Privacy Policy

Last updated: July 22, 2026

This Privacy Policy explains how Spell Legends (the "Game," "we," "us"), published by Krash, handles information when you play. It applies to the Spell Legends Android app on Google Play and to the web version at super-scrambble.vercel.app.

The short version: Spell Legends uses no third-party analytics SDKs and never sells your data. You can play the entire game as a guest with no account. Signing in is optional and exists only to sync your progress and enable friends and online multiplayer. The app shows limited ads (including opt-in "watch for a reward" videos) served by Google AdMob — see the Advertising section below.

1. Playing as a Guest (No Account)

You can play solo and offline without an account. In this mode your settings, statistics, and progress are stored only in your device's localStorage and are not sent to us. The Game also stores a randomly generated, anonymous session identifier on your device to recognize it within a play session; it is not linked to your identity.

2. Signing In (Optional)

If you choose to create an account or sign in, authentication is handled by our provider, Clerk. Depending on the method you use (for example Google Sign-In or email), we receive a stable account identifier and basic profile details, which may include your email address, display name, and, if available, a profile picture. We use this only to identify your account and sync your data across your devices.

3. Account Data We Store

When you are signed in, the following is stored on our backend (Convex) and linked to your account so your progress follows you across devices:

Your chosen username and profile icon.
In-game currency and owned characters and cosmetics.
Your level, ranked standing, and achievements.
Adventure-mode progress and earned equipment.
Your friends list and friend requests.
Recent match history (which you can set to private).
A presence timestamp and status so friends can see when you are online and, optionally, what mode you are currently playing.

4. Online Multiplayer

When you play an online match, the match's game state (board, tiles, moves, scores, turn information, and room code) and the display names of the players are processed by our backend so every player's device stays in sync. Your friends may be able to spectate a match you are in.

5. How We Use Information

To provide features you request: cross-device sync, online multiplayer, friends, leaderboards, and spectating.
To operate the in-game economy (currency and unlocks) securely on our servers.
To keep the Game reliable and fair (for example, server-side validation of account values).

We do not use your account data to target ads or to build a profile of you, and we do not sell or rent it to anyone. (Ad serving is handled separately by Google AdMob — see section 6.)

6. Advertising

The app shows ads through Google AdMob. This includes opt-in rewarded videos (you choose to watch one in exchange for in-game currency) and may include full-screen ads shown at natural breaks. To serve and measure ads, AdMob may collect a device advertising identifier and general device/usage information, as described in Google's policies. We do not share your account details with AdMob, and we do not use ads to build a profile of you ourselves. On supported devices you can reset or limit ad personalization through your device's Ads settings.

7. What We Do Not Collect

No separate third-party analytics or behavioral-profiling SDKs (beyond the ad measurement described above).
No location, contacts, camera, microphone, photos, or files.
No in-app purchases or payment processing at this time.

8. Service Providers

We rely on a small number of processors that handle data on our behalf, under their own privacy terms and only to deliver their service to us:

Clerk — account authentication and sign-in.
Convex — backend database (hosted on Google Cloud) that stores your synced account data and online match state.
Google AdMob — serving and measuring the in-app ads.
Google Play — app distribution; and Google Sign-In if you choose that login method.

9. Data Retention and Deletion

Guest data lives only on your device; clearing the app's storage or uninstalling removes it.
Account data is retained while your account exists. You can delete your account and its synced server data from within the app (Account settings → Delete account), or by contacting us.
Online match state is retained only as needed to run and conclude a match and is periodically cleaned up.

10. Permissions (Android)

The Android app uses the INTERNET permission to connect to the backend for sign-in, sync, and online multiplayer. It does not request location, contacts, camera, microphone, photos, or files.

11. Children's Privacy

Spell Legends is a general-audience word game and is not directed to children under the age required by law in your region. We do not knowingly collect personal information from them. If you believe a child has provided us personal information, contact us and we will delete it.

12. Security

Data in transit is encrypted using HTTPS/TLS, and sensitive account operations are validated server-side. No method of transmission or storage is completely secure, but we take reasonable measures to protect your information.

13. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date above. Significant changes will be reflected in the app or on the website.

14. Contact

Krash — Spell Legends
Email: supportlegends@gmail.com