Privacy Policy

Last updated August 23, 2026

This Privacy Policy explains how Elevation Software Services Inc. ("Crossword Kingdom," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Crossword Kingdom mobile application, visit crosswordkingdom.io, or contact us about those services (collectively, the "Services").

The mobile app is an online game. It creates a guest account when you begin playing so that it can save progress, and it supports saved accounts, analytics, advertising, and optional third-party features. The marketing website does not currently use advertising or analytics cookies, but its hosting provider may process ordinary request and security logs to deliver the site.

If you have questions or want to exercise a privacy right, email contact@crosswordkingdom.io.

1. Information we collect

Account and identity information

Guest accounts. When you start as a guest, we create an internal account identifier and a generated public username. A guest account does not require a name or email address.
Saved accounts. If you register or save a guest account, we collect your email address, password, and any full name you provide. We store a one-way hash of your password rather than the password itself.
Social sign-in. If you use Apple, Google, or Facebook, we receive a provider account identifier and, when the provider makes them available, your verified email address and name. We store the connected provider and may store encrypted provider authorization data needed to disconnect or revoke the connection.
Profile and privacy choices. We collect your generated or chosen public username, leaderboard visibility choice, whether you choose to display your full name on leaderboards, onboarding status, preferences, and notification settings.

Gameplay and progression information

We collect the puzzles you start and complete, grid progress and entered letters, guesses, hints, reveals, mistakes, elapsed time, completion percentage, accuracy, puzzle ratings, streaks, XP, ranks, achievements, inventory and rewards, leaderboard scores and standing, and whether you record an in-app social-share action. This information lets you resume play, sync progress, receive rewards, and participate in social features.

Device, network, and local app information

A stable device identifier created from the iOS identifier for vendor, Android ID, or a randomly generated fallback; mobile platform; app version when available; time zone; app and device properties; IP address; and request, diagnostic, and security information.
The app stores its device identifier and signed-in session in secure device storage. It stores a local flag recording that introductory setup has been completed. Advertising, analytics, authentication, and notification providers may also store their own identifiers and consent choices on your device.
We do not request precise GPS location. We and our providers may infer an approximate location from an IP address, and we use the time zone supplied by your device for daily puzzles and streaks.

Analytics information

Production versions of the app use PostHog to understand app performance and feature use. Analytics may include a randomly assigned analytics identifier, device and app properties, app interactions, event timestamps, puzzle and game-session identifiers, puzzle titles, completion and post-game events, ratings, streak and achievement counts, timing information, and error categories. We do not intentionally send your email address, full name, password, or entered crossword letters to PostHog.

Advertising information

Production versions of the app display banner ads using Google AdMob and use Google's consent tools. Google and participating advertising partners may process IP addresses, mobile advertising or app identifiers, device and app information, approximate location, consent choices, ad requests, and ad views or interactions. Depending on your region, consent, platform settings, and Apple tracking permission, advertising may be personalized or non-personalized. We do not provide Google with your Crossword Kingdom email address or full name for advertising.

Notifications, purchases, and communications

Notifications. If push notifications are offered in your app version and enabled, the app may use OneSignal to process a push subscription or token, device and app information, notification delivery and interaction data, and a OneSignal identifier. You can control notifications in your device settings.
Purchases. If you make an in-app purchase or subscription, Apple or Google processes your payment. We and RevenueCat may receive an app user identifier, product and entitlement information, transaction or purchase-token information, purchase and expiration dates, and the store environment. We do not receive your full payment-card number.
Communications. We collect the information you send when you request support, submit feedback, or otherwise contact us. If you request a password reset, we use your email address to send a security code through Resend and retain hashed reset and requester information for security and rate-limiting.

Website information

Our marketing website does not currently run advertising pixels or product analytics. Vercel, which hosts the website, may automatically receive IP address, browser and device information, requested page, referrer, timestamps, and security or diagnostic logs. Essential hosting technologies may be used to operate and protect the website.

Information from other sources

In addition to information collected from you and your device, we receive information from the sign-in, app-store, advertising, analytics, notification, and email providers described in this policy. We may also receive information from another person if they contact us about a support or safety issue involving you.

2. How we use information

We use information to:

create and authenticate guest and saved accounts;
deliver puzzles and save, restore, and sync gameplay;
calculate progress, rewards, streaks, achievements, ranks, and leaderboards;
maintain your profile, preferences, connected accounts, and privacy choices;
personalize puzzle recommendations and the gameplay experience;
measure app use, diagnose errors, improve features, and protect service reliability;
display, measure, and manage consent for advertising;
send account-security messages and, when enabled and permitted, push notifications;
process subscriptions and purchases, provide support, and respond to requests;
prevent fraud, abuse, unauthorized access, and other harmful activity; and
comply with law and establish, exercise, or defend legal rights.

3. When we disclose information

We may disclose information in the following circumstances:

Service providers. Providers process information for hosting, storage, content delivery, caching, analytics, advertising, notifications, authentication, email, subscriptions, security, and support. Current providers include Fly.io and Fly Postgres for the app backend and database; Upstash for leaderboard caching; Supabase for puzzle-artwork storage and delivery; Vercel for the website; PostHog for app analytics; Google AdMob for advertising and consent; OneSignal for optional push notifications; Resend for password-reset email; and RevenueCat for subscription records when purchases are offered.
Authentication and app platforms. We exchange authentication information with Apple, Google, or Meta when you choose the corresponding sign-in method. Apple and Google process app downloads, purchases, and platform services under their own terms.
Other players and the public. If you appear on a leaderboard, other signed-in players can see your public username and leaderboard performance. Your full name is shown only if you affirmatively choose that option. You can hide yourself from leaderboards in Settings.
Legal, safety, and business purposes. We may disclose information when reasonably necessary to comply with law or legal process, protect people and the Services, investigate abuse, or in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets. Any successor will be subject to this policy or a notice describing its practices.
At your direction. We may disclose information when you ask us to or give consent.

We do not sell personal information for money. Our use of Google advertising may involve disclosing mobile identifiers and app activity for personalized or cross-context behavioral advertising. Some privacy laws call that activity a "sale," "sharing," or "targeted advertising" even when no money changes hands. See Section 8 for your choices.

4. Legal bases for processing

If European Economic Area or United Kingdom data-protection law applies, our legal bases depend on the context:

Contract. Processing needed to create your account, provide requested gameplay, sync progress, operate purchases, and provide support.
Legitimate interests. Operating and improving the Services, measuring performance, securing accounts, preventing abuse, and maintaining non-personalized advertising, where those interests are not overridden by your rights.
Consent. Personalized advertising, tracking, push notifications, and other processing where the law or platform rules require consent. You may withdraw consent for future processing.
Legal obligations and legal claims. Processing needed to comply with law or establish, exercise, or defend rights.

5. Retention and account deletion

We keep information only for as long as reasonably necessary for the purposes described above, including providing the Services, maintaining security and transaction records, resolving disputes, and meeting legal obligations. Retention depends on the type of information:

Account and gameplay information is generally kept while your account is active.
Refresh tokens expire after up to 30 days and are revoked when you sign out or delete your account.
Password-reset challenge records, which contain hashed rather than plain-text email, requester, and code values, are retained for up to 30 days.
Provider, analytics, advertising, hosting, app-store, and notification records follow the applicable provider settings and retention schedules.
Security logs and backups are kept for limited operational periods and then deleted or overwritten.

You can delete your account from Settings → Delete Account. Deletion revokes Crossword Kingdom sign-in tokens, removes your email, password hash, full name, and connected social identities from the active account, disconnects devices, and removes you from leaderboards. We may retain de-identified or pseudonymized gameplay, transaction, audit, security, and aggregate records where reasonably needed for service integrity, fraud prevention, legal compliance, or claims. Providers may retain information as described in their own policies or as legally required.

6. Security

We use reasonable administrative, technical, and organizational safeguards designed to protect information. These include encrypted network connections, hashed passwords, encrypted storage of certain provider credentials, access controls, scoped authentication tokens, secure device storage, and separation of public leaderboard identity from internal account identifiers. No system is completely secure, so we cannot guarantee absolute security.

7. International processing

We are based in the United States, and the Services and our providers process information primarily in the United States and other countries where they operate. Those countries may have data-protection laws that differ from the laws where you live. Where required, we use recognized safeguards for international transfers.

8. Your privacy choices

Profile and leaderboards. In Settings, you can update your profile and public username, choose whether to display your full name, and hide your account from leaderboards.
Advertising and tracking. Where available, use Settings → Manage Ad Privacyto review Google advertising choices. On iOS, you can deny or change app-tracking permission in system settings. You can also use platform-level ad-personalization controls or email us to request an opt-out of sale, sharing, or targeted advertising where applicable.
Notifications. You can change notification permission in your device settings.
Connected accounts. Where another sign-in method remains, you can disconnect Apple, Google, or Facebook in Settings.
Access, export, correction, and deletion. You can correct certain profile information and delete your account in the app. Email us to request a portable copy of account data or to make another privacy request.

The marketing website does not currently use advertising or analytics technology and does not sell or share website visitor information for cross-context behavioral advertising. As a result, browser Do Not Track or Global Privacy Control signals do not change the website's current behavior. If our website practices change, we will update this policy and honor legally required opt-out preference signals.

9. Regional privacy rights

Depending on where you live and subject to exceptions, you may have the right to know or access information we process, receive a portable copy, correct inaccurate information, delete information, restrict or object to processing, withdraw consent, opt out of sale, sharing, targeted advertising, or certain profiling, and appeal a denied request. You may also have the right to complain to your local regulator. We will not discriminate against you for exercising a privacy right.

To submit a request, email contact@crosswordkingdom.io. We may ask for information reasonably needed to verify your identity and authority. An authorized agent may submit a request where permitted by law, but we may require proof of authorization and identity. If we deny a request, you may appeal by replying to our decision.

Additional notice for United States residents

In the preceding 12 months, we may have collected the following categories of personal information: identifiers; customer-record information; commercial and subscription information; internet or other electronic activity; approximate geolocation inferred from IP address and device time zone; account login credentials; and inferences used for puzzle recommendations. We collect these categories from you, your device, your gameplay, and the providers listed in this policy. We use and disclose them for the business and commercial purposes described in Sections 2 and 3.

We do not use sensitive personal information to infer characteristics about you. We do not knowingly sell or share the personal information of anyone under 16. Mobile advertising identifiers and app activity may be shared with Google and advertising partners for cross-context behavioral advertising, subject to consent and opt-out controls. Other categories are disclosed to service providers for the business purposes described above and may be disclosed for legal or business-transfer purposes.

10. Children

The Services are intended for people who are at least 18 years old and are not directed to children. We do not knowingly collect personal information from anyone under 13 or knowingly sell or share the personal information of anyone under 16. If you believe a minor has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.

11. Third-party services

The Services may link to or integrate with third parties. Their handling of information for their own purposes is governed by their privacy policies and settings. This policy does not control third-party apps, websites, app stores, or advertising partners acting independently from us.

12. Changes to this policy

We may update this policy as our Services, providers, or legal obligations change. We will post the updated policy here and revise the date above. If a change is material, we may also provide notice in the app, on the website, or by email where appropriate.

13. Contact us

Elevation Software Services Inc.
563 Memorial Drive, Unit 504
Atlanta, GA 30312
United States
Email: contact@crosswordkingdom.io