Privacy policy

1. Who we are

Ghost Static Labs ("we," "us," or "our") develops Word Anomaly (formerly Word Rift) and operates ghoststaticlabs.com, including its browser game and private playtest pages. This policy explains how we handle information when you play Word Anomaly, visit our website, or contact us. Ghost Static Labs is responsible for the information we process for these purposes.

Questions and privacy requests can be sent to info@ghoststaticlabs.com.

2. Game saves and online leaderboards

Information saved on your device

Word Anomaly saves progress, puzzle results, settings, earned items, collectibles, and related game state locally. The browser edition uses your browser's storage. This local save is not automatically uploaded to us as a cloud backup.

Online leaderboard information

The Pumpkin Flight leaderboard uses Unity Authentication and Unity Leaderboards. When that online feature connects, Unity creates or reuses a player identifier and sign-in credentials without requiring an email-and-password registration. Eligible scores are submitted to the leaderboard. A chosen or generated display name, score, and rank can be visible to other players.

We use this information to associate scores with players and operate the rankings. Use a nickname rather than your real name or other personal information. The service also processes the network and technical information needed to connect securely. See Unity's Privacy Policy.

3. Advertising and optional purchases

Advertising in the Android game

Android editions with advertising enabled use Google AdMob. Browser editions do not use the Android AdMob integration. Development builds may show test ads.

Google's advertising services process information such as IP address and approximate location derived from it; advertising, app-set, and other applicable identifiers; app or ad interactions; and diagnostic information. This supports serving and measuring ads, detecting fraud, and maintaining the service.

Where required, we ask for advertising privacy choices before requesting ads. Where available, reopen Ad privacy choices in the game's Options menu to change them. Non-personalized or limited ads can still involve data processing. Android also provides advertising-ID controls in device settings.

Learn more in Google's Privacy Policy and how Google uses information from partner sites and apps.

Optional Remove Ads purchase

The Android game offers an optional, one-time Remove Ads purchase through Google Play, using Unity In-App Purchasing to connect the game to the store. Google Play handles checkout and payment information. Our game does not ask for or store your payment-card number or bank-account details.

The purchase integration processes store-provided information, such as the product purchased, purchase status, and transaction identifiers or purchase tokens, to deliver, confirm, and restore ad removal. The game saves your ad-removal ownership locally as part of your game save. Restoring a purchase checks the purchases associated with the Google Play account used in the store; it does not upload or restore your puzzle progress.

After Remove Ads is applied, the game's AdMob integration stops requesting and showing ads. Data processing needed for other features, such as online leaderboards, reward codes, feedback, and purchase restoration, can still occur when those features are used. Google Play maintains its own purchase records under Google's policies.

4. Our website and messages you send

Website hosting and private playtests

Our website is hosted by IONOS. Hosting and security systems process connection and access information, such as requested pages, access times, browser/device details, referrers, and IP-related information, to deliver pages, troubleshoot problems, and protect the service. IONOS describes anonymization of IP addresses in its web-hosting visitor logs.

Private playtest pages use a necessary session cookie to remember password access and IP-derived rate-limiting information to limit repeated login attempts. Game saves and service sign-in tokens may also remain in browser storage. Clearing site data can sign you out and erase local progress.

Website contact form

When you submit our contact form, Google Firebase Cloud Firestore stores your message, any name or email you choose to provide, the source page, and a submission timestamp. Firebase App Check and Google's reCAPTCHA service process security signals, tokens, and browser/device or network information to prevent spam and abuse. Security cookies or local storage may be used, including when you open the contact page.

In-game feedback and email

The in-game feedback form sends your message and any optional name or email to our developer feedback channel using Discord. Updated versions send this through our website, along with the game version and platform to help investigate bugs. The relay temporarily records keyed IP-address hashes and request times to limit spam; it does not keep a separate database of feedback messages. Hosting access logs are covered above. Email messages are handled through our email service. We use messages to respond, investigate bugs, and improve the game. Do not include passwords, payment details, or sensitive personal information.

Reward codes

When you use an online reward code, Word Anomaly sends our website a randomly generated player-save identifier, a security token, and the code you enter. We use these to verify codes, record rewards, prevent repeated claims, and recover interrupted claims. This feature does not request your name or email address or send your puzzle guesses or gameplay history. Once a reward identity exists, the game can check for interrupted claims when you return to the Main Menu.

The rewards database stores the random save identifier, a hash of its security token, reward-code hashes, reward receipts, claim times, and whether the game confirmed saving each reward. These records remain until deleted by Ghost Static Labs so claimed codes stay claimed and interrupted rewards can be recovered. This is not a complete backup of your game progress. Code rewards, including ad removal, are associated with your local save; clearing app or browser data can remove that association.

The service receives your IP address as part of the connection. Abuse-prevention records use a secret-derived hash rather than storing the raw address in the rewards database; expired records are removed during later requests. Hosting-provider logs are covered above. The developer management page uses a necessary session cookie to protect access. Contact info@ghoststaticlabs.com for questions or deletion requests, including the code you used and its approximate claim date where available. Deleting claim records can affect reward recovery and code-use tracking.

5. Earlier browser builds and analytics

Updated Word Anomaly builds have removed our Unity Analytics gameplay event tracking. The earlier public browser demo at /WordRift/ has a Google Analytics page tag and includes Unity Analytics. Depending on the edition and its configuration, these services can process page visits, gameplay events, technical details, approximate location, and browser, installation, or player identifiers to measure use and performance.

This differs from the updated private tester build. The removal of gameplay analytics does not remove data processing needed by advertising, leaderboards, feedback, or hosting. Data collected by an earlier version is not automatically erased by updating the game.

Browser cookie controls and Google's Analytics opt-out browser add-on can limit supported website analytics; they do not disable Unity services or AdMob in an Android app. You can also contact us about information associated with an earlier build.

6. How information is used and shared

We use information to provide game and website features, operate leaderboards, deliver ads where enabled, fulfill and restore purchases, answer requests, fix problems, and protect against misuse. Where data-protection law requires a legal basis, we rely on providing the features you request, legitimate interests in operating and securing the service, consent where required, and applicable legal obligations.

Information is processed by the providers involved in the feature you use:

• Google: AdMob, advertising consent, Google Play purchases, website feedback storage and protection, and analytics in the earlier browser demo. See Firebase privacy information and Google Cloud privacy information.
• Unity: player authentication, leaderboards, the Unity In-App Purchasing integration with Google Play, and analytics in earlier builds. See Unity's Privacy Policy.
• Discord: delivery and storage of in-game feedback. See Discord's Privacy Policy.
• IONOS and email providers: website hosting, security, and handling correspondence. See IONOS's Privacy Policy.

We do not sell your contact details or feedback messages. Advertising-related disclosures may be considered "sharing" or a "sale" under some privacy laws; use the available advertising choices or contact us to exercise applicable rights. We may also disclose information when required by law or necessary to protect rights, safety, and the service.

Providers may process information in countries other than your own. Where required, applicable contractual and other safeguards govern international transfers. Their linked policies explain their practices.

7. Retention and security

• Local saves: remain until you reset them, clear app/browser data, or otherwise remove them. Device backup settings can affect what is retained or restored.
• Purchase ownership: the game retains the local ad-removal entitlement with your save. After clearing app data or reinstalling, you may need to use Restore Purchases with the Google Play account that made the purchase. Google Play's purchase records are managed separately from the local game save.
• Online player records and scores: are retained to operate the leaderboard until removed through service administration or a verified deletion request. Clearing a local save does not remove these online records.
• Feedback and correspondence: are kept as needed to address your request, investigate an issue, and maintain necessary support records.
• Security logs and provider records: follow the relevant provider's retention settings and policies. Information may be retained longer where needed for legal obligations, fraud prevention, or resolving disputes; backups may take additional time to expire.

We use HTTPS for our online services and the access controls supplied by our providers. No method of storage or transmission can guarantee absolute security. Please avoid sharing information that the game or support team does not need.

8. Your choices and deletion requests

Depending on where you live, you may have rights to access, correct, delete, or obtain a copy of personal information; restrict or object to certain processing; withdraw consent; or opt out of applicable targeted advertising or sale/sharing. Withdrawing consent does not change the lawfulness of earlier processing. You may also contact your local data-protection authority.

To request deletion of Word Anomaly online player data, leaderboard entries, or feedback: email info@ghoststaticlabs.com with the subject "Word Anomaly privacy request." Tell us what you want removed and provide enough context to locate it, such as your leaderboard display name and platform, or the email and approximate date used for feedback. We may request reasonable verification before acting. Do not send passwords or identity documents unless we have explained a specific need.

We will address requests within the periods required by applicable law. If some information must be retained, we will explain the reason. You can use the contact form instead; include a reply address if you want a response.

Uninstalling the game or clearing browser storage does not automatically delete online scores or previously submitted messages. If you want an online player record removed, contact us before clearing local data where possible, because losing the anonymous sign-in token can make verification harder.

9. Children and teenagers

Word Anomaly is intended for players aged 13 and older and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us so we can investigate and arrange appropriate deletion.

Age and parental-consent requirements can differ by country. Where a higher age of consent applies, the relevant parental permission or other legal requirements must be met. A store's content rating is separate from this intended audience.

10. Changes to this policy

We may update this policy as features or data practices change. We will update the date above and provide additional notice or request consent where required.