Word Catch Privacy Policy

Effective 10 September 2026. Version 2.0. What changed.

Who is responsible for your data

Word Catch is published by Rebusarium, a small team of mobile game developers. In this policy, "we" means Rebusarium.

For anything concerning this policy or your data, including exercising your rights: hello@rebusarium.com. It is a working address, real people read it, and you get an answer within 24 hours.

This policy covers the Word Catch app and this website only. Our other apps have their own policies, listed on the home page.

What the app stores on your device

The game saves a handful of values using iOS storage (UserDefaults), inside the app's sandbox, where neither we nor other apps can reach them. The complete list, with nothing left out:

None of these values leaves your device: the app contains no networking code that could send them. We cannot see them and cannot obtain them.

None of it is personal data - it cannot identify anyone. We list it in full anyway, so you do not have to guess what "progress" stands for.

How to delete it

Deleting the app deletes everything listed above. There is no button for it, and no need to ask us - we do not hold this data. For the same reason we cannot restore it: no backup exists. That is the trade-off for a game that needs no account.

Advertising

The game is free and lives on advertising. There is exactly one format - a video for coins. Its button appears only when you do not have enough coins for a hint, and you start the video yourself. Advertising never interrupts play: there are no videos between levels and no banners in the game.

Ads are served by the Yandex Advertising Network through its SDK embedded in the app. It is the only third-party code in the game.

What leaves the app, and where it goes

The advertising module goes online when the game launches, not only when an ad is shown: it fetches its settings and prepares a video in advance so the button does not appear late. Requests go to Yandex servers:

• startup.mobile.yandex.net - SDK configuration;
• report.appmetrica.yandex.net - reports from the AppMetrica component (see below).

Along with the ad request, Yandex receives the technical details without which an ad cannot be selected: device model and system version, language and screen parameters, the app identifier and version, the SDK's own identifiers, and your IP address - which is visible on any network request and cannot be hidden.

We do not receive any of this. It goes to Yandex directly, bypassing us. All we can see in the advertising dashboard are aggregate numbers: how many impressions there were and how much they earned.

What the advertising module does not receive

• The device advertising identifier (IDFA). We do not present an App Tracking Transparency prompt, and without one the system does not hand the identifier over. Ads are therefore contextual, not personalised to your history.
• Precise location. The game never asks for location permission, so the advertising module has no access to coordinates. Coarse location - city-level, derived from the IP address - is declared by the AppMetrica component in its privacy manifest; it cannot be removed without removing advertising.
• Your game progress. Words found, level and coins are not passed to the advertising module; it knows nothing about them.

The full list of data categories

Below is everything declared by the privacy manifests of the advertising SDK and its components. These are machine-readable files inside the app; we did not write them and cannot change them, but anyone can read them, and we reproduce their contents in full.

Some of these do not apply to our game in practice: Word Catch has no in-app purchases at all, so no purchase history exists. We keep the row because it is a declared capability of the component, not because the data exists.

None of the categories is declared as linked to your identity. Tracking in Apple's sense is declared by a single component - AppMetricaAdSupport, with the domains tracking.appmetrica.yandex.net and tracking.reserve.appmetrica.yandex.net. Because we never request tracking permission, iOS itself blocks connections to those domains.

AppMetrica

The advertising SDK brings AppMetrica - Yandex's analytics component - into the app as a dependency, and it starts itself: it creates its own database inside the app sandbox (Library/Application Support/io.appmetrica/) and sends reports to a Yandex server.

We did not configure it, we hold no AppMetrica key and we receive no reports from it. The game has no analytics of ours: we do not know how many players we have or which levels they reach.

We say this plainly although we could have stayed silent: the file on your device and the network requests exist, and a policy that contradicts the app's behaviour is worthless.

How to limit it

• On iOS: Settings → Privacy & Security → Tracking - a system-wide ban for every app. We already comply with it: we never ask.
• Without a network at all: in airplane mode the game works in full - the dictionary and every level ship inside the app. Ads simply do not appear, and hints remain available for coins earned by finding words.

Yandex's own documents covering their side: the Yandex privacy policy, the AppMetrica policy and the Mobile Ads SDK terms.

What the app never does

• does not request or store your name, email address, phone number, date of birth, gender, or any other detail about you;
• never asks for location permission and does not determine your location;
• does not access contacts, photos, camera, microphone, calendar, health data or files;
• never presents an App Tracking Transparency prompt and never receives the device advertising identifier (IDFA);
• contains no analytics of our own: we do not know how many players we have or which levels they reach;
• builds no user profile and makes no automated decisions;
• contains no in-app purchases or subscriptions;
• never interrupts play with advertising: you start the video yourself, there are none between levels and no banners;
• does not pass your game progress to the advertising network.

The previous edition of this policy promised that the app made no network requests at all. Advertising made that untrue, so we removed the promise rather than leaving it in place. What now goes over the network is set out under Advertising. The game itself remains fully playable in airplane mode.

If you write to us

The only situation in which we receive your data is when you email hello@rebusarium.com yourself, from the app or by any other means.

We then receive: your email address, the text of your message, and anything you choose to attach.

What the "Contact us" button fills in

The game's settings include a "Contact us" button. It opens your mail app with a pre-filled message so we do not have to ask for technical details separately. Exactly three things are filled in:

• the app name and version;
• the device type - the word iPhone or iPad, with no model and no serial number;
• the iOS version.

The message is never sent automatically. You see all of it before sending and may add to, change or delete any part, including that footer. There are no hidden identifiers in it.

What we do with it

We read it and reply. We do not use your address for newsletters, do not add it to any list, do not pass it to third parties and do not sell it.

What Apple processes, not us

The app is distributed through the App Store, and Apple as the platform processes some data. We do not control this, and we would rather be explicit about it:

• Buying the app. Apple is the seller. Apple processes payment details; we never see or store them.
• Aggregate statistics. App Store Connect shows us summary figures: download counts, countries, iOS versions. These are aggregated, cannot identify an individual, and we cannot connect them to you.
• Crash reports. If you have allowed sharing analytics with developers in your iPhone settings, Apple may send us an anonymised crash report. You control this: Settings → Privacy & Security → Analytics & Improvements.

How Apple handles data is described in Apple's own privacy policy.

Legal bases for processing

For users in the European Economic Area and the United Kingdom (GDPR / UK GDPR):

• Support correspondence - legitimate interest (Art. 6(1)(f) GDPR): answering someone who contacted us. You get in touch on your own initiative and decide yourself how much to tell us.
• Data on your device - no processing in the GDPR sense takes place: the values never leave your device and are not accessible to us.
• Serving advertising - legitimate interest (Art. 6(1)(f) GDPR): a free app has to exist on something. Our advertising is contextual - we do not receive the advertising identifier and no profile is built from your history - so this processing does not require consent under Art. 6(1)(a). You can object to it by playing without a network; see Advertising.

For users in Russia (Federal Law 152-FZ): personal data is processed only to the extent you send it in your message, and only to answer you.

Who your data is shared with

We do not sell personal data. We pass nothing you have written to us, and nothing from your game progress, to the advertising network.

There are two recipients:

There are no other recipients. The two are unconnected: a support email never reaches the advertising network, and an ad request carries neither your address nor anything else from our correspondence. The website you are reading loads no third-party services whatsoever: no fonts, no counters, no widgets - not one external resource on any page. You can confirm this in your browser's developer tools.

We may disclose data if the law requires it. No such request has ever been made.

International transfers

Mail hosting for the domain is provided by VK / Mail.ru, whose servers are located in Russia. If you write to us from the European Economic Area, your message reaches servers outside the EEA. There is no European Commission adequacy decision covering Russia.

The same applies to advertising: the Yandex Advertising Network and AppMetrica are Russian services, and the technical data of an ad request is processed in Russia. If you are in the EEA, this transfer happens every time the game launches; you can avoid it by playing without a network.

We state this plainly so you can decide with your eyes open. If such a transfer is unacceptable to you, write from a mailbox in a jurisdiction you prefer, or say so in your first message and we will arrange another way to talk.

How long we keep data

We keep correspondence for a limited time for one reason only: so that if you write again, you do not have to explain everything from scratch.

Your rights and how to use them

The rights below concern your correspondence with us. Data collected by the advertising network is held by Yandex, not by us: to exercise rights over it, use the contacts in the Yandex documents linked under Advertising. We can neither read that data nor delete it.

If you are in the EEA or the UK (GDPR)

• Access - find out what data of yours we hold and get a copy;
• Rectification - have inaccurate data corrected;
• Erasure - have the correspondence deleted;
• Restriction - have processing paused;
• Portability - receive the data in a machine-readable form;
• Objection - object to processing based on legitimate interest;
• Complaint - lodge a complaint with the data protection authority in your country. That right does not depend on contacting us first.

If you are in California (CCPA / CPRA)

• we do not sell and do not share personal information as CCPA defines those terms, and have not done so in the preceding 12 months;
• you may ask what categories of data we hold and request deletion;
• we do not discriminate against you for exercising these rights - there is nothing in the app that could be withheld.

If you are in Russia (152-FZ)

• you may obtain information about the processing of your data, demand correction, blocking or destruction, and withdraw consent;
• you may complain to Roskomnadzor.

How to exercise them

Email hello@rebusarium.com from the address you wrote to us from and say what you want, in your own words - no legal phrasing needed. We answer within 30 days, usually sooner. We charge nothing for this.

If a request arrives from an address that appears nowhere in our correspondence, we will ask for details - not out of bureaucracy, but so we do not hand someone else's messages to a person who did not write them.

Children

The app never asks for an age and collects nothing from anyone, children included. It contains no in-app purchases, no chat and no user-generated content - no mechanism through which a child could disclose anything or spend money.

There is advertising in the game, and that has to be said plainly. A video plays only when tapped, and only when coins are short of a hint; it never appears by itself. We do not receive the advertising identifier, so ads are not matched to the device's history. But an ad video is an outbound link: tapping it opens the advertiser's page or an App Store listing. If you hand the phone to a child, bear that in mind.

We knowingly collect no data from children under 13 (COPPA) or under 16 (GDPR). If you are a parent and believe your child emailed us personal details, write to us and we will delete them.

Security

Game data needs no protection from us: it sits in the app's sandbox on your device, protected by iOS itself, including device encryption.

Correspondence is kept in a mailbox only we can open, secured with two-factor authentication. This site is served over HTTPS only.

Absolute security does not exist, and promising it would be dishonest. We reduce the risk in the most reliable way available: data we never collect cannot be lost by us. The game itself collects nothing - that is a design decision, not an omission. What the advertising module sends is described above, and it is held by Yandex, not by us.

Changes to this policy

If the app changes in a way that changes how data is handled, we will update this page before that version ships, not after.

For material changes we will raise the policy version and describe what changed - the previous text will not be quietly replaced. The effective date is shown at the top of this page.

Contact

Questions about this policy, exercising your rights, anything else: