Privacy.

The short version

Syllafall does not run adverts, does not sell anything, and does not sell or share your data with anyone for marketing. There is no advertising SDK and no third-party analytics SDK in the app. To play, you need an account, so there is an email address and a username. To keep the leaderboards honest, the server records how each round was played and replays it. That is most of it.

The rest of this page is the detail, written out properly because a summary is not a policy.

Who we are

Syllafall is made by Will Kilgallon, a sole trader based in the United Kingdom, trading as Syllafall. For data protection law, that person is the data controller for both this website and the app.

You can reach us at privacy@syllafall.com. A postal address is available on request.

What the app collects

Your account

Accounts are handled by Clerk, our sign-in provider. Depending on how you sign in, that means your email address, your name, and your profile photo if you use Google, Apple or Facebook. Your profile photo can only ever come from the sign-in provider. It cannot be uploaded, which is a deliberate safety decision.

On top of that you choose a username and, optionally, a display name and a colour. The game also generates a friend code so people can add you.

How you play

Every scored round stores the score, the board it was played on, and the sequence of words you swiped. That sequence matters: the server replays your round through the same game engine your phone used and checks that the score it computes matches the score you submitted. Rounds that fail that check are left out of leaderboards and standings. This is the anti-cheat system, and it is the main reason gameplay is recorded at all.

Friends and challenges

Who you are friends with, the challenges you send and receive, and anyone you have blocked or reported. Reports are reviewed so that profile photos and names stay safe to look at.

How the game is used

Two things, both first-party, both stored on our own servers with no third-party SDK involved. First, one record per day that you play, which is how we count how many people are playing. Second, an event when you share or save a results card, noting which mode it came from, whether you shared or saved, which card format, and which daily puzzle number. Nothing about the content of a share is recorded.

What this website collects

• The waitlist. If you sign up, your email address and, where it is present in the link you arrived from, a short note of where you came from. Sign-ups are confirmed by email before you are added to the list, and every email we send has an unsubscribe link.
• Aggregate analytics. The site uses Vercel Analytics and Speed Insights to count page views and measure loading performance. It records one custom event, when a waitlist sign-up succeeds, and that event carries no information about who you are.
• Request logs. Standard web server records, including IP address, which are also used to stop the waitlist form being flooded.

What we do not do

• No advertising, and no advertising SDK anywhere in the app or the site.
• No tracking across other apps or websites, so the app never shows the "ask app not to track" prompt.
• No selling or renting of personal data, ever.
• No purchases. Coins are earned by playing and cannot be bought, so we never see payment details.
• No automated decisions that have a legal or similarly significant effect on you.

Why we are allowed to hold it

Under UK GDPR every use of your data needs a lawful basis. Ours are these. Running your account and the game itself is necessary to provide the service you asked for. Anti-cheat checking, keeping blocks and reports working, and counting how many people play are our legitimate interests in running a fair game that we can keep online. Waitlist email is sent on the basis of your consent, which you can withdraw at any time by unsubscribing.

Who else handles it

These are the companies that process data on our behalf. They may only use it to provide their service to us.

Where your data goes

Some of the companies above are based in the United States. Where data leaves the UK or the European Economic Area, it is protected by the safeguards those transfers require, such as the UK addendum to the standard contractual clauses or an adequacy decision.

How long we keep it

Your account and its gameplay history stay while your account exists. Delete the account and they go with it. Waitlist email addresses are kept until you unsubscribe or until the launch mailing list is retired, whichever comes first. Aggregate analytics and web server logs are short-lived and are not tied back to your profile.

Your rights

You can ask for a copy of your data, ask us to correct it, ask us to delete it, ask us to restrict or object to how we use it, and ask for it in a portable format. Email privacy@syllafall.com and we will respond within one month.

Deleting your account is the fastest route, and you can do it yourself: how to delete your account.

If you think we have got something wrong, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can fix it.

Age

Syllafall is for players aged 13 and over, and 16 and over in the United Kingdom and the European Economic Area. It is not designed for children and we do not knowingly collect data from anyone below those ages. If you believe a child has an account, email us and we will remove it.

Changes to this policy

If this policy changes in a way that matters, the date at the top changes with it and anyone with an account is told in the app. Small corrections to wording are made quietly.