Privacy Policy
How this version of Undercover Word handles browser storage, gameplay records and optional tracking. Updated October 20, 2026.
Optional host accounts and subscriptions
Free gameplay does not require an account. If you choose a host account, Supabase Auth processes your email address and sign-in requests and your browser stores a session so you can stay signed in. We store your private word packs, hosting presets, billing customer identifier and subscription status. Stripe processes checkout, recurring payments and billing management; we do not store full payment card details. Your email and a host account identifier are shared with Stripe for billing. Other players cannot browse your saved library, but they receive assigned words when you use a pack in their room. Subscription cancellation does not automatically delete your account or library. You can delete saved items in your host account or contact us about account deletion. Billing records may need to be retained for accounting and legal obligations.
Playing without an account
The browser stores a random player token, display name, recent room and host credentials where needed. The server holds room membership, names, assigned words, turn state and votes to run the game. Other members of your room see your display name and public game state. Keep room links and host credentials private.
Gameplay records and optional analytics
The game stores room and round state to support play and reconnect. To understand usage and improve the service, server state changes increment daily counters for rounds started and completed, total players per start, round duration, game mode and outcomes. These counters contain no room or player identifiers, account or billing information, names, words, IP addresses or individual event timestamps. This server-side aggregation uses existing game state and adds no browser storage or tracking requests. We rely on our legitimate interests in understanding and maintaining the service for this limited processing of operational state; contact us to ask questions or object. With analytics permission, your browser can also send an anonymous returning-session flag. Google Analytics is no longer loaded. The flag is immediately added to a daily counter, without storing a separate session event, browser identifier or first-play date on our server. Rejecting or withdrawing optional analytics stops these browser requests without preventing play. Infrastructure providers still receive connection information to serve requests; their logs are separate from these counters.
Advertising
Advertising permission alone does not mean an ad will appear. When available, ads appear only on selected informational guides after you give advertising permission. Gameplay, the homepage, family and adult pack pages are excluded. Initial advertising eligibility is limited to the US, Canada, Australia and New Zealand. Other locations, including unknown locations and the EEA, UK and Switzerland, remain blocked. Google may receive device and request information when its services are enabled.
Your controls
Use Privacy settings on any page to accept, reject or change optional preferences. Saving reloads the page to stop previously loaded scripts. You can also remove this site’s cookies and local storage in browser settings. Clearing player storage can lose access to your current seat and host controls. Withdrawing permission does not erase data already received by a service.
Contact and infrastructure
The contact form sends your name, email and message through Resend so we can respond. The contact form uses request IP information for short-term rate limiting. Supabase stores game room data and gameplay records. Hosting and service providers may process request and security logs. Avoid sending private game credentials in a message.
Retention and requests
Inactive rooms and their associated player, round and vote records are eligible for deletion after 24 hours of inactivity through scheduled cleanup. Daily aggregate counters are retained for long-term comparisons independently of room cleanup; they cannot be linked back to an individual for access or deletion. Browser return-visit dates reset after 180 days on the next play action, and are removed when you reject analytics. Existing optional session events were converted to daily counters and removed. Older gameplay analysis records may remain subject to the room retention process. Hosting and service-provider logs, backups and billing records have separate retention settings. Contact contact@undercoverword.com to request access, correction, deletion, restriction or objection concerning personal records, or to ask about providers and international transfers. You may also complain to your local data protection authority.
Intended audience
Undercover Word is intended for players ages 13 and older and is not intended for children under 13. The Family pack refers to everyday vocabulary for teens and adults. Family and gameplay pages remain outside the advertising inventory. Avoid using real names or sharing personal information in rooms. If you believe a child under 13 has provided personal information, contact contact@undercoverword.com.
Advertising cookies and personalization
If you allow advertising and visit an eligible guide, third-party vendors, including Google, may place advertising cookies in your browser. These cookies can help Google and its partners choose ads using your previous visits to Undercover Word and other websites. Ads may be personalized using that browsing activity when personalization is enabled.
You can turn off personalized advertising through Google Ads Settings. Read how Google uses advertising cookies and how Google uses information from partner sites. Other advertising vendors may also use cookies when their ads are served; the Digital Advertising Alliance opt-out tool offers choices for participating companies.
Those services manage personalization separately from this site's Privacy settings. Rejecting advertising here prevents new advertising loads on this site after the page reloads. Turning off personalization at Google does not turn off all ads or delete existing cookies. Use your browser's controls to remove cookies already stored by a service.