Summer Door Studios

Privacy Policy

Word Rails

Effective Date: October 3, 2026
Last Updated: October 3, 2026

1. Introduction

This Privacy Policy explains how Summer Door Studios LLC ("Summer Door," "we," "us," or "our") collects, uses, discloses, and protects information when you use the Word Rails mobile application, the Word Rails Daily web game at wordrails.com (the "web Daily"), the wordrails.com website, and any related websites or services we operate (collectively, the "Service").

Summer Door Studios LLC, located in Washington State, United States, is the data controller responsible for your personal information described in this Policy. By using the Service, you agree to the collection and use of information as described in this Policy. If you do not agree, please do not use the Service.

This Policy does not apply to third-party services, websites, or applications that you access through the Service. Those are governed by their own privacy policies.

2. Who This Policy Applies To

Word Rails is intended for users 13 years of age and older. The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you are in the European Economic Area ("EEA") or the United Kingdom, you must be at least 16 years old, or have consent from a parent or guardian, to use the Service.

If we learn that we have collected personal information from a child under 13 (or under the applicable minimum age in your jurisdiction), we will delete that information promptly. See Section 11 for more information and how to contact us.

3. Information We Collect

3.1 Information You Provide to Us

• Player profile information. A display name or player name you choose, and any avatar or cosmetic selections you make.
• Account information. If you sign in to sync progress or use social features, we or our authentication provider may collect an account identifier and, where you choose to use it, an email address or third-party account identifier (for example, Sign in with Apple or Google Sign-In). On the web Daily, signing in is optional: if you choose to save your streak, you sign in with Google or Apple, and we receive an account identifier and the email address (and, with Apple, the name) that the provider shares.
• Dare names. On the web Daily, you may sign a dare to a friend with an optional name. That name is shown with your score to the people who open your dare and on their rival lists.
• Social and competitive activity. Friend connections, Rally participation, leaderboard entries, and match results you generate by playing, and on the web Daily, your daily runs, dares and rivals.
• Support communications. If you contact us for support or to exercise a privacy right, we collect the contents of your message and any contact details you provide.
• Purchase records. When you make an in-app purchase, we receive a confirmation of the transaction and your entitlements from the app store. We do not receive or store your payment card number, billing address, or other payment credentials. Payments are processed entirely by Apple or Google.

3.2 Information Collected Automatically

• Device and technical information. Device model, operating system and version, language, region, screen characteristics, app version, and network type.
• Identifiers. A device or installation identifier, and — where permitted — a mobile advertising identifier (the Google Advertising ID on Android or the Identifier for Advertisers (IDFA) on iOS).
• IP address. Used for approximate location (country or region level), security, fraud prevention, and to route requests. On our website, your country is used to decide whether we ask for your cookie choices before any analytics run. We do not collect precise GPS location.
• Gameplay and usage data. Events such as matches started and completed, words played, tutorial progress, session length, screens viewed, feature usage, and progression milestones.
• Diagnostic and crash data. Crash logs, error reports, stack traces, and performance data.
• Website and web Daily data. When you visit wordrails.com: your browser type and version, device type, language, the pages and screens you view, and the page that referred you. When you play the web Daily, we automatically create an anonymous account for your browser so your run and streak are saved, and we record each run (the board number, your score, grade, the words you played, and how long you took). For abuse prevention, the web Daily stores only a salted hash of your IP address, not the address itself.
• Attribution and install data. Information about how you found and installed the Service, including referral, campaign, and deep-link parameters, and in-app events used to measure our marketing (such as tutorial completion, match milestones, return visits, rewarded ad views, and in-app purchases). See Section 6.

We do not collect sensitive personal information such as government identifiers, precise geolocation, biometric data, health data, or information about your race, religion, or sexual orientation.

3.3 Information We Receive From Third Parties

• App stores. Apple and Google provide us with purchase confirmations, subscription/entitlement status, refund notices, and aggregated performance data.
• Advertising and attribution partners. The advertising networks we use to promote Word Rails (such as Unity and Liftoff) and our mobile measurement partner (Tenjin) may provide us with aggregated or pseudonymous information about ad performance and app installs, including which ad campaign, if any, led to your install.

3.4 Cookies and Similar Technologies on Our Website

The web Daily keeps a small amount of data in your browser (local storage and IndexedDB) so the game works, and may set cookies for analytics and, if we enable them, advertising. The informational pages of wordrails.com (such as About, How to Play, this Privacy Policy, and our Terms) set no cookies and run no analytics.

Your choices. In the EEA, the UK, Switzerland, and wherever we can't determine your location, Google Analytics stays off until you accept it in the cookie banner. Elsewhere it is on by default, and you can turn it off at any time. Either way, you can change or withdraw your choice at any time with Cookie settings. If your browser sends a Global Privacy Control signal, the web Daily treats it as an opt-out of analytics and advertising unless you turn analytics on yourself. You can also block or delete cookies and site data in your browser settings; the web Daily will still work, but a cleared browser starts a new anonymous account and loses a streak you haven't saved by signing in.

4. How We Use Information

We use the information described above to:

• Operate, provide, and maintain the Service, including matches, Rallies, leaderboards, social features, and the web Daily (grading your runs, keeping your streak, and delivering dares and rival lists);
• Save and sync your progress and entitlements across devices;
• Deliver and manage in-app purchases, and honor entitlements such as the Conductor's License;
• Display advertising, including personalized advertising where you have consented or where permitted by law (see Section 6);
• Send push notifications, where you have granted permission (see Section 7);
• Understand how players use the Service so we can improve gameplay, onboarding, balance, and performance;
• Diagnose crashes, fix bugs, and monitor stability and performance;
• Measure the effectiveness of our marketing and user acquisition;
• Detect, investigate, and prevent cheating, fraud, abuse, and violations of our Terms & Conditions;
• Respond to your support requests and communicate with you about the Service;
• Comply with legal obligations and enforce our agreements.

We do not sell your personal information for money, and we do not use your personal information to make automated decisions that produce legal or similarly significant effects about you. Gameplay systems such as matchmaking and difficulty balancing operate on gameplay data and do not have such effects.

5. Legal Bases for Processing (EEA and UK Users)

If you are in the EEA or the UK, we rely on the following legal bases under the GDPR / UK GDPR:

Where we rely on consent, you may withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

6. Advertising and Tracking

Word Rails displays advertising provided through Google AdMob and its mediation partners. Advertising helps keep the Service free to play. Players who purchase the Conductor's License do not see in-game advertisements.

Personalized advertising. Depending on your device, settings, and location, ads you see may be personalized based on your advertising identifier and inferred interests. Our advertising partners may collect your advertising identifier, IP address, device information, and in-app ad interaction data, and may infer interests from them, as described in their own privacy policies.

• On iOS, we request permission through Apple's App Tracking Transparency ("ATT") framework before any tracking across apps and websites owned by other companies. If you decline, we do not access your IDFA for that purpose and you will receive non-personalized ads.
• In the EEA, UK, and Switzerland, we present a consent message through Google's User Messaging Platform ("UMP") before serving personalized ads. You may change or withdraw your choice at any time from the in-app privacy settings.
• Elsewhere, you may opt out of personalized advertising at any time using your device settings and the in-app privacy settings.

Your device-level controls:

• Android: Settings → Google → Ads → Delete advertising ID or Opt out of Ads Personalization.
• iOS: Settings → Privacy & Security → Tracking, and Settings → Privacy & Security → Apple Advertising.

Opting out of personalized ads does not remove ads; it means the ads you see will be less relevant.

Advertising on our website. We may show ads on wordrails.com, including on the web Daily, through Google AdSense. As of the date of this Policy, website ads are not enabled. If we enable them:

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to our website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to our site and/or other sites on the Internet. Learn more about how Google uses information from sites that use its services.
• You may opt out of personalized advertising by visiting Google's Ad Settings, and you can opt out of some third-party vendors' use of cookies for personalized advertising at www.aboutads.info/choices or www.youronlinechoices.eu.
• We will not show website ads to visitors in the EEA, the UK, or Switzerland until we offer a consent choice that meets Google's requirements there, and we will not show them to Conductor members or to browsers sending a Global Privacy Control signal.

Marketing and install attribution. We advertise Word Rails in other apps and on other services through advertising networks, including Google Ads, Apple Search Ads, Unity, and Liftoff. To understand which of these campaigns lead to installs and engaged players, we use Tenjin, a mobile measurement partner whose software is built into the app. Tenjin processes this data on our behalf as our service provider. When you first open the app and as you play, Tenjin may receive:

• Your advertising identifier (where permitted by your device settings and, on iOS, only if you allow tracking through ATT), a Tenjin-generated installation identifier, your IP address, and device information;
• Selected in-app events, such as tutorial start and completion, match milestones, return visits, and rewarded ad views;
• In-app purchase details, such as the product purchased, its price and currency, and, on Android, the purchase record issued by Google Play so the transaction can be validated. We do not send your payment card or billing details.

Tenjin matches this information to ad clicks and impressions to determine which campaign, if any, led to your install, and may report install and in-app event results back to the advertising network that ran that campaign (for example, Unity or Liftoff) so it can measure and optimize our ads. On iOS, if you do not allow tracking, attribution relies on Apple's privacy-preserving frameworks (SKAdNetwork and AdAttributionKit), which report aggregated campaign results without identifying you. The advertising networks may use information they collect when you view or interact with our ads in accordance with their own privacy policies (see Section 8).

Do Not Track. The Service does not respond to browser "Do Not Track" signals. We honor Global Privacy Control (GPC) on our website: the web Daily treats a GPC signal as an opt-out of analytics and advertising (see Section 3.4).

7. Push Notifications

We may send push notifications about Rallies, streaks, rewards, friend activity, and game updates. Notifications are sent only after you grant permission at the operating-system level. You can revoke that permission at any time in your device settings, and you can adjust notification categories in the in-app settings. Turning off notifications does not affect your ability to play.

8. Third-Party Services We Use

We rely on the following service providers, each of which processes data on our behalf or as an independent controller. Their privacy practices are governed by their own policies. Some pages of our website also load code from public content delivery networks, which receive your IP address and browser information when they deliver it.

9. How We Share Information

We disclose information only as follows:

• Service providers. To the vendors listed above, who process information on our behalf under contractual obligations.
• Advertising partners. Where you have consented (or where permitted by law), we or our ad partners may use your advertising identifier and app usage data to serve and measure personalized advertising. Our measurement partner may also report install, in-app event, and purchase results to the advertising networks that ran the campaign that led to your install, so they can measure and optimize our ads (see Section 6). Under U.S. state privacy laws, this may be considered "sharing" for cross-context behavioral advertising or "targeted advertising." See Section 12.
• Other players. Your display name, avatar, and competitive results (such as leaderboard placement and Rally standings) are visible to other players. Screenshots or recordings of public leaderboards and events, which may include your display name and standings, may also be used to promote the Service. On the web Daily, a name you sign a dare with is shown, with your score, to the people who open that dare and on their rival lists. Do not use your real name, email address, or other personal details as your display name or dare name.
• Legal and safety. When we reasonably believe disclosure is required by law, subpoena, or legal process, or is necessary to protect the rights, property, or safety of Summer Door, our players, or the public.
• Business transfers. In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the terms of this Policy.

We do not sell your personal information for monetary consideration.

De-identified data. Where we maintain or use de-identified or aggregated data, we commit to maintaining it in de-identified form and will not attempt to re-identify it, except as permitted by law to test whether our de-identification processes work.

10. Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy:

• Account and progression data: for as long as your account is active, and for up to 24 months after your last activity, unless you request earlier deletion. Records needed to honor paid entitlements (such as the Conductor's License) are kept as long as needed to honor them.
• Analytics event data: typically retained on a rolling basis in accordance with our analytics provider's configured retention window (currently 14 months).
• Web Daily data: an anonymous web Daily account that has not been linked to a sign-in is deleted, with its runs, dares, and rivals, after 180 days without a visit. A web Daily account you sign in to is kept like any other account (above). Data stored in your browser stays there until you clear it.
• Crash and diagnostic data: typically 90 days.
• Purchase and transaction records: as long as required for tax, accounting, and legal purposes (generally up to seven years).
• Support correspondence: for as long as needed to resolve your issue and for a reasonable period thereafter.

We may retain de-identified or aggregated data indefinitely; such data is not used to re-identify you.

11. Children's Privacy

Word Rails is a general-audience word game not directed to children under 13, and we do not knowingly collect personal information from them. Our app store listings declare a target audience of 13 and older, and we do not market the Service to children.

If you are a parent or guardian and believe your child under 13 has provided us with personal information, please contact us at support@summerdoor.com. We will delete the information and terminate the child's account promptly.

12. Your Privacy Rights

12.1 All Users

You can, at any time:

• Change your display name and cosmetic selections in the app;
• Adjust push notification permissions in your device settings;
• Reset or opt out of your advertising identifier in your device settings;
• Change your advertising consent choice in the in-app privacy settings;
• Change or withdraw your cookie choices for the web Daily with Cookie settings, or clear the web Daily's data by clearing your browser's site data for wordrails.com;
• Request deletion of your account and associated data (see Section 12.5).

12.2 EEA, UK, and Swiss Residents

Subject to applicable law, you have the right to: access your personal data; rectify inaccurate data; request erasure; restrict or object to processing; data portability; withdraw consent; and lodge a complaint with your local supervisory authority. We do not make decisions based solely on automated processing that produce legal or similarly significant effects concerning you.

12.3 U.S. State Privacy Rights

Residents of California and of other states with comprehensive privacy laws (including Colorado, Connecticut, Virginia, Texas, Oregon, Minnesota, and others) have the right to: know what personal information we collect and how we use it; request access to or a copy of that information; request correction; request deletion; opt out of "sales," "sharing" for cross-context behavioral advertising, and targeted advertising; opt out of profiling in furtherance of decisions that produce legal or similarly significant effects (we do not engage in such profiling); and not be discriminated against for exercising these rights.

Categories of personal information we collect (as categorized under the California Consumer Privacy Act), the sources, and the recipients:

We do not collect the CCPA categories of sensitive personal information, biometric information, precise geolocation, or protected classifications, and we retain each category as described in Section 10.

Categories "sold" or "shared": We do not sell personal information for money. In the preceding 12 months, we have "shared" identifiers (advertising ID), internet activity (in-app usage and ad interaction data), and limited commercial information (in-app purchase events) with advertising partners for cross-context behavioral advertising, unless you opted out. To opt out of sharing/targeted advertising, use the in-app privacy settings or your device's advertising controls described in Section 6. On our website, we do not currently sell or share personal information; if we enable website ads, you can opt out with Cookie settings or by sending a Global Privacy Control signal.

We do not knowingly sell or share the personal information of consumers under 16 years of age.

12.4 Appeals (Colorado, Virginia, Connecticut, Minnesota, and Similar States)

If we decline to act on your privacy request, you may appeal our decision within 45 days by replying to our response or emailing support@summerdoor.com with the subject line "Privacy Appeal." We will respond within the period required by your state's law (generally 45–60 days). If your appeal is denied, you may contact your state Attorney General to submit a complaint.

12.5 How to Exercise Your Rights — Including Account Deletion

To request access, correction, or deletion of your data — or to delete your account entirely — you may:

1. Use the Delete Account option in the app's settings (step-by-step instructions); or
2. Email us at support@summerdoor.com with the subject line "Privacy Request".

Web Daily. If you play the web Daily without signing in, clearing your browser's site data for wordrails.com removes what is stored on your device, and the anonymous account behind it is deleted automatically after 180 days without a visit. If you signed in with Google or Apple and linked the Daily to a Word Rails app account, deleting that app account deletes it too. Otherwise, email us from the address of the Google or Apple account you signed in with and we will delete your web Daily account and runs. See the account deletion page for details.

We will verify your request using your account identifier or, where you have no account, other reasonable means. We will respond within the timeframe required by applicable law (generally 30 to 45 days). You may authorize an agent to make a request on your behalf; we will verify the agent's authority and, where permitted, your identity.

13. International Data Transfers

We are based in the United States, and our service providers may process data in the United States and other countries. These countries may not offer the same level of data protection as your home country.

Where we transfer personal data out of the EEA, UK, or Switzerland, we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, as implemented in our agreements with our service providers.

14. Security

We use commercially reasonable administrative, technical, and physical safeguards to protect information, including encryption in transit (TLS), access controls, and reliance on established platform providers for backend infrastructure. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

15. Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the "Last Updated" date above. If we make material changes, we will provide additional notice, such as an in-app message or a notice on our website before the change takes effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy. Prior versions are available on request.

16. Contact Us

Summer Door Studios LLC
600 1st Ave Ste 330 PMB 81025
Seattle, WA 98104-2246
United States

Email: support@summerdoor.com

If you are in the EEA or UK, you may also contact your local data protection authority with concerns.