Privacy policy

Last updated: 11 October 2026

This policy covers the SlovoBoj game (the Android app) and the website slovoboj.com.

In short

• You don't need an e-mail address, a password or your real name to play, just a nickname you make up.
• The server keeps your nickname, avatar, coins and results. Single-player progress stays on your phone.
• Room chat is not stored, except the messages the server attaches to a report about a player.
• Ads are shown by Google AdMob. Personalised ads are shown only with your consent.
• We don't sell data. The game and the website have no analytics or tracking cookies, apart from Google's ads in the game.
• You can delete your profile in Settings, and we delete a profile automatically when it hasn't been used for a year.

Who is the controller

Tvornica programa d.o.o., Primorska 29, 10360 Sesvete, Croatia, OIB 31134785829 (legal notice). For anything about privacy, write to slovoboj@tvornica-programa.hr.

What we process and why

Your profile

The first time you play, you enter a nickname and pick an avatar (a picture from the game). The server then creates a random player ID and an access token. The token is stored on your phone; the server keeps only a cryptographic hash of it. With the profile the server records when it was created and when it last connected.

Purpose: so the game recognises you, you can play with others and your coins stay yours.

Legal basis: performance of a contract, that is, providing the game under the terms of use (Art. 6(1)(b) of the General Data Protection Regulation, GDPR).

Play, results and coins

• Matches with other players: place, points, League Points, the number of words found, hints and wrong attempts, and the room's name and settings; for each round also the words found and the time of each.
• Statistics and the leaderboard for each puzzle language: League Points, matches played, wins, give-ups and the total numbers of words found, bonus words, hints and wrong attempts.
• Single player: when you solve a level while the phone is online, the app sends the server the language, the level number, the solving time, the bonus words found and the number of hints, so the server can work out the level's coins. Of that, the server keeps only which level it rewarded and when; it doesn't store the time or the words.
• Coins: the balance and every change (kind, amount, time), so the same reward is never paid twice.

Purpose: the game, the leaderboard, coins and preventing cheating.

Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, for preventing cheating and abuse, our legitimate interest (Art. 6(1)(f) GDPR).

What other players see

Your nickname and avatar are seen by players in rooms and on the room list. The leaderboard (nickname, avatar, League Points, matches, wins) and player statistics are public: anyone can see them in the game or ask the server for them.

Chat

The server passes room messages on to the players in that room and does not store them. It automatically hides swear words and insults with asterisks. For a hidden message it records only that it was hidden, with the player ID and the room, not its text. While a room exists, the server holds its last 50 messages in memory, only so it can attach them to a report (see below); they go with the room.

Reports and blocks

You can report a player from the app (by tapping a chat message or the player). With a report the server stores the reason, your short description (only with the reason "Something else"), the IDs and nicknames of you and the reported player, the room (name, identifier, language and match) and up to 11 messages from that room: the reported one and up to ten before it, as the server itself sent them, not text from your app. The reported player learns neither about the report nor who sent it. For every report the server sends us an e-mail with this data and the number of earlier reports about the same player.

When you block a player, the server records who blocked whom and when, so the block can be enforced: you don't see each other's messages and can't be in the same room. You see and change the list in Settings → Blocked players.

Measures taken after a report (chat switched off, no playing with others) are recorded with the profile, with the date until which they apply.

Purpose: the safety of players and enforcing the terms of use.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR).

IP address and technical logs

Every connection to the server reveals your IP address; connections go through Cloudflare (see "Where the data is and who else receives it"), which passes your address on to the server. The server uses it only in memory, to limit the number of registrations from one address, and does not store it in the database or with your profile. With every request the app also sends its version number, so the server knows whether it supports it.

The server and the server in front of it keep technical logs: the time, the kind of request, the player ID and sometimes the IP address, a room name or the nickname of a match winner. They serve the operation of the service, security and fixing errors, and are kept for at most 30 days.

Legal basis: legitimate interest in running the service safely and correctly (Art. 6(1)(f) GDPR).

Ads (Google AdMob)

The game is free because it shows ads. They are shown by Google's AdMob (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): a banner at the top of some screens and, only when you start it yourself, an ad for coins. For this, Google collects from the app:

• the IP address (and from it a rough location),
• the device's advertising ID and App set ID,
• data about ad impressions and taps,
• diagnostic data about how the ads work.

When you watch an ad for coins, Google confirms to our server that the ad was watched. With the confirmation it sends the player ID the app gives it for that purpose, so the coins reach the right profile.

In the EU, the EEA and the United Kingdom the app opens Google's consent form on first start. Personalised ads are shown only with your consent. Without it, Google shows non-personalised ads. You can change or withdraw your consent at any time in Settings → Privacy settings.

Google processes this data as an independent controller under its own policies: how Google uses information from partners' apps and Google's privacy policy.

Legal basis: consent for personalised ads and for storing advertising data on the device (Art. 6(1)(a) GDPR); for non-personalised ads, which pay for the game, legitimate interest (Art. 6(1)(f) GDPR).

What stays on your phone only

Single-player progress, records and statistics, the settings and the last known coin balance are stored only on the phone (apart from the level records described above). The player ID, token and nickname are kept in the device's secure storage. If Android backup is turned on in the phone's settings, Android may include the app's data in a backup on your Google account.

When you write to us

If you send us an e-mail, we use its content and your address only to answer it, and keep them for at most a year after the matter is closed.

This website

The website slovoboj.com has no cookies, no analytics and no scripts from other servers: fonts and images come from our own server. When you visit, the server receives your IP address and what your browser sends, and uses them only to deliver the page and protect it from abuse. Technical logs are kept for at most 30 days. Visits go through Cloudflare (see below), which may ask your browser to report when the page fails to load (Network Error Logging: the page's address and the kind of error).

Where the data is and who else receives it

The game's server and database run at Hetzner Online GmbH in a data centre in Nuremberg, Germany, inside the European Union. Hetzner is our processor, with whom we have a data processing agreement.

All connections to the game and to this website (api.slovoboj.com and slovoboj.com) go through the network of Cloudflare, Inc. (USA), which protects them from attacks and passes them on to our server. Cloudflare therefore receives your IP address and the content of the requests: the connection is encrypted up to Cloudflare and from Cloudflare to our server, but Cloudflare decrypts it on the way. Cloudflare is our processor under a data processing agreement and may use this data only for that service. Traffic may pass through its data centres outside the EEA; the transfer is covered by the EU–US Data Privacy Framework, under which Cloudflare is certified, and by standard contractual clauses. More in Cloudflare's privacy policy.

We send the e-mail about a report (see "Reports and blocks") through the Mailgun service (Mailgun Technologies, Inc.), also our processor under a data processing agreement; we use its European region, so these e-mails are processed in the EU. Apart from Cloudflare (above) and Google (below), data does not leave the European Economic Area.

Advertising data goes to Google (see above), which may process it outside the EEA with the safeguards described in its policies. We don't sell or give data to anyone else, unless the law requires it.

How long we keep data

Data	How long
The profile and everything with it (coins, results, statistics, level records)	until you delete it; a profile that hasn't connected to the server for a year is deleted automatically, and a profile with no match and no solved level after 30 days
A match's rounds with the words found and their times	30 days from the end of the round
A match record (room, time, the players' places and points)	12 months from the end of the match; deleting your profile removes your results from it at once
Chat	not stored (a room's last 50 messages are held in memory while the room exists)
Reports, with the messages from the room	until the report is resolved, then 12 more months; they stay after a profile is deleted, with the nickname but without the deleted player's ID
Blocks	until you remove them; deleted with the profile of either player
Technical logs	at most 30 days
Database backups	at most 30 days
E-mail enquiries	at most a year after the matter is closed

Your rights

You have the right to access your data, to have it corrected (you change your nickname and avatar in the game), to have it erased (how to delete your profile), to restrict its processing and to data portability. You have the right to object to processing based on legitimate interest. You can withdraw your consent to personalised ads at any time; this doesn't affect the lawfulness of the processing before.

To make a request, write to slovoboj@tvornica-programa.hr. Since a profile has no e-mail or password, we will ask for something that identifies it (nickname, avatar, language, roughly when you last played). We answer within one month.

If you think the processing breaks the rules, you can complain to the Croatian Personal Data Protection Agency (AZOP, Selska cesta 136, 10000 Zagreb, azop.hr) or to the supervisory authority in the country where you live.

Age

The game is meant for people aged 16 and over. We don't knowingly process data of younger people. If we learn that a profile belongs to someone younger, we will delete it.

Security and automated decisions

The connection between the app and the server is encrypted (HTTPS), and the server doesn't keep the token in its original form. Only the people who maintain the server and the database have access to them.

The bad-word filter automatically refuses a nickname with a swear word or an insult and hides such words in chat. When three different players report the same profile within a day, the server automatically switches its chat off for a day, until we review the reports; every other measure after a report is decided by a person. We make no other automated decisions about players.

Changes to this policy

When the policy changes, the new version is published on this page, with the date of the last update at the top.