Privacy Notice

This Privacy Notice describes how Project Word handles information in the research beta.

Version: privacy-v2. Eligibility policy version: eligibility-v1. Effective date: September 4, 2026.

Project Word uses persistent browser identifiers, session records, referral codes, hashed security values, and hosting logs. That information is pseudonymous. It is not fully anonymous, because those records can distinguish a browser installation or tester even without your name.

Who we are and how to contact us

Project Word is operated by Evertheme LLC. Email info@evertheme.com. Mail 160 W. Camino Real, Unit #756, Boca Raton, FL 33432. The public website is projectwordgames.com.

Scope

This notice describes Project Word’s public beta website, local and preview fixtures, and the research records created after valid Terms acceptance. Opening /privacy or /terms does not create a user, session, cookie, or research event.

Identifiers we assign

If you start a game, the server assigns a pseudonymous user ID and a personal referral code and stores the user ID in this browser. Each game gets a session ID. Requests use one-time request IDs so retries do not duplicate data. The browser also stores a session capability token; the server stores only a hash of that token.

We do not ask for your name, email, phone number, postal address, or account password, and we do not read your contacts.

Gameplay information

We record the starting word, the sequence of words, accepted and rejected attempts, the changed letter and remaining replacement uses, score, word count, public result class, replay linkage, and I’m Stuck behavior, including opening the confirmation, Keep Playing, and End Run.

Timing

We record wall-clock start and end times, accumulated active play time (excluding hidden or background time where practical), and decision timing for moves and for a confirmed I’m Stuck ending.

Survey ratings and comments

After a run we ask four required ratings and one optional comment of up to 2,000 characters. Do not enter personal, confidential, or sensitive information in the comment box.

Referral and invitation information

If you arrive through an invite link, this browser stores that referral code on first touch and we attach it to your later session as source attribution. Invite a Friend copies a link that uses your own referral code. We do not collect a friend’s name or contact details.

We do not currently collect tester codes, named cohorts, or extra invitation codes. Those database fields stay empty.

Device, browser, and local play day

We store a coarse device category, browser family, operating system family, viewport width and height, the referring website origin if the browser provides one, a coarse IANA time zone, and the local calendar date used for the daily play allowance. We do not store the raw user-agent string in the research database. We do not fingerprint your device or use precise location.

IP addresses, logs, cookies, and browser storage

Project Word’s application code does not set cookies. This browser uses local storage for gameplay restore, referral attribution, survey drafts, session capability, legal-evidence timestamps, and related operational keys. If local storage is unavailable, the same information may stay in memory only until you close the page.

We do not store your IP address in the research database. On Vercel we use a daily rotating hash of the source address Vercel reports, only to limit abusive requests. Vercel’s own runtime logs may include IP address, request path, and similar technical data. On the current Vercel Hobby plan, runtime logs are kept for about one hour. Application error logs record only a route name and a stable error code.

Vercel may set its own host cookies or similar technologies for hosting, security, or preview protection. We do not use advertising cookies, analytics SDKs, session replay, or fingerprinting.

Sources and purposes

Gameplay, survey, and device information come from your use of the site after Terms acceptance. Referral codes come from invite links you open or copy. Security hashes and host logs come from the request path used to operate the site.

We use this information to run and restore the game, enforce the daily allowance, attribute invitations, study how people play, improve the product, and limit abuse. We do not use it for advertising or marketing.

Daily game allowance

Each stored user ID may start one initial game and one replay per local calendar day. A compatible unfinished game resumes without using another slot. Clearing storage or using another browser can create a new user ID. We do not add accounts or fingerprinting to prevent that.

Service providers and transfers

We host the site on Vercel (Hobby plan, region iad1 in the United States). Research records use Neon Postgres through the Vercel Marketplace (Free plan, AWS us-east-1 / Northern Virginia). GitHub stores the project source. Vercel Analytics and Speed Insights are disabled and not installed.

Those providers process information in the United States to host and store the beta. We do not sell information to them for their advertising.

Retention

Gameplay sessions, attempts, survey ratings, referral records, daily-allowance records, and Terms-acceptance evidence are kept for 24 months after that tester’s last session activity, then removed by an operator-run process.

Optional survey comments are removed after 12 months even if the rest of the session is still kept.

Hashed rate-limit rows are kept only until their window expires. Vercel runtime logs follow the Hobby plan, currently about one hour. Neon keeps about 6 hours of history, subject to a 1 GB limit, and one manual snapshot. Already-written research exports and genuinely deidentified aggregates may be kept until the research ends.

Access and security

The operator can access live research records. Optional comments are treated as restricted. Researcher exports are operator-run, read-only, and redact comments unless a separate restricted acknowledgement is given. Exports do not include secrets, raw logs, full IP addresses, or private optimal paths. Vercel and Neon act as processors for hosting and storage.

We use TLS for database connections, hashed session capabilities, hashed rate-limit identities, and same-origin checks on gameplay APIs. No security practice is perfect.

Access and deletion without an account

Because there is no account, we locate a tester only by the anonymous user ID and/or referral code stored in that browser. If you send both, they must identify the same tester. We will not ask for extra identity data to fulfill a request.

Email info@evertheme.com with those locators and say whether you want a copy of the linked research records, deletion, or both. We aim to respond within 30 days. Clearing this site’s local storage can remove the locators, after which we may not be able to find your records.

Deletion removes that tester’s user record, daily allowance, sessions, events, finishes, surveys, and linked allocation and event-batch receipts. Other testers’ sessions that only cited your referral as the source are not deleted; the source referral on those sessions is cleared. There is no public deletion button, so one tester cannot submit another tester’s identifiers through the website.

Backup and deletion limits

Neon history and the manual snapshot, already-written research exports, hashed rate-limit rows, and failed allocation requests that were never tied to a session are not purged by a deletion request. Those copies age out according to the provider or process that holds them.

Children

Project Word is not directed to children under 13. People 13 or older may participate. We do not use an age-gate screen. If we learn we stored information from a child under 13, we will delete the linked records we can locate.

Privacy rights

U.S. state privacy laws may give you rights to know, access, delete, or correct information, or to opt out of sale or sharing for cross-context behavioral advertising. We do not sell information, share it for cross-context behavioral advertising, use it for advertising, or use it for marketing.

Use the email process above with your stored locators. We cannot honor a request that would delete another tester’s data. Correction is limited because we do not keep a profile of your identity; we can delete locatable records.

International use

The beta is offered only to people located in the United States. Hosting and storage are in the United States. We do not currently geo-block visitors. If you use the site from elsewhere, you do so against these eligibility terms and information may still be processed in the United States.

Changes to this notice

If we make a material change, we will show the updated notice before the next new game. We will not silently rewrite the Privacy Notice version already stored with an earlier session.