Privacy policy

1. Controller

Christian Scholler
Dülmener Straße 32
48163 Münster
Germany
Email: [email protected]

2. Hosting, Cloudflare and server log files

The website is hosted by ALL-INKL.COM - Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. A data processing agreement according to Art. 28 GDPR is in place with the host.

When you open the site, the server processes technically necessary data that your browser sends automatically: IP address, date and time, requested file, browser type and version, operating system and the previously visited page (referrer). This data is stored in server log files to keep the website running and secure. It is deleted or anonymized after a short time according to the host's settings. It is not combined with other data.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure and stable operation).

Cloudflare: All requests to wordlanche.com go through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare forwards requests to our server, delivers the site encrypted and protects it against attacks and overload. In doing so, Cloudflare processes the technical connection data of your request, mainly your IP address, the requested address, date and time as well as browser and device details. Cloudflare acts as our processor on the basis of its Data Processing Addendum including the EU Commission's Standard Contractual Clauses. Cloudflare is also certified under the EU-US Data Privacy Framework. Data may also be processed in the USA. To protect against automated attacks, Cloudflare may set a technically necessary security cookie (e.g. __cf_bm). Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a secure, fast and available website) and, for the cookie, § 25 (2) no. 2 TDDDG. More in Cloudflare's privacy policy.

3. Storage in your browser (local storage)

Wordlanche stores the following in your browser (local storage, no cookies):

• your settings (e.g. dark mode, colorblind mode, zoom) and the game options you chose last,
• the ID of your current game and your daily puzzles, so a game continues after reloading,
• the chat window settings: whether it is open and docked, position and size, font size, whether the time is shown and whether you have already read the chat hint. As a streamer, also your streamer settings (e.g. chat commands and which chat features are on),
• the chat messages of the last hour, so the chat survives a page reload. They are kept only in the session storage of this tab and are gone as soon as you close the tab,
• a randomly generated, anonymous player ID that your personal stats are linked to. It is shown to you on the sync page as your personal code, so you can take your stats to another device. Anyone who knows this code can see and continue your stats. So don't share it.

This storage is strictly necessary to provide the features you use (game progress, settings, personal stats) (§ 25 (2) no. 2 TDDDG). The data stays in your browser until you delete it in your browser settings (“clear site data”).

If you arrive through the old address wortlawine.de, the site takes this data from your browser to wordlanche.com once. It is handed over directly in the browser and not sent to the server.

If you pick a language with the globe at the top, the site remembers your choice in a cookie (wl_lang, valid for one year) so the start page opens in that language on your next visit. Without that choice it follows your browser's language setting and, if that doesn't match, the country Cloudflare derives from your IP address. The country is not stored. The cookie only contains the language code (§ 25 (2) no. 2 TDDDG).

4. Game data on the server

So that the game works and stats can be shown, the server stores for each game:

• the hidden words, your guesses, the result and timestamps,
• the anonymous player ID (see section 3) and a random viewer link.

No names, email addresses or IP addresses are stored with the games. A link to you as a person is only possible if you share your player ID or a viewer link yourself. Community stats only show aggregated values (e.g. win rate, most popular starting words).

Legal basis: Art. 6 (1) (b) GDPR (providing the game you use) and Art. 6 (1) (f) GDPR (legitimate interest in statistics and in improving the word lists). Game data is stored for as long as the site is operated. It is deleted on request.

5. Watching live

Every game has a viewer link. Anyone who knows this link can follow the game live, including the letters currently being typed. The link is only shown when you reveal it yourself. Only share it if you want others to watch.

So the streamer can see how many people are watching, the server remembers each viewer's anonymous player ID (see section 3) together with the time. These entries are deleted after one hour at the latest.

The server also counts per game how many people watched in total and at most at the same time, and per streamer which player ID watched how often (first and last watch, number of games). If you are logged in with Twitch as a viewer, this player ID is linked to your Twitch account and visible to the operator as a name. Without logging in it remains an anonymous number. For reach statistics, the server additionally counts how many different viewers there were per day. For this it only stores a shortened, irreversible hash of the player ID per day and deletes it after a little over a year. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in usage statistics).

6. Logging in with Twitch

You can choose to log in with your Twitch account. The site then forwards you to Twitch (Twitch Interactive, Inc., 350 Bush Street, San Francisco, USA), where you confirm the login. Twitch then sends us your Twitch ID, your login name, your display name and the public details of your profile (profile picture, profile description, account type such as Partner or Affiliate and the creation date of your Twitch account). We do not request your email address. The Twitch access token is not stored and is revoked immediately. The exception is chatting from the site, see below.

We store an account with these details, the time of login and the link to your game stats. The site occasionally refreshes the public profile details and whether you are live (viewer count, category, stream title) for the operator overview via the public Twitch API. To keep you logged in, the site sets a technically necessary cookie with a random value (valid for 90 days, or until you log out). The server only stores an encrypted hash of it. During login, another cookie is set for at most ten minutes that protects against forged logins.

Legal basis: Art. 6 (1) (b) GDPR (you use the login so your stats are stored across devices). Twitch's privacy policy applies to data processing at Twitch. Twitch also processes data in the USA. If you want your account deleted, email us at the address above.

Chat suggestions and chat display for streamers: If you are logged in with Twitch and have turned on chat suggestions or the chat display, your browser connects directly to the public chat of your Twitch channel during your game (read only, without logging into chat). Twitch technically receives your IP address. The messages themselves are only evaluated in your browser and not stored. For chat messages that contain a game command (e.g. #1 WORD), your browser reports the sender's public Twitch name, the suggested word and the board to the server. Per streamer, only a count is stored: Twitch name, number of suggestions, number of hits, number of games and first and last participation. This way the streamer sees who in their chat guessed along. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in a co-player statistic; the names are public in Twitch chat anyway). Anyone who does not want to be counted does not post game commands in chat or asks for deletion at the email address above. You can turn this off at any time in the streamer settings.

Chat while watching: If a streamer has enabled their chat for viewers, your browser also connects directly to the public chat of their Twitch channel while you watch through their viewer link (read only, without logging into chat). Twitch technically receives your IP address. The messages are only shown in your browser. Nothing of it goes to our server and nothing is stored. The connection ends as soon as you stop watching or close the page. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in showing the chat alongside the game).

Chatting from the site: If you want to write in Twitch chat from Wordlanche, Twitch additionally asks for the “send chat messages” permission when you log in. Only then do we store the Twitch access token, encrypted on our server. It only allows sending chat messages in your name and is only used when you click “Send” yourself. We pass your message on to Twitch for this, but do not store it. When you log out, we revoke the token at Twitch and delete it. You can also withdraw the permission at any time in your Twitch account under “Connections”. Legal basis: Art. 6 (1) (b) GDPR (you use the feature to write in chat).

7. Checking unknown words

If you guess a word that is not in the site's dictionary, the server asks Wiktionary (Wikimedia Foundation) whether the word exists. Only the word itself is sent. The request comes from the server, not from your browser. Your IP address or other data about you is not passed on.

8. External links

The site contains links to other websites (e.g. to the sources of the word lists or to the Cambridge Dictionary for the answers). Data is only sent to the respective provider once you click a link. No content, fonts or scripts are loaded from outside servers.

9. Protection against abuse

To prevent automated mass requests and password guessing, the server counts requests per visitor. Instead of the IP address, it only stores a shortened hash that changes every hour and from which the IP address cannot be calculated. These counters are deleted after one hour at the latest. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure operation).

10. Admin area

For the operator's password-protected admin area, a technically necessary session cookie is set. This cookie is not used for visitors and players.

11. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). Contact the email address above for this. So that game data can be matched, please include your player ID or the viewer link of the game in question.

You can also lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

12. Use of artificial intelligence

Artificial intelligence was used in creating this website.

13. Changes

This privacy policy is updated when the site or the legal situation changes. Last updated: October 2026.