email address, password, IP address and messages are never shown to other players.

In your profile settings you can hide your online status and turn off incoming friend requests. You can also block a player.

House players. In some languages, to keep matches and leagues active, some accounts are house players run by GuessClash. They follow the same rules and scoring as everyone else. They are not linked to any real person, so no personal data is collected about them.

6. Name and photo checks

New names are first checked automatically against a list of offensive words. Where that check is not certain, the name and username — and nothing else — may be sent to OpenAI for a second automatic check. Names and photos can also be reviewed by a moderator, who may reject them. OpenAI processes these names on our behalf and, under its API terms, does not use them to train its models.

7. Cookies and local storage

We keep a small number of items in your browser that the game needs — such as your session, language, theme and sound settings. Advertising and analytics are separate and depend on your choice. The full list, and how to switch them off, is in our Cookie Policy.

8. Third-party services

We share data only with the providers that make the service work:

• Hosting and database — our servers, which store your account and game data.
• Advertising and measurement partners — Google (AdMob, AdSense, Analytics), Meta and TikTok, as described in section 9.
• Firebase Cloud Messaging (Google) — to deliver push notifications, if you allow them.
• OpenAI — the second automatic name check described in section 6.
• Google Sign-In and Google Play Games — only if you choose to sign in with them.
• Google reCAPTCHA — the “I'm not a robot” check, where it is switched on for sign-up.
• Google Fonts — the site's typefaces are loaded from Google servers.
• Speech recognition — if you guess by voice, the speech recognition built into your browser or device (for example by Google or Apple) turns your voice into text. We receive only the text, never the audio.

We do not sell your personal data. We disclose it to authorities only where we are legally required to.

9. Advertising, measurement and attribution

GuessClash is free. To pay for it we show ads, and we advertise the game on other platforms. To know which of our ads actually bring new players (“attribution”), we may share measurement data with the platforms below. Each one is listed with its current status: a platform that is not in use receives nothing from us.

Google Analytics (Google) — visit statistics: pages visited, time spent, device and browser type, approximate location (city level, from a shortened IP address) and events such as signing up. Purpose: to see how the game is used and to improve it. Google privacy policy.

Meta Pixel (Meta — Facebook and Instagram ads) — records events on our website (page views, signing up) together with Meta cookies (_fbp, _fbc), your IP address and browser details. Purpose: so Meta can tell us how many players our ads brought, and show our ads to people with similar interests. Meta privacy policy.

TikTok Pixel (TikTok — TikTok ads) — the same kind of event data (page views, signing up) together with TikTok cookies (_ttp), your IP address and browser details, for the same purpose. TikTok privacy policy.

Google AdMob and AdSense — ads inside the app and on the website. Google may use cookies and your device's advertising identifier to show and measure ads, and to personalise them where you have consented. Google privacy policy.

Status: in use.

In the mobile app, ad measurement uses your device's advertising identifier: the Android advertising ID, or on iOS only if you allow tracking when the app asks.

Meta SDK and TikTok Business SDK (Android app) — the app's counterpart of the pixels above. When switched on, they tell Meta and TikTok that the app was installed and opened and that an account was created, together with your device's advertising ID, device model, operating system and app version, and your IP address. Purpose: to measure which of our ads brought new players. They start only after you choose “Accept” in the notice shown in the app; before that, or if you choose “Decline”, they send nothing. You can change your choice at any time on our Cookie Policy page. The website pixels are separate and follow the choice you make on the website.

We never send these platforms your name, email address, password, messages or the content of your games. Each platform processes the data under its own privacy policy and may combine it with information it already holds about you.

Legal basis: your consent. On the website nothing is sent to Google Analytics, Meta or TikTok unless you choose “Accept” in the cookie banner. In the app, the advertising identifier is used according to your device settings.

How to refuse or change your mind: choose “Decline” in the cookie banner, or change your choice at any time with the button on our Cookie Policy page. On your phone you can reset or delete your advertising ID (Android) or turn off “Allow Apps to Request to Track” (iOS). You can also manage ads in your Google ad settings, your Meta ad preferences and the privacy settings of the TikTok app. Declining does not remove ads; it stops measurement and personalisation.

Where the data goes: Google, Meta and TikTok process data in the United States and in other countries. These transfers rely on the EU–US Data Privacy Framework where the company is certified under it, and on standard contractual clauses otherwise.

Children: the Platform is not directed at children. It is intended for people aged 13 and over, and our ad campaigns are aimed at that audience. We do not knowingly send data about children to advertising platforms.

10. International transfers

Some of the providers above, including Google, Meta, TikTok and OpenAI, process data outside your country, for example in the United States. Where data is transferred internationally, it is protected by the safeguards those providers offer, such as the EU–US Data Privacy Framework or standard contractual clauses.

11. How long we keep data

• Account and game data — for as long as your account exists. When you delete it, it is anonymised as described in section 16.
• Notifications — deleted automatically after 30 days.
• Voice messages — the audio files are deleted automatically after 30 days. Text and photo messages are kept for the participants of the conversation.
• Support requests and reports — while they are open and for a reasonable period afterwards.
• Sign-up IP address and invitation records — the sign-up IP address is kept while your account exists and erased when you delete it. Invitation records are kept while the accounts involved exist, to prevent abuse of invitation rewards.
• Data shared with advertising partners — kept by Google, Meta and TikTok under their own policies. On our side we keep only a short note of how you found us (section 2.3).
• Daily counters — aggregate numbers only; they contain nothing personal.

12. Security

Traffic is encrypted with HTTPS. Passwords are stored as salted hashes. Administrative access is limited and authenticated. No system is perfectly secure, but we deliberately keep the amount of data we hold small, which is the most effective protection of all.

13. Languages

The Platform is available in several languages. Your account, XP, badges, inventory and friends are shared across all of them; leagues and progress are kept separately for each language. This policy is published in several languages; if a translation differs from the English version, the English version prevails.

14. Children's privacy

The Platform is not directed at children and is not intended for anyone under 13. We do not knowingly collect personal data from children or send it to advertising platforms. If you believe a child has created an account, write to us and we will remove it.

15. Your rights

Depending on where you live, you have the right to:

• access the personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw your consent at any time;
• complain to your local data protection authority.

To exercise any of these, write to privacy@guessclash.com. We reply within one month at the latest.

16. Deleting your account

You can delete your account yourself, from your profile, at any time — or use our account deletion page if you cannot sign in.

Your account is then anonymised: your name becomes “Deleted user”; your email address, password, Google and Play Games connections, photos, friend connections, push tokens and notification settings are erased; and nobody can sign in to it again. Your profile disappears from leaderboards, search and friend lists.

Some records stay, because they also belong to other players: match records (your name in match history and match summaries is replaced with “Deleted user”) and the messages you sent, which stay in the other participants' conversations under the name “Deleted user”. Your sign-up IP address is erased; invitation records are kept to prevent abuse. Data already shared with advertising partners is kept by them under their own policies.

17. Changes to this policy

We may update this policy as the game changes. The date at the top always shows the current version. Significant changes will be announced in the app.

18. Contact

Questions about this policy or your data: privacy@guessclash.com. General enquiries: support@guessclash.com.