Privacy policy
Last updated: 3 October 2026
How Spell to Win handles information when you play at spellto.win or use an optional account.
Who is responsible
Zal Interactive AB, based in Sweden, is the controller of personal data used to operate Spell to Win. Contact contact@zalinteractive.com for support, privacy questions and data requests.
Game and account information
Guest progress, submitted words, scores, hints, puzzle identifiers and timing are saved in your browser. When signed in, active games and results sync to your account. We process your authentication identifier, email, sign-in provider information, username, display name and preferred language. Technical requests may include your IP address, browser information, requested URL and diagnostic logs. Active guest progress may be adopted when you sign in if there is no conflicting account game; completed guest history is not imported.
Google sign-in
Google sign-in is optional and requests only basic identity scopes: openid, email and profile. Google may supply your account identifier, email and verification status, name and profile picture. Our authentication service stores this information to identify and protect your account. Your Google name and picture are not automatically published. We do not request your Google password, Gmail, Drive, contacts or calendar.
Use of Google information
Google information is used only to authenticate you and provide and protect requested account features, including saved progress. It is processed by our hosting and authentication providers for those purposes. We do not sell it, use it for advertising or profiling, send it to word-checking AI models or use it to train AI models. Spell to Win’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.
Public profiles and shared accounts
Accounts and profiles are shared with Word Hunt, another Zal Interactive game. New accounts receive editable random usernames and display names. Those names and summary statistics can be public through shared profile features. Your email, Google authentication information and detailed game history remain private. Spell to Win progress is stored separately from other games, but deleting the shared account also affects its other games.
Word checking
Words not already accepted by a puzzle may be sent with their language to our server and, when needed, OpenAI for a vocabulary decision. We do not include your account identifier, email or game history in model requests. Shared lexical decisions have no player identifier: accepted decisions remain until revised, while rejected decisions are eligible for re-evaluation after 30 days. AI decisions can be incorrect. Short-lived, keyed IP hashes and request counters limit abuse; later evaluations clean up expired counters. Model and hosting providers may retain technical records under their applicable retention settings.
Purposes and legal bases
We use account and game data to provide requested play, saving and profile features (GDPR Article 6(1)(b), performance of a contract). Our legitimate interest in operating a reliable, secure service supports abuse prevention and necessary technical records (Article 6(1)(f)). We process data required to handle statutory rights requests or legal obligations under Article 6(1)(c). The game has no advertising or analytics tracking.
Service providers and international processing
Vercel hosts the website. Our authentication and database service processes account records and saved games. Google processes Google sign-in, and OpenAI processes words requiring model evaluation. These providers may process data outside the EU/EEA. Contact us for current processing locations, recipients and applicable transfer safeguards, including adequacy decisions or standard contractual clauses and how to obtain copies. We do not share personal information for unrelated purposes.
Security
We use HTTPS, authenticated sessions and database access rules to protect private account records. Access is limited to operating the service, support, security and legal obligations. Providers operate underlying storage and security controls. No online service can guarantee absolute security.
Retention
Guest saves remain until you clear site data or your browser removes them. Local account saves are cleared when you sign out or change accounts; cloud saves remain. Browser word verdicts are usable for 30 days, with at most 1,000 entries; expired entries are removed during later cache writes or when you clear site data. Account and Google authentication records remain while the shared account exists. Logs and backups follow provider retention settings. Support messages are retained only as needed to handle requests and applicable obligations.
Disconnecting Google and deleting information
You can revoke Spell to Win’s connection in your Google Account at any time. This stops future access through that connection but does not delete existing game or account data. Email contact@zalinteractive.com to request deletion of Spell to Win data or the shared account; specify which you intend. Shared-account deletion removes the active authentication record, profile and linked game records across games. Provider backups and security logs may retain records for their configured periods, and legal obligations may require limited retention. Clearing browser data or signing out does not delete the cloud account.
Your rights
You may request access, correction, deletion, restriction or portability where applicable, or object to processing based on legitimate interests. Edit your profile in the game or email contact@zalinteractive.com. We may verify your identity and normally respond within one month, subject to lawful extensions. You can complain to the Swedish Authority for Privacy Protection (IMY) or your local supervisory authority.
Children and updates
An account is optional. A parent or guardian should help a child understand account use and this policy where needed. Contact us about concerns involving a child’s data. We update this policy when processing changes and show its revision date above.
Manage Google connections · Google API Services User Data Policy · Your rights at IMY