Privacy Policy
Last updated: 01.06.2026
Hållingwood A/S (“Hållingwood”, “we”, “us”) respects your privacy and is committed to protecting your personal data. This policy explains what data we collect when you use Wordnerd 3D (the “Game”), why we collect it, how we use it, and what rights you have.
We are the data controller for the processing described in this policy. We comply with the EU General Data Protection Regulation (GDPR), as incorporated into Norwegian law through the Personal Data Act (Personopplysningsloven), and with applicable privacy laws in other jurisdictions where the Game is available.
1. Who we are and how to contact us
Hållingwood A/S
Mørkved 39,
7877 Høylandet
Norway
Org. no.: 924754303
For any question about this policy or your personal data, contact us at wordnerdsupport@hållingwood.no. We may need to verify your identity before acting on a request.
2. What data we collect and why
We only collect data we need to operate the Game. The categories below describe everything we process.
Account data
- Username (chosen by you; visible to other players)
- Password (stored as a salted hash; we never see your actual password)
- Email address (optional; used only for account recovery and important service notices)
Purpose: create and manage your account, let you log in across devices, recover access if you forget your password.
Legal basis: performance of a contract (GDPR Art. 6(1)(b)).
Retention: for as long as your account is active. See Section 5.
Gameplay data
- Games you play, words you submit, scores, opponents, timestamps
- Your in-game statistics and rating
Purpose: run the game, match you with opponents, maintain history and leaderboards, resolve disputes.
Legal basis: performance of a contract.
Retention: for as long as your account is active. After account deletion, gameplay records are anonymized (your username is replaced with a non-identifying placeholder) so that opponents’ game histories remain intact.
Technical and device data
- Device type, operating system and version, app version, language setting
- IP address (used transiently for connection; not stored long-term in identifiable form)
- Session connection and disconnection timestamps
Purpose: operate the multiplayer service, diagnose bugs, prevent abuse, maintain service security.
Legal basis: legitimate interest (GDPR Art. 6(1)(f)) — specifically, our interest in running a stable, secure service. We have weighed this against your privacy interests and consider the impact minimal.
Retention: server logs are kept for up to 30 days, then deleted or aggregated. IP addresses in logs are truncated.
Purchase data (Wordnerd Premium)
- Purchase receipt from Apple App Store (or Google Play, when available)
- Premium entitlement status, tied to your account
Purpose: verify your purchase and grant Premium features (such as ad removal) across your devices.
Legal basis: performance of a contract; legal obligation (Art. 6(1)(c)) for accounting records required under Norwegian law.
Retention: entitlement is tied to your account. Receipt records required for accounting are kept for 5 years as required by Norwegian bookkeeping law (Bokføringsloven).
We do not see, store, or process your payment card details. All payments are handled by Apple or Google under their own terms and privacy policies.
Push notification token
- A device token issued by Apple Push Notification service (or Firebase Cloud Messaging on Android)
Purpose: send you notifications about your turn, game invitations, and similar in-game events you have opted in to.
Legal basis: consent (you grant this through your device’s notification permission).
Retention: until you disable notifications or delete the app.
3. What we do not collect
To be explicit:
- We do not collect your real name, address, phone number, or date of birth.
- We do not collect precise location data.
- We do not access your contacts, photos, microphone, or camera.
- We do not sell or rent your personal data to anyone.
- We do not use your data for behavioural advertising profiling. (Ads in the free version are served by AdMob — see Section 4.)
4. Third parties who process data on our behalf
We use the following service providers (“data processors”) to operate the Game. Each is bound by a data processing agreement.
| Provider | Purpose | Location |
|---|---|---|
| Linode (Akamai) | Server hosting | Germany (EEA) |
| Apple Inc. | App distribution, in-app purchases, push notifications | United States / Ireland |
| Google LLC | Android distribution, AdMob ads, push notifications | United States / Ireland |
| Lettermint | E-mail distribution | Europe |
International transfers: Services provided by Apple and Google involve transfers to the United States. These transfers are made under the EU-US Data Privacy Framework and/or Standard Contractual Clauses approved by the European Commission.
We do not transfer your data to any other third parties except where required by law (e.g. in response to a valid court order or law enforcement request).
5. How long we keep your data
| Data | Retention period |
|---|---|
| Account data | Until you delete your account |
| Gameplay data | Until you delete your account, then anonymized |
| Server logs (technical) | Up to 30 days |
| IP addresses | Truncated; not stored long-term in identifiable form |
| Purchase receipts | 5 years (Norwegian bookkeeping law) |
| Push notification token | Until you delete your account |
| Inactive accounts | Accounts inactive for 3 years are deleted |
When you request deletion, we erase or anonymize your personal data immediately, except where we are legally required to keep specific records (such as purchase receipts).
6. Your rights
Under GDPR, you have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate or incomplete data
- Erasure (“right to be forgotten”) — request deletion of your data
- Restriction — request that we limit how we process your data
- Portability — receive your data in a structured, machine-readable format
- Objection — object to processing based on legitimate interest
- Withdraw consent — for any processing based on consent, withdraw it at any time
You can exercise the right to erasure directly in the Game: Settings → Account → Delete Account.
Right to lodge a complaint: if you believe we have handled your data unlawfully, you have the right to file a complaint with the Norwegian Data Protection Authority (Datatilsynet, datatilsynet.no) or with the supervisory authority in your country of residence.
7. Security
We use industry-standard measures to protect your data:
- All communication between the app and our servers is encrypted using TLS
- Passwords are hashed using a modern password-hashing algorithm
- Backups are encrypted and stored in a separate location
- Access to production data is limited to staff who need it for support and operations, and is logged
- We follow data protection by design and by default principles (GDPR Art. 25)
No system is completely secure. If a data breach occurs that is likely to affect your rights, we will notify Datatilsynet within 72 hours and inform you directly without undue delay where required by law.
8. Children
The Game is not intended for children under 13. We do not knowingly collect personal data from children under 13. If you become aware that a child has created an account, please contact us and we will delete the account.
If you are between 13 and the age of majority in your country, please use the Game only with the consent of a parent or guardian.
9. Advertising (free version)
The free version of the Game shows ads served by Google AdMob. When ads are shown, AdMob may process limited device data (such as advertising identifier and IP address) under its own privacy policy. On iOS, ads only use your advertising identifier if you have allowed tracking through the Apple App Tracking Transparency prompt.
You can remove ads entirely by purchasing Wordnerd Premium.
10. Changes to this policy
We may update this policy when our service or applicable law changes. The current version will always be available here. The “Last updated” date at the top shows when the policy was last revised.