The Short Version (For People in a Hurry)

We collect very little data. We don't sell it. We don't do anything weird with it. We use a small amount of information to make the game work and understand how people are using it, so we can make it better.

If you'd like the full picture — including the legally mandated parts that have to be in here — read on. We've tried to make it as painless as possible. There are no trick clauses, no buried opt-outs, and no paragraph that quietly signs you up to a newsletter. You have our word. (Which, again, feels apt.)

1. Who We Are

INGRAIN is operated by us ("we", "us", "our"). For the purposes of UK data protection law, we are the data controller for any personal data collected through ingrainwordgame.com.

Legal entity: CORDAGE & CO LTD (company number 17142359).

If you have any questions about how we handle your data, you can reach us at:

Email: support@ingrainwordgame.com Website: ingrainwordgame.com Company: CORDAGE & CO LTD (17142359)

We don't have a Data Protection Officer, because we're a small operation and the law doesn't require one at our scale. But we take data protection seriously nonetheless — partly because the ICO can issue some eye-watering fines, but mostly because it's just the right thing to do.

2. What Data We Collect

We collect two types of data: information you give us directly, and information that gets collected automatically when you use the Site.

2a. Information You Give Us

If you contact us by email (with feedback, a question, or to tell us you absolutely knew that word and the puzzle must be wrong), we'll receive your email address and whatever you wrote to us.

If you create an account, we collect what you provide for registration and profile use — typically your username, email address, and password (stored securely; we never store it in plain text). If you sign in with a third party such as Google, we receive identifiers and profile details that provider shares with us under their terms. We may also store your preferences for optional email updates or reminders if you opt in.

Gameplay you complete while signed in — scores, guesses, streaks, leaderboard placement, and related puzzle data — is associated with your account so the game can function and so competitive features stay fair.

If you sign up to any mailing list or notification service we operate, we'll collect your email address for that purpose.

You can play as a guest without an account; in that case we don't hold a profile for you on our servers in the same way, though we may still process technical data as described below.

2b. Information Collected Automatically

When you visit ingrainwordgame.com, some information is collected automatically. This may include:

• Your IP address (used to understand approximate geography and prevent abuse — not to track you personally)
• Browser type and version
• Device type (desktop, mobile, tablet — the holy trinity)
• Pages visited and time spent on the Site
• Referring URL (how you found us — was it a friend, a tweet, or sheer serendipity?)
• Game interactions, such as puzzle completion, guesses made, and whether you're on a streak we should all be impressed by

This information is collected through cookies, similar technologies, server logs, and analytics tools (see Section 5 for more on cookies). It is used in aggregated, anonymised form wherever possible to help us understand how people use the Site and how we can improve it.

3. How We Use Your Data

We use the data we collect for the following purposes:

To operate and improve the game. Understanding how people play — where they get stuck, which puzzles are too easy, which are unfairly hard — helps us make INGRAIN better for everyone.

To remember your progress. If you're signed in, your streak, puzzle history, and related game state are stored on our systems so you can pick up where you left off. If you play as a guest, some progress may be stored locally in your browser (for example using localStorage) — that data stays on your device unless you submit it as part of gameplay we process on our servers. If you clear your browser data, local progress may be lost. We mention this not to alarm you, but so you know where to direct your frustration if it happens.

To respond to your messages. If you email us, we'll use your email address to reply. Groundbreaking stuff.

To send communications you've opted into. If you've signed up for updates or a newsletter, we'll use your email address to send those. You can unsubscribe at any time — every email will include a clearly labelled unsubscribe link, because anything less would be rude.

To comply with legal obligations. Sometimes the law requires us to keep or process certain data. We'll do what we must, and no more.

4. Our Legal Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we need a valid legal basis for processing your personal data. Here's ours:

• Legitimate interests — for analytics and Site improvement, where our interest in understanding how the Site is used is balanced against your right to privacy. We use anonymised or aggregated data wherever possible.
• Consent — for any non-essential cookies or marketing communications. You can withdraw consent at any time.
• Contractual necessity — if you've asked us to do something (like send you emails), processing your data to actually do that thing is necessary.
• Legal obligation — where the law requires it.

We do not use your data for automated decision-making or profiling in any way that has a significant effect on you.

5. Cookies

Cookies are small text files that websites store on your device. They're used everywhere on the internet, and most of them are completely benign. Here's how we use them:

Essential cookies and similar technologies

These are required for the Site to function properly. They handle things like your session, security (including CSRF protection), and staying signed in when you choose to. You can't meaningfully opt out of these without opting out of the Site entirely — but they don't track you beyond what's needed for the game and your account to work.

Analytics

We use Plausible Analytics, a privacy-focused analytics service, to understand aggregate traffic and usage — pages viewed, referrers, and similar metrics — without the invasive profiling associated with many ad-tech tools. Plausible is designed to minimise personal data collection; see plausible.io/privacy for how they process data.

Where UK law requires consent for any non-essential cookies or similar technologies, we will obtain it in line with current guidance. You can also control cookies through your browser settings — though blocking some cookies may affect how the Site works.

6. Data Retention

We don't keep your data any longer than we need to.

• Email correspondence is retained for as long as it's relevant, and typically deleted within 2 years if no ongoing relationship exists.
• Email list data is held for as long as you remain subscribed, plus a short period thereafter in case of any queries.
• Analytics data is retained in line with the analytics platform's own retention settings, typically 14 to 26 months.
• Account and gameplay data is kept while your account is active and for a reasonable period afterwards if we need it for legal, security, or dispute-resolution purposes.

Locally stored guest progress in your browser is entirely within your control.

7. Who We Share Your Data With

We do not sell your personal data. We do not share it with advertisers. We are not part of a vast data-harvesting operation. INGRAIN is a word game, not a surveillance apparatus.

We may share data with:

• Analytics providers (including Plausible), who process data on our behalf under appropriate arrangements. We configure tools to limit data collection and use privacy-respecting options where available.
• Hosting and infrastructure providers who keep the Site running.
• Email service providers, if we use one to send newsletters or notifications. These providers act as data processors on our behalf.
• Authentication providers (such as Google) when you choose to sign in through them, as governed by their policies and your settings with them.
• Legal authorities, if we are required by law to disclose information.

All third-party providers we use are selected with data protection in mind and, where required, are bound by appropriate contractual safeguards.

8. International Data Transfers

Some of the third-party tools we use may transfer data outside the UK or European Economic Area (EEA). Where this happens, we ensure appropriate safeguards are in place — such as the UK International Data Transfer Agreement (IDTA) or equivalent mechanisms — to protect your data in line with UK GDPR requirements.

9. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

The right to access — you can ask us what personal data we hold about you.

The right to rectification — you can ask us to correct inaccurate data.

The right to erasure — you can ask us to delete your data ("the right to be forgotten"). We'll comply unless we have a legal reason to retain it.

The right to restriction — you can ask us to limit how we use your data in certain circumstances.

The right to data portability — you can ask for your data in a structured, commonly used, machine-readable format where applicable.

The right to object — you can object to us processing your data on the basis of legitimate interests, including for direct marketing purposes.

The right to withdraw consent — where we rely on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at support@ingrainwordgame.com. We'll respond within one month. We may need to verify your identity before we can action your request, which is standard practice and not us being awkward.

10. The Right to Complain

If you're unhappy with how we've handled your data, we'd really like to hear from you first so we can try to put things right. But if you feel we've not resolved things satisfactorily, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.

ICO Website: ico.org.uk ICO Helpline: 0303 123 1113

We genuinely hope it never comes to that. But the right is yours, and we wouldn't dream of hiding it from you.

11. Children's Privacy

INGRAIN is not directed at children under the age of 13, and we do not knowingly collect personal data from anyone under 13. If you believe a child has provided us with personal data, please contact us and we'll delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we'll update the "Last updated" date at the top of this page. If we make significant changes, we'll try to let you know — possibly via a notice on the Site, or an email if you're on our list.

We recommend checking back occasionally, particularly if you're the kind of person who reads Privacy Policies in full. (Hi again.)

13. Contact Us

For any questions, concerns, or data requests relating to this Privacy Policy:

Email: support@ingrainwordgame.com Website: ingrainwordgame.com

We're human, we're responsive, and we genuinely care about getting this right.