Privacy Policy — Wordy Bunch on Reddit

Who we are (Data Controller)

The data controller for Wordy Bunch is:

Wordy Bunch is a registered trade mark of Brainy Bunch Games Limited. Reddit is not us — Reddit runs the platform the game lives on, and Reddit's own handling of your account and activity is governed by Reddit's privacy policy.

What we collect, and why

The game stores most of the items below in Reddit's own Developer Platform storage. This game storage is kept separately for each community, so your play in one subreddit is not mixed with another. Operational runtime logs are separate from game storage and their retention is controlled by Reddit.

• Reddit identity — your public Reddit username, and in limited cases the Reddit account identifier supplied by Reddit. We use the username for leaderboards, competitions, saved progress, titles, and flair. The account identifier is used for push-notification delivery and to verify payment callbacks. We never receive your Reddit password or email.
• Game stats, progress, Best Finds, and fair-play evidence — your score, accepted words, best word, streaks, competition activity, titles, and display choices. The Best Finds ballot records candidate words with the first finder's username, each voter's username and selected word, and the winning username, word, and vote count. For competitive rounds the app also stores timing and tile-trace evidence, attempt identifiers, and validation results so the server can verify scores and moderators can review suspicious rounds.
• Leaderboard and standings entries — your username and score for a given day, stored so the community can see the rankings for that day, week, and month.
• Avatar image address — the web address of your Reddit avatar (snoovatar), fetched from Reddit and cached for about 24 hours so your avatar can appear next to your score. If you have no avatar, a simple initial is shown instead.
• Reports, moderation, and community-join records — a player report stores the reported username, the reporter's username and the report time. The app may retain an alert marker after moderators have been notified and may store moderation actions, reasons, dates, and visibility or disqualification state. It also keeps a short-lived marker when it offers the community-join prompt and a longer-lived marker when a player joins through that button.
• Reminder opt-in (only if you turn it on) — we store your username and time-zone offset. Where Reddit push notifications are available and you accept them, we also store your Reddit account identifier for delivery. At about 9pm in your local time on an eligible day when you have not already completed that day's board, the app sends one Reddit push notification or falls back to a Reddit private message when push delivery is unavailable. The same opt-in allows at most one private-message nudge per UTC day when another player overtakes you in a Duel.
• Duel and Arena messages — taking part in these competitions may cause the app to send operational private messages about a challenge, completed result, open-Duel summary, Arena turn, target, deadline, or format change. While delivery is pending, the app stores an event identifier, recipient username, subject, complete message text, attempt count, and first-queued time. Failed messages may move to a dead-letter record after five attempts.
• Daily result challenges — if you privately challenge another player from a Daily result, the app stores the board date, both usernames, the challenger's score, word count and complete accepted-word list, the Daily post identifier, and the creation time. When the other player completes the challenge, the record also contains their score, word count and complete accepted-word list, the winner, margin, completion time, and any cached avatar addresses. The invitation message contains the challenger's username and result. Invitation and completed-battle records expire after 14 days.
• Optional support-purchase callback — where support purchases are enabled and you use the 100-Gold checkout, Reddit sends the app the order identifier, status, product identifier, callback timestamps and the Reddit request context used to verify the buyer. Reddit does not send us payment-card, bank, or billing details. The payment handler writes a limited operational log containing the operation, raw order identifier, outcome, buyer-verification route, and whether username, account-ID, and subreddit context were present. It does not log the callback body, username, Reddit account identifier, Gold amount, or payment credentials.
• Supporter record (only if you support) — the app stores one record per order containing the order identifier, your Reddit username, Reddit account identifier where supplied, product identifier, fulfilment or refund state, and fulfilment or refund times. It stores both an active-order list and an all-orders list linked to your username; those lists contain raw order identifiers, including refunded orders in the all-orders list. The preference record contains your cosmetic-display choice, entitlement-cycle and reconciliation-version numbers, first-entitled time, and last-updated time. This lets the app provide the cosmetics, avoid applying the same callback twice, and remove recognition following a reversal. We store no payment amount, payment method, or information about purchases made elsewhere.
• Account-removal record — when deletion begins, the app creates a record containing your username, Reddit account identifier where available, how the request was received, the request time, and whether deletion is pending or complete. This lets the app block new writes during deletion, retry unfinished work, and avoid silently reopening a completed request.

Sharing cards as comments

When you finish a grid you can choose to post your result as a comment. The game draws the result card inside your Reddit app or browser, converts it to a PNG image, and sends that image to the app's server running on Reddit's Developer Platform.

• The server uploads the PNG to Reddit's media service and posts it as a Reddit comment by you, beneath the Daily post.
• The image contains the game details shown on the selected card, such as your score, words found, best-word length, streak, username, date, theme, and either a board-coverage pattern or a word-length tally.
• If the image upload or image comment fails, the app falls back to posting the validated plain-text and emoji version of your result as you.
• No result-card request or game details are sent to wordybunch.co.uk.
• Sharing is entirely your choice. Nothing is uploaded or posted unless you choose to share.

You can also choose to share an earned-title card in the community's Title Gallery. That card may contain your username, Reddit avatar, subreddit, up to five earned title names, earned-title totals by category, an optional weekly honour, the selected theme, and an optional supporter border. It follows the same client drawing, Reddit media upload and user-comment flow described above.

Reminder and competition messages

The Daily reminder is off until you turn it on, from the prompt after a game or from Settings. When enabled, the game sends one Reddit push notification at roughly 9pm in your local time on an eligible day when you have not already completed that day's board; otherwise it falls back to a Reddit private message. This consent also covers the once-per-day Duel overtake nudge described above. You can turn the opt-in off at any time in Settings, and moderators can pause Daily reminders for everyone in their community.

Separate private messages that are necessary to operate a Duel or Arena may be sent when you choose to participate, for example to tell you that a challenge arrived, a result is ready, or your Arena turn or deadline has begun.

What we do not collect

• Your email address, real name, phone number, or postal address.
• Your Reddit password — the game never sees it.
• Card number, billing address, bank details, or other payment credentials. Optional support purchases use Reddit Gold and are processed by Reddit; we receive only the limited callback information described above.
• Location data (GPS, IP-based, or otherwise). The only location-related value we ever use is the time-zone offset you provide when you opt in to reminders, and only to time that message.
• Device advertising identifiers, contacts, calendar, photos, or microphone.
• Third-party analytics or advertising SDKs — there are none. We do not use Google Analytics, Firebase, Amplitude, or any behavioural-tracking service, and there are no ads.

Third-party services

• Reddit Developer Platform — the game runs on Reddit's infrastructure. Reddit provides hosting, Redis storage, messaging, notifications, flair, media upload, comments, and the optional Gold checkout. Reddit processes Gold purchases and sends the app the limited callback information described above. Your use of Reddit is governed by Reddit's privacy policy and user agreement.

We do not send gameplay or result-card data to an external analytics, advertising, or image-generation service.

Children

Wordy Bunch is a general-audience word game with no adult content. It is played on Reddit, and Reddit's own rules require account holders to meet Reddit's minimum age. We do not knowingly collect information from children beyond the Reddit identity and game, notification, and optional support information described in this policy.

Data retention

• Stats, streaks, and titles — kept so your progress and streak survive between days. Removed on request (see "Your rights").
• Leaderboard and standings entries — kept so past days, weeks, and months can still be viewed.
• Fair-play audit summaries — kept without an automatic expiry so moderators can review competitive results and the app can protect one-attempt and title-progression rules. The current automated game-data deletion does not remove these per-date summaries.
• Best Finds ballots — candidate, vote, and winner records are kept without an automatic expiry so past community results and title awards remain available. The current automated game-data deletion does not remove a username from those records.
• Competition history — kept for ongoing Duels, Arena operation, completed match records, Champion history and the Hall of Crowns. Shared competition records may continue to name participants after an individual game-data deletion.
• Daily result challenges — invitations and completed battle records expire after 14 days.
• Avatar image address — cached for about 24 hours, then refreshed or dropped.
• Preferences and community markers — kept until changed or removed. Device-only display choices remain on that device. The signed-in master mute is kept in community storage and is not removed by the current automated game-data deletion. The join marker and other indexed app-side choices are removed by an account-removal run; the join-offer cooldown expires after about three days.
• Reminder opt-in — the opt-in and time-zone offset are deleted when you switch the reminder off. Removal of the stored push-delivery identifier is best effort, so a temporary storage failure may delay that part. A legacy last-sent date can remain until an account-removal run deletes it.
• Queued competition messages — a pending record is removed after successful delivery. After five failed attempts the app keeps a dead-letter copy, and it may keep a delivery marker to prevent duplicate sends. The current build sets no automatic expiry for those records.
• Reports and moderation state — kept to prevent duplicate reports or alerts, support moderator review and preserve enforcement decisions. The current build sets no general automatic expiry for these records.
• Supporter records — active and refunded order records are retained so the app can keep paid cosmetics working, process reversals, and handle repeated callbacks safely. The current build removes the supporter preference, public cosmetic marker, and flair during a game-data deletion, but retains the underlying order record and its username/account-ID association. Reddit separately keeps its own transaction record as the seller of Gold purchases.
• Account-removal record — the pending or completed deletion record is retained without an automatic expiry so deletion can be resumed safely and a completed request is not silently reopened. It contains the username, Reddit account identifier where available, request source, request time, and state.
• Support checkout diagnostics — operational payment log entries contain the operation, raw order identifier, outcome, buyer-verification route, and context-presence flags. They do not contain the callback body, username, Reddit account identifier, Gold amount, or payment credentials. Reddit controls retention of Devvit runtime logs.
• Shared result and title-card comments — these are ordinary Reddit comments posted by you; you can edit or delete them from Reddit like any other comment.

Your rights

Under the UK General Data Protection Regulation and the Data Protection Act 2018, you have the right to access, correct, erase, restrict, or object to processing of your personal data, and to data portability.

• Turn off reminders at any time in Settings — this removes the active opt-in and time-zone offset straight away. Removing the push-delivery identifier is best effort, and the legacy last-sent date is removed during account deletion rather than by the reminder toggle.
• Delete a shared comment directly on Reddit, the same way you delete any comment.
• Ask us to remove your game data. In the game, open Settings and choose Delete my game data, or email contact@brainybunchgames.co.uk with your Reddit username. The app queues removal of leaderboard scores, streaks, titles, reminder and join settings, raw or held play traces, public supporter recognition, and flair. Failed steps are retried by the app's hourly maintenance job. The current build retains the fair-play audit summaries, Best Finds ballots, shared competition history, signed-in master-mute field, supporter order records, and account-removal record described above; some of those records continue to contain your username or Reddit account identifier. Daily result-challenge records expire after 14 days. Removing game data ends supporter cosmetics but is not a refund; Gold refunds are requested through Reddit Help.

Right to complain. If you are unhappy with how we have handled your information you can complain to the UK supervisory authority: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk. We would appreciate the chance to address your concern first.

Changes to this policy

If we change this policy, we will update the "Last updated" date at the top. Material changes — a new category of data or a new service — will be noted here before they take effect.

Changed 27 August 2026. Result-card images are now drawn inside the Reddit client and uploaded directly to Reddit's media service. The earlier wordybunch.co.uk/card.php flow is no longer used.

Changed 27 August 2026. The optional 100-Gold support checkout and its cosmetic supporter recognition are available where enabled. This policy now describes the callback, stored supporter records, operational logging, and reversal behaviour currently used by the app.

Changed 27 August 2026. Added the current title-card sharing flow and fuller disclosures for competition messages, reports, moderation, retention, and account removal.

Contact

For game support: support@wordybunch.co.uk

For data-rights requests, complaints, or anything addressed to the data controller: contact@brainybunchgames.co.uk