Privacy Policy

1. Who we are and what this covers

Word Operative is a free word unscrambler and puzzle-solving site operated by Operative Enterprise, LLC (“we”, “us”, “our”). This policy covers the website at wordoperative.com and everything on it — the unscrambler, the Jumble and Spelling Bee solvers, the Training Center, and any account or paid feature we offer.

For visitors in the European Economic Area and the United Kingdom, Operative Enterprise, LLC is the data controller for the information described here — meaning we are the ones who decide what is collected and why, and the ones you can hold to account for it.

This policy does not cover other companies' websites, including any site you reach by clicking an advertisement. See Links to other sites.

2. Information you give us

Letters and words you type into the solvers

When you use the unscrambler, the Jumble Solver or the Spelling Bee Solver, the letters you enter are sent to our server so it can work out the answers. These pages are built to work without JavaScript, which means your letters travel in the web address itself — a search for the rack retinas produces a URL containing retinas. That address is recorded in our server logs alongside the request, as described in the next section.

We treat these as puzzle input, not as anything about you: we do not build a profile from them, we do not link them to your account if you have one, and we do not use them to target advertising.

Account information

Accounts are optional and only needed for features that require one. When you create an account we collect your email address and a password. The password is stored only as a cryptographic hash — a scrambled form that cannot be reversed back into your password — so nobody at Word Operative can read, recover or tell you what your password is. We also keep basic account records such as when the account was created, when you last signed in, and whether the ad-free upgrade is active.

Messages you send us

If you use our contact form or email us, we receive whatever you choose to put in it — typically your name, your email address, and the content of your message. We use it to answer you and to keep a record of the conversation. Please don't send us sensitive personal information through the contact form; it is a support channel, not a secure one.

When you submit the contact form we also record the IP address and browser user-agent the submission came from, alongside the message itself. This is used only to limit how many messages a single sender can submit and to block abuse; it is not used to profile you, is never shared, and is deleted along with the message under the retention period below. Our lawful basis is legitimate interests — keeping a public form usable by preventing automated abuse of it.

Payments for the ad-free upgrade

Payments are handled by an independent, established payment company — we will name it here before the paid upgrade launches. Your card number, expiry date and security code go directly to them and never touch our servers. We cannot see them, store them, or use them.

What we do receive back is a confirmation message (a “webhook” — an automatic notification sent computer-to-computer) telling us that a payment succeeded, failed, renewed or was cancelled, along with an identifier that lets us match it to your account and, in some cases, the billing country and the last four digits of the card for our own records. That is enough for us to switch the ads off for you and to support you if something goes wrong. The payment company handles your payment details under its own privacy policy.

3. Information collected automatically

Server logs

Like effectively every website, our servers keep a record of requests they receive. Each entry typically contains:

• your IP address (the network address your connection comes from, which gives a rough idea of your city or region — not your street address);
• the date and time of the request;
• the page or web address requested, including any letters you searched for;
• the referring page, if you arrived by clicking a link;
• your browser and operating system (the “user agent”); and
• the response our server sent, such as success or error.

We use these logs to keep the site running, diagnose faults, and detect abuse such as automated scraping or attacks. We do not use them to build advertising profiles.

Device and connection information

Our pages adapt to your screen, and your browser reports things like window size and language as a normal part of loading a page. We do not record this to identify you, and we do not attempt device fingerprinting — the practice of combining such details into a hidden identifier that follows you without a cookie.

4. Cookies and similar technologies

A cookie is a small file a website asks your browser to store and hand back on your next visit. Some are necessary for a site to function at all; others exist to track and target you. Here is every kind we use or expect to use, and what each one is for:

You can delete existing cookies and block future ones in your browser's settings. Blocking all cookies will not stop the solvers working, but it will stop you being able to stay signed in.

5. Advertising

Word Operative is free to use and paid for by advertising. We use Google AdSense to display ads.

• Google, as a third-party vendor, uses cookies to serve ads on this site.
• Google's use of advertising cookies enables it and its partners to serve ads to you based on your visits to this site and other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can opt out of personalised advertising by many other vendors at optout.aboutads.info or optout.networkadvertising.org.
• Opting out stops ads being personalised. It does not remove ads — you will still see them, chosen without reference to your browsing history.

We do not give Google the letters you search for, your email address, or anything else you type into this site. What ad networks see is the ordinary information any embedded content receives: the page the ad appears on, your IP address, your browser, and their own cookies.

If you are in the EEA or the UK, we ask for your consent before advertising or analytics cookies are set, through a consent notice on your first visit. You can change your mind at any time using the same notice, and ads will still appear either way — without consent, they are non-personalised.

If you would rather have no ads at all, the paid ad-free upgrade removes them.

6. Analytics

We use Google Analytics to understand how the site is used — how many people visit, which solvers get used, which pages fail people, and roughly which country visitors come from. This is reported to us in aggregate: we look at totals and trends, not at individuals, and we do not try to identify anyone from it.

Google Analytics sets its own cookies and receives your IP address, the pages you view, and general device information. You can prevent it entirely with the Google Analytics Opt-out Browser Add-on, by declining analytics cookies where we ask for consent, or by blocking cookies in your browser.

7. How we use information

We use what we collect only for these purposes:

• To answer your puzzle. Your letters go in, the words come back.
• To run accounts. Creating your account, signing you in, resetting your password, and remembering whether the ad-free upgrade is active.
• To process payments for the ad-free upgrade and keep the records a business is required to keep about its sales.
• To reply to you when you contact us.
• To send transactional email only — password resets, receipts, and notices about your account or a change to these terms. We do not send marketing email and do not have a mailing list.
• To keep the site working and secure — fixing faults, and detecting abuse, scraping and attacks.
• To improve the site using aggregate analytics.
• To show advertising, as described above.
• To comply with the law and to establish, exercise or defend legal claims.

We do not use your information to make automated decisions that produce legal or similarly significant effects about you.

8. Legal bases (EU/UK visitors)

If you are in the EEA or the UK, data protection law requires us to have a specific legal reason for each use of your information. Ours are:

9. Who we share information with

We do not sell your personal information for money. We share it only in these situations:

• Service providers who run parts of the site for us — our hosting provider, our payment company, our email delivery provider, and Google for advertising and analytics. Each receives only what it needs to do its job and is not permitted to use it for its own unrelated purposes, except as described for advertising below.
• Advertising partners, as described in Advertising.
• When the law requires it — in response to a valid legal request, or where we must act to protect the rights, safety or property of our users, the public or ourselves.
• If the business is sold or transferred, information may pass to the new owner as part of that transaction. We would say so here before it took effect.

A note for California and other US state residents: some state privacy laws define “sale” and “sharing” broadly enough that letting an advertising network set cookies for personalised advertising counts as one, even though no money changes hands and we receive nothing for it. To be straightforward about it: we treat our use of advertising cookies as sharing for cross-context behavioural advertising, and you can opt out using the links in Advertising, by enabling Global Privacy Control in your browser, or by buying the ad-free upgrade. We honour Global Privacy Control signals as opt-out requests. We have never sold personal information for money, and we do not sell or share the personal information of anyone we know to be under 16.

10. How long we keep things

11. How we protect information

The whole site is served over an encrypted HTTPS connection, so what passes between your browser and our servers cannot be read in transit. Passwords are stored as salted cryptographic hashes using Django's standard password handling, never as readable text. Access to the server and its data is limited to people who need it. Card details never reach us at all.

No system is perfectly secure, and we would be misleading you to claim otherwise. If a breach ever affects your personal information, we will notify you and the relevant regulators as the law requires.

12. Your rights and choices

Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it, and you can close your account at any time. We do not limit these to the places where the law compels them.

If you are in the United States

California, Colorado, Connecticut, Virginia and a growing list of other states give residents rights to know what is collected, to access and delete it, to correct it, to obtain a portable copy, to opt out of sale, sharing and targeted advertising, and not to be discriminated against for exercising any of them. We extend all of these to every US visitor rather than checking which state you are in.

If you are in the EEA or the UK

You have the rights to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interests. Where we rely on consent, you may withdraw it at any time without affecting what was done beforehand. You also have the right to complain to your national data protection authority — in the UK, the Information Commissioner's Office.

How to exercise any of them

Use our contact form, choose “Privacy or data request”, and say what you want. We will reply within 45 days (or one month for EEA/UK requests) and will tell you if we need more time. We may need to verify that the account is yours before acting — usually by emailing the address on the account. You can use an authorised agent where the law allows it. Exercising these rights costs nothing and will never get you a worse version of the site.

Do Not Track: browsers vary in how they send this signal and there is no agreed standard for honouring it, so we do not respond to Do Not Track headers. We do honour Global Privacy Control, which is a recognised opt-out signal.

13. Children

Word Operative is a general-audience site intended for adults and older students. It is not directed at children under 13, and we do not knowingly collect personal information from them. Accounts require you to be at least 13 (or 16 in the EEA and the UK, where local law sets that threshold).

If you are a parent or guardian and believe your child has given us personal information, tell us through our contact form and we will delete it promptly.

14. Visitors outside the United States

We operate from the United States and our servers are located there, so using this site means your information is transferred to and processed in the US, where privacy laws differ from those in your country. For transfers of EEA and UK personal data, we and our providers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) or another approved safeguard.

15. Links to other sites

This site links to other websites — dictionary and word list sources on our Data Credits page, the opt-out tools named above, and the sites behind any advertisement. Once you follow a link, you are on someone else's site under someone else's privacy policy, and we have no control over what they collect. We would encourage you to read theirs.

16. Changes to this policy

We will update this policy when what we do changes — for example, when the paid upgrade launches and we can name the payment company. When we do, we will change the “Last updated” date at the top. If a change materially affects your rights or how we use your information, we will give you clear notice on the site before it takes effect, and email account holders where the change is significant.

17. How to contact us

Questions about this policy, or a request about your information:

Our Terms of Service govern your use of the site alongside this policy.