Who is responsible
Numberplate Words is operated by Stuart Tippett, trading as Rogue Terrapin, a self-employed software developer in Spain. The operator is the controller for personal data processed through the game and this website.
Privacy requests can be sent to privacy@numberplatewords.app. General support requests can be sent to support@numberplatewords.app. Operator details are published at https://rogueterrapin.io/legal/.
Guest and device-local play
Practice and the current Daily Challenge can be played without an account. Appearance, haptics, reduced-motion preference, optional diagnostics choice and guest-capable Daily history may be stored locally on the device. Clearing app storage or uninstalling the app removes this local information.
Player accounts and sessions
When you create a recoverable player account, Numberplate Words processes your display name, the Apple or Google sign-in provider used, provider-supplied email where available, provider and player identifiers, aliases, linked-account state and session records. Security records can include creation and expiry times, IP address and user-agent information. Provider identity tokens are verified during sign-in and are not stored as reusable credentials.
Gameplay and social features
Competitive matches store rules, timing, participants, banked guesses, adjudications, scores, results and lifecycle state so matches survive restarts, reconnect safely and resolve consistently. Friends, invitations, blocks, notification preferences, device push tokens and in-app notifications are processed when those features are used.
Safety, moderation and support
A player report contains a selected category and server-verified profile, invitation or closed-match context. There is no free-text report field. Reports do not attach guesses, provider identities or private account details.
Moderation records can retain a reported display-name snapshot, limited match metadata, decisions and audit events needed for review. When an account is deleted, references to that account and retained display-name snapshots are removed or anonymised while a non-identifying record may remain for safety, fraud prevention and legal obligations. Support emails contain the information you choose to send.
Reliability and security
Optional mobile reliability telemetry records typed events such as app version, environment, operation, timing, outcome, lifecycle stage and privacy-safe error fingerprints. It excludes raw guesses, request bodies, access tokens, email addresses, display names and raw account or match identifiers.
Mobile telemetry is sent only to the Numberplate Words API. The API validates, minimises and exports scrubbed records over HTTPS using the OpenTelemetry Protocol to the observability processor configured for the deployed environment. Collector credentials are never embedded in the mobile application. Minimised server request, security and failure records are still created where needed to operate and protect online features.
How information is used
- Provide guest play, player accounts, multiplayer, friends, invitations, notifications and recovery.
- Apply game rules, preserve competitive integrity and resolve matches consistently.
- Investigate reports, enforce blocks, prevent abuse and protect the service.
- Respond to support, privacy, export and deletion requests.
- Diagnose crashes, reliability failures and security incidents.
- Meet legal, dispute-handling and app-store obligations.
Depending on the activity, the legal basis is performance of the service requested, legitimate interests in operating and protecting the game, consent for optional device diagnostics, or compliance with legal obligations. Numberplate Words does not sell personal information, use gameplay for targeted advertising, upload your address book or provide direct messaging.
Service providers and disclosures
Information is shared only where needed to operate the service, comply with law or protect players. Relevant recipients can include Apple and Google for authentication; Apple Push Notification service, Firebase Cloud Messaging and Expo notification infrastructure for delivery; infrastructure, database, email and observability providers acting on the operator’s instructions; and authorities or professional advisers where legally required.
Providers receive only the information required for their role and are subject to contractual, platform or legal safeguards. International transfers, where applicable, use the mechanisms required by data-protection law.
Retention
- Completed competitive matches: 180 days.
- Abandoned or cancelled matches: 30 days.
- Raw structured reliability telemetry: no more than 30 days.
- Aggregated reliability metrics: no more than 90 days.
- Player reports: normally 180 days.
- Moderation audit events: normally 365 days.
- Account and active social data: while the account remains active, then removed or anonymised through deletion.
A longer period may apply where necessary for an active investigation, security incident, dispute, fraud prevention, legal claim or legal obligation. Closed records are removed through documented retention cleanup. The configured observability processor must use matching or shorter retention and restricted operator access before production telemetry is enabled.
Your choices and rights
You can disable optional mobile diagnostics in Settings. The choice remains on that device, queued mobile events are cleared immediately, and new mobile lifecycle or crash events are not created while diagnostics are disabled. This preference does not disable minimised server request, security and failure records needed to operate and protect online features.
Signed-in players can export a portable account record and permanently delete their account from Account Data. The public account-deletion page at https://numberplatewords.app/account-deletion/ provides a route for people who cannot access the app. Deletion revokes sessions, removes provider links and personal account details, anonymises safety references and resolves active matches under the published lifecycle rules.
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent without affecting earlier processing. Contact privacy@numberplatewords.app. You may also complain to the Spanish Data Protection Agency or another competent supervisory authority.
Children, security and changes
Numberplate Words is intended for a general audience but is not directed at young children. A parent or guardian who believes a child supplied personal information without appropriate permission should contact the privacy address.
We use proportionate safeguards including encrypted connections, access controls, minimised telemetry and server-authoritative competitive state. No online service can guarantee absolute security.
This policy may change when features, providers or legal requirements change. Material changes will update the document version and effective date and, where appropriate, be accompanied by an in-app notice.