128ordle Privacy Policy

Last updated: October 6, 2026.

This Privacy Policy explains how 128ordle handles information when you play the game, create an account, submit scores, use leaderboards, interact with profiles or friends, contact support, view ads or sponsor links, or make a purchase.

The policies page links to shorter plain-language pages on cookies and storage, analytics and tracking, security, your data, and the companies that help run the site.

If you create an account, 128ordle may store account identifiers, username, display name, email address, avatar or profile image, profile settings, badges, achievements, friend or profile interactions, submitted results, streaks, preferences, support messages, and subscription or entitlement status.

If you contact support, report abuse, send partnership requests, or email 128ordle, the information you include in that message may be used to respond, investigate issues, preserve evidence, improve the service, and keep an internal support history.

If you choose Continue with Google, 128ordle uses Google Sign-In through Supabase Auth to create or sign you in to a 128ordle account. For this sign-in flow, the app is intended to request only the basic Google OAuth scopes openid, https://www.googleapis.com/auth/userinfo.email, and https://www.googleapis.com/auth/userinfo.profile. Google may provide your Google account identifier, email address, email verification status, name, and profile picture or avatar.

128ordle uses that Google user data to authenticate you, keep you signed in, create your 128ordle profile, link gameplay progress, stats, streaks, achievements, leaderboards, friend features, support requests, purchases, subscriptions, and account security to the same account. 128ordle does not use Google user data to access Gmail, Drive, Calendar, Workspace, or Data Portability APIs, does not sell it, does not use it for ad targeting, and does not use it to train AI or machine learning models.

Google sign-in data is stored by Supabase Auth and in 128ordle account or profile records as needed to operate your account. 128ordle uses Supabase-issued session tokens in browser storage to keep you signed in; it does not use Google access tokens to call Google APIs after sign-in or store Google refresh tokens in application tables. Use and transfer of Google user data is limited to providing and improving visible user-facing features, security, legal compliance, and account operation.

128ordle stores game progress, guesses, puzzle seeds, preferences, statistics, consent choices, feature flags, pending result submissions, and other gameplay state in browser storage so puzzles can continue across sessions. Signed-in features may also save selected results, account settings, achievements, friend actions, and profile data remotely through Supabase.

The app and its service providers may process technical details such as IP-derived request metadata, browser type, device information, referrer, pages viewed, approximate region, error details, performance data, fraud signals, and security events to run the site, troubleshoot issues, prevent abuse, understand usage, and improve gameplay.

128ordle offers free school colour packs. If you verify a college or university email, 128ordle stores that address, its domain, the school it matched, when it was verified, whether you chose to show a badge, and when you claimed your pack. If you send a school pack request, it stores the school name and note you typed. This information is used to give you your pack, optional badge and private school leaderboard, and to limit abuse. 128ordle does not contact your school, share your account or results with it, send marketing to school addresses, or sell or advertise with school information. Verification emails are sent by Resend. The School Emails and School Data page has the full detail.

When you finish a game, 128ordle stores the result: the board count and mode, which puzzle it was, whether every board was solved, how many boards were solved, how many guesses were used, the timer reading where one was running, and when the game finished. Results from players without an account are not linked to a profile. A random ID stored in your browser and a one-way code derived from the network address are kept with them to prevent duplicate and fraudulent submissions.

If you leave a game before finishing it, 128ordle also stores how far you got: which puzzle it was, how many guesses you had made and how many boards you had solved. The words you typed are not stored. This is kept with the same random browser ID and one-way network code, is not linked to an account, name or email, and is used only for site-wide totals such as guesses made and letters typed.

The public stats pages and monthly recap show totals, averages and records built from those results, from games left unfinished and from Party rounds, without names, emails or private account details. 128ordle does not record individual key presses. Letters typed is calculated as the number of guesses made multiplied by the length of the word, and figures marked as estimates are worked out from a sample of finished games. How stats are counted explains this in full.

128ordle works out a two-letter country code from your IP address and keeps it in a one-day cookie to show shop prices in your local currency and a flag in Party rooms. When a result or a report of an unfinished game is sent, a salted one-way hash of the IP address is stored with it to limit how many one network can send; the address itself is not kept in the record. Party chat messages are filtered and stored as a moderation record. Party rounds are recorded on the server so that everyone in the room sees the same result: the display name, words guessed, number of guesses, boards solved and finishing time of each player.

128ordle may use hosting, database, authentication, analytics, security, storage, and error-monitoring tools such as Vercel, Supabase, PostHog, DataFast, Google Analytics, Cloudflare, and similar providers. Paid checkout, subscriptions, receipts, fraud checks, and billing portals are handled by Stripe; 128ordle does not store full card numbers.

PostHog product analytics, DataFast traffic analytics, and Vercel Web Analytics and Speed Insights run for every visitor. For signed-in players, the account ID and email address are attached to the PostHog profile. Google Analytics loads only if you choose Accept on the consent banner. The full list is on the service providers page.

128ordle may use Google AdSense to display advertising on game, leaderboard, editorial, and other pages. When ads are served, Google and its advertising partners may process information such as IP address, browser and device information, cookies, web beacons, advertising identifiers, page context, approximate location, ad impressions, and interactions to deliver, measure, limit fraud, and improve advertising.

Depending on your location and consent choices, Google AdSense may serve personalized or non-personalized ads. The site sends the consent signals supported by its consent controls, but contextual or limited advertising may still be available where permitted. Google may place or read cookies and use similar technologies on its domains when serving ads.

128ordle uses browser storage and similar technologies for essential gameplay, sign-in sessions, preferences, consent choices, advertising consent signals, PostHog product analytics, Google Analytics where enabled, abuse prevention, and payment handoff. Clearing local storage or cookies may reset local progress or sign you out. The Cookie and Browser Storage Policy lists each one and lets you change your choice.

Information may be shared with service providers that help operate 128ordle, with other players when you use public features, with payment processors for purchases, with authorities or rights holders when legally required or needed to protect rights and safety, or as part of a merger, acquisition, financing, or asset transfer involving the service.

128ordle does not sell Google user data, does not sell personal information in the ordinary sense of exchanging it for money, and does not use Google Sign-In data for personalized ads. Google AdSense and other advertising partners may use their own data and technologies as described in their policies. Sponsor links and ads may send you to external sites that have their own privacy practices.

128ordle keeps information for as long as reasonably needed to provide the service, maintain records, resolve disputes, enforce rules, prevent abuse, satisfy legal obligations, and keep backups. Some browser-stored data remains on your device until you clear it.

128ordle is not directed to children under 13 and does not knowingly collect personal information from children under 13. If you believe a child provided personal information, contact support so the account or data can be reviewed.

You can play without an account, clear browser storage, adjust browser privacy controls, decline optional tracking where consent tools are shown, cancel subscriptions through billing management, revoke Google Sign-In access from your Google Account permissions, change profile details, permanently delete your account from Settings, under Details, or contact support about account and profile data. Your Data explains each step and what deletion removes.

Depending on where you live, you may have rights to request access, correction, deletion, portability, restriction, objection, withdrawal of consent, or appeal of certain privacy decisions. Verification may be required before account-specific requests are fulfilled.

Questions about privacy can be sent through the contact page. The rules for using 128ordle are available in the Terms of Service, and every policy is listed on the policies page.