Field paperwork

Privacy

Last updated: 17 September 2026

Word Commando is an online game made and operated by Midnight Crush Games, the controller responsible for the personal data described here. Contact us using the privacy request form below. This notice covers the game, optional accounts and cloud saving, and the separate full-game launch email list.

Cookies & saved progress

The game does not use advertising cookies, tracking pixels or client-side analytics. It uses functional browser storage to remember vocabulary progress between visits. No cookie-consent pop-up is used for this storage: it supports the game’s saved-progress feature, rather than advertising or tracking you across sites.

Your browser stores guest vocabulary progress and game settings. Progress includes mastery, attempts, correct and incorrect answers and review dates, separately for each translation direction. Guest records are not uploaded automatically. Opening an account does not merge them into cloud progress; you can choose to add your earlier browser progress in Account. Open or collapsed panels reset on reload. Your browser may also cache game files.

If you sign in, your browser remembers your sign-in session so you do not need a new email code on every visit. It also stores a copy of your account’s progress and settings, plus changes waiting to save to the cloud. This supports continued play when the connection drops. Each account’s copy is kept separately.

Guest data remains until you delete it or the browser clears site data. Signing out clears the current account’s local cache and restores guest progress; the game first tries to save any waiting changes and will show an error if it cannot sign out safely. Clearing site data yourself can lose unsynced changes. It also signs you out, but does not delete your cloud account.

The controls below download or delete guest vocabulary progress in this browser. They do not delete saved settings, an account, cloud saves, or submitted emails. Use Account in the game to export or reset cloud progress, or delete your account. Browser controls can clear all of this site’s local data. Separate browsers, devices, localhost and older site addresses have separate local copies.

What data is used, and why?

Playing: local learning records make the saved-progress and review features work. Where these records are personal data, processing is necessary to provide the game service you request (GDPR Article 6(1)(b)). Guest play does not require an account.
Optional account and cloud saving: your email, account identifier, sign-in records, learning records, game settings and sync timestamps let us authenticate you and provide the cross-device saving you request (Article 6(1)(b)). Account security and abuse prevention also serve the legitimate interest of protecting players and the service (Article 6(1)(f)).
Optional launch email: your email address, affirmative consent, notice version and submission time let us send the one launch notification you request. The basis is consent (Article 6(1)(a)); signing up is never required to play.
Bug reports: your description, selected card and the current prompt, sector, translation direction and play mode let us investigate. You can optionally include an email address for a reply. This serves our legitimate interest in fixing and maintaining the game (Article 6(1)(f)). We do not attach screenshots, account progress or recordings, and reporting does not subscribe you to marketing.
Privacy requests: your email, request type, optional message and related correspondence let us respond and fulfil data-protection obligations (Article 6(1)(c)). Please don’t include passwords or sensitive information.
Hosting and security: Netlify receives ordinary connection information, such as IP address, requested URL, browser information and timestamps, when delivering the site or accepting forms. Delivery supports the requested service; security and spam prevention serve the legitimate interest of keeping it available and safe (Article 6(1)(f)).

Recorded word audio is served with the game. If a recording fails, your browser’s text-to-speech service may read the game word instead. Some browser or operating-system voices use an online provider under that provider’s privacy settings. The game does not access your microphone, record audio or capture your screen.

Optional accounts & cloud saves

Accounts are for people aged 16 or older. An email code verifies access to your address; you do not create a password for the game. Supabase handles authentication and stores cloud records. Resend delivers the sign-in emails. Signing in never subscribes you to the separate launch list.

While signed in, learning results and saved settings sync to your account when a connection is available. The game keeps an offline copy and shows when changes are waiting. Guest progress is separate. If you explicitly add guest progress, only words missing from that account are added; existing cloud word records and the guest copy remain.

Account provides a downloadable copy of your account data, a confirmed reset of cloud learning progress, and account deletion that requires you to type DELETE. Resetting progress keeps the account. Successful account deletion removes the sign-in account and its linked live game records. These actions leave the separate guest copy in this browser, which you can delete above. Local copies on other devices must be cleared there; deleting an account does not remotely erase an offline browser’s storage.

Account and cloud records are kept while the account is open so that you can return to your save, until you delete it or the service is closed. You can also request deletion through the form below. Limited security logs, delivery records or backups may remain under the providers’ applicable retention periods, or where a specific legal obligation requires them; they are not an active game account. Contact us if you need help with those copies or cannot access your account.

Launch emails & withdrawal

The signup is for people aged 16 or older and is limited to one email about the full game’s launch. It does not sign you up for an ongoing newsletter. We do not sell your email or use it for advertising profiles. If an under-16 signup is discovered, we will remove it.

You can withdraw at any time using “Stop launch emails” below, without affecting your ability to play. Withdrawal does not make earlier processing unlawful. We will remove withdrawn addresses from the launch list before sending. The launch message will also explain how to contact us.

Launch-list entries are kept until the notification is sent, you withdraw, the launch is cancelled, or 12 months have passed since signup, whichever happens first. They are then deleted within 30 days. We keep a minimal record of consent or withdrawal and completed privacy requests for up to 12 months to document how they were handled, with access limited to that purpose. A record may be kept longer only where a specific legal duty or unresolved claim requires it.

Bug report retention

Bug reports and related replies are kept while we investigate, then deleted within 12 months after closure. We may keep a description of the technical issue with your email and identifying details removed.

Service providers & international transfers

Netlify, Inc. hosts the site and stores submitted forms on our behalf. Netlify’s form service uses Akismet for spam filtering. These providers may process form and technical data in the US and other countries. Netlify’s data-processing terms provide transfer safeguards, including the EU–US Data Privacy Framework where applicable and Standard Contractual Clauses where required. See its subprocessor list; you can also request information about the applicable safeguards from us.

Supabase processes account, authentication and cloud-save data, and Resend processes the destination address, sign-in email content and delivery information needed to deliver codes. Supabase hosts the project in its configured region; related provider operations and subprocessors may process data elsewhere, including the US. We do not promise that all processing stays in the EU. Their data-processing agreements contain applicable transfer safeguards, including Standard Contractual Clauses: Supabase DPA and Resend DPA. Their current Supabase and Resend subprocessor lists give further details. You can request information about the safeguards applicable to your data from us.

Hosting, authentication and email-delivery logs follow the providers’ applicable service retention periods, with longer retention only where necessary for security incidents or legal obligations. We do not maintain a separate visitor-tracking database. Information may also be disclosed when legally required. Links you choose to open to other sites are covered by their own privacy notices.

Your rights

Depending on the circumstances, you can request access, correction, deletion, restriction or a portable copy of your personal data, and object to processing based on legitimate interests. You can withdraw consent at any time. There are no decisions with legal or similarly significant effects made about you solely by automated processing.

Requests are normally free. We will respond within one month; if a complex request needs an extension permitted by law, we will explain within that month. We may ask for proportionate confirmation of identity before disclosing data. You can complain to the data-protection authority where you live or work, or where an alleged infringement occurred.

Contact Midnight Crush Games / make a privacy request

Use the email linked to the account or launch signup concerned. Choose “Stop launch emails” to withdraw from the launch list; this does not delete your game account. For account help, choose the appropriate data request and describe what you need. No account or extra marketing consent is needed. Sending a request does not itself delete data; we will review and act on it.

Changes

This notice will be updated when the game’s data use changes, including before a new provider or purpose is introduced. Any new purpose that requires consent will be offered separately.