What we keep, and what we do not.

Who we are

WordQuest is the team behind this site and the studio, and we are the data controller for everything described on this page. Any question about it, or any request to see, correct or delete what we hold, goes to hello@wordquest.studio.

Who this is for

WordQuest is a tool for teachers, and accounts are for adults. Pupils do not sign in, have no accounts and are not recorded anywhere in the product. Please keep pupil names out of the words, titles and footers you type: they would be stored with the sheet, and there is no reason for them to be there.

What we store

• Your account. Your email address, your name and school if you fill them in, whether you have been verified as a teacher, and which method you sign in with. There is no password anywhere in WordQuest, so we never hold one. Signing in is a link we email you plus a six digit code the asking device shows, or a Google or Microsoft account if you prefer.
• Your puzzles. The title, topic, words, clues, grid, page settings and the school logo if you upload one. Work you do as a guest, before you have an account, never leaves your browser tab: it sits in that tab's own storage and is gone when you close it, unless you sign in, in which case it is saved to your new account.
• Teacher verification. If you apply to be verified, the school name and email domain you give us, and a photo of a staff card if you choose to send one. The photo is deleted thirty days after we decide.
• AI generations. When you ask the AI for words or clues, the topic and the words on the sheet go to the model provider. We keep the exact request and answer for thirty days so we can look into a bad clue or an abuse report, then they are deleted. Running totals of tokens, cost and response time are kept longer, with no wording attached.
• Payments. Your balance, the currency you topped up in, and a line for every generation and every payment: amount, bonus, tax, status, and the brand and last four digits of the card. Card numbers never reach our servers. Polar handles the card and tells us only whether it worked.
• Email we send you. The address, the subject and whether it arrived. The written message is kept thirty days, except sign-in emails, whose contents are never written down at all because they carry a live credential.
• Safety and support. Clues our filter catches or you report, and notes our support staff write while helping you.
• Staff actions. When one of our staff looks at or changes something on an account, that action, who did it and the IP it came from are written to an audit log. It is how we can tell you what happened to your account if you ever ask.
• How the site gets used. If you agree to it, Google Analytics records which pages you open, how you arrived, what browser and device you are on and roughly which country you are in. We read it as counts. It is never joined to your account, your email or your puzzles.

Advertising, analytics and tracking

We use Google Analytics, and only to answer two questions: how many people find the site, and whether teachers come back to it. It tells us which pages get opened, where visitors arrive from, what browsers and devices are in use and roughly which country someone is in. We look at all of that as numbers. It is not joined to your account, and your email address, your topics, your words and your puzzles are never sent to it.

It only runs if you agree to it. You are asked the first time you arrive, nothing is set until you say yes, and saying no costs you nothing: every part of WordQuest works the same either way. If you have an account there is a switch on your account page, and you can change your mind on it as often as you like.

Google's advertising features are switched off on our property. There is no remarketing, no Google Signals, no advertising identifiers, and nothing we collect is shared with Google's advertising products. Beyond that: we do not advertise, we do not fingerprint your device or build a profile of you, no decision about you is made automatically, and we never sell your data or hand it to anyone for their own marketing.

Cookies and local storage

• A session cookie once you sign in, so the studio knows it is you. It lasts until you sign out or it expires.
• A short lived cookie called wq_signin, set while you are signing in. It ties the six digit code to the device that asked for it, so a link opened on a different device cannot sign you in. It lasts ten minutes.
• Your browser's own session storage, which holds guest work in the tab and nothing else.
• Two Google Analytics cookies, _ga and one beginning _ga_, which tell one visit from the next. They last two years and they are the only ones you have a choice about. They are not set unless you agree, and turning analytics back off deletes them.

The first three are how you get signed in and how your work survives a reload, so there is no asking you about them. The analytics pair is the only optional thing on the site, and it waits for your answer.

Who else handles it

We keep the list short, and everyone on it is contracted to use your data only to do the job we hired them for.

• Northflank runs the service behind the studio, and holds the database and the uploaded logos and staff card photos with it.
• Cloudflare delivers the site, the studio and the console to your browser, and delivers sign-in and account email.
• Polar takes payments and holds the card details.
• A large language model provider receives the topic and words when you ask for a generation, and nothing else. Which provider we route to can change as models improve. Ask us at hello@wordquest.studio and we will tell you who it is today.
• Google Analytics (Google Ireland Limited) counts visits, if you agreed to it.
• Google or Microsoft, only if you choose to sign in with one of them, and then only to confirm who you are.

Where it is kept

Our servers are in Singapore. If you are in the UK or the EEA, that means your data leaves it. We rely on the UK International Data Transfer Addendum and the EU standard contractual clauses with each of the companies above, Google among them, and we do not send your data anywhere beyond them.

How long we keep it

• Your account and your puzzles: until you delete them. Deleting your account makes your puzzles unreachable straight away and erases them thirty days later.
• AI requests and answers: thirty days.
• Staff card photos: thirty days after the verification decision.
• The text of emails we sent you: thirty days. The record that we sent one: twelve months.
• Our staff audit log: twenty four months.
• Analytics: Google holds the visit-by-visit data for up to fourteen months. The totals we read outlive it, and they are counts with nobody in them.
• Payments and receipts: kept after you leave, because tax and accounting law requires it. They are records of money, not of what you made.

Why we are allowed to hold it

Under the UK and EU GDPR, our grounds are these.

• Performing our contract with you: running your account, storing and rendering your puzzles, generating words when you ask, and taking payment.
• Our legitimate interests: keeping the service up, stopping abuse, checking the quality and safety of AI output, and being able to reconstruct what happened to an account.
• Legal obligation: keeping payment records for tax.
• Your consent: analytics, and sending us a staff card to be verified. Both are yours to withdraw whenever you want: the analytics switch is on your account page, and we delete the photo as soon as you ask.

What you can ask for

You can ask to see what we hold, have it corrected, have it deleted, have a copy in a portable form, restrict what we do with it, object to our legitimate interests, or withdraw a consent you gave. Three of those you can do yourself without asking: your account page exports every puzzle you have made as a zip, turns analytics off, and deletes your account outright. For anything else, write to hello@wordquest.studio and we will answer within thirty days.

If we get it wrong, you can complain to a regulator. In the UK that is the Information Commissioner's Office. In the EEA it is the supervisory authority where you live or work.

Children

WordQuest is not for children and we do not knowingly hold any child's data. Accounts are for the adult making the worksheet - a teacher or a parent - aged sixteen or over. Pupils never sign in, and a worksheet is printed on paper and handed out by you, which is the point. If you think a child has made an account, tell us at hello@wordquest.studio and we will remove it.

If this page changes

The date at the top moves and, when the change is one that matters, we email everyone with an account before it takes effect. See also the terms of use.