Privacy

Last updated 17 October 2026

Letterly is a free daily word game you play in the browser. You do not need an account. This page says exactly what the game keeps and where it goes, in plain English, because most privacy pages are written to not be read.

What stays on your device

Your streak, your round history and your preferences.
A random player ID, created in your browser the first time you play, so the game can recognise your own results. It is not linked to your name, email or anything else unless you choose to sign in (below).

Settings → Data → Reset all data wipes everything on the device. Clearing your browser storage does the same. If you play on a phone that clears site data after a while, the game offers a restore code so you can get your identity back on a new device; the code is just a handle for that random ID.

What leaves your device when you play

When you submit a round, the game sends:

your ten answers and the date of the round;
your random player ID, so the round counts as yours on the leaderboards;
a two-letter country code, for the country leaderboard. The server takes it from Cloudflare, which estimates the country from the IP address your connection comes from. Your browser also sends a guess based on its language setting, and that is used only if Cloudflare's is missing. Only the two letters are kept with your round. It is not your location: no GPS, no address, and it can be wrong.

Scores, leagues and leaderboards are worked out from those submissions on our own server in the UK. Nobody else sees your player ID.

Your random player ID works through a sign-in session with our server, even if you never give an email address. Like most sign-in systems, that session records the IP address and browser type (the "user agent" your browser reports) it was used from. We do not use them for anything, and they are kept for 30 days.

Your answers are checked by Google's Gemini

Whether "Kat" counts as a cat is decided by an AI model, Gemini, run by Google. The game sends it only the day's letter, the category names, and the answer text. No player ID, no country, nothing about you. Verdicts are cached so the same answer is only ever checked once, and the cache holds the answer text, not who wrote it. Google's handling of API requests is covered by its own terms, which is why this is spelled out here.

Things that only happen if you opt in

Friend leagues. Joining one stores the display name you type and which league you are in. Other members see that name and your scores, never your player ID.
Daily reminder. Turning on notifications stores a push subscription (an address and keys your browser generates) so the game can nudge you once a day. Turn it off in Settings and it is deleted.
Email sign-in. If you choose to sign in, your email address is stored so the same progress can be found on your other devices and in other Cyber-Jack games. Skip it and no email is ever collected.
Where you came from. We store the website that sent you (just the site name, e.g. listdle.com, or a campaign tag in the link), to see which sites send players. It is saved with each round you play and, once, as the site that first sent you, alongside your random player ID. No full links, no IP address. It also appears in the private notification that tells us a round was played. Nothing is saved on your device for this.
Supporter question. If you answer "would you sign up for Letterly Supporter?", the server stores your answer (monthly, yearly or no thanks), the date, which screen you answered from and your random player ID, so the same answer is not counted twice. No payment details are asked for and nothing is charged.
Analytics. Google Analytics runs only if you accept the cookie prompt, and with IP anonymisation on. Decline it and nothing is sent to Google Analytics at all.

Rate limiting

To stop one machine spamming thousands of rounds, the server counts submissions per IP address per day. Those counters are deleted after seven days and are used for nothing else. Practice rounds are limited per player per day with a counter kept against your random player ID, which is deleted after two days.

Who can see what

Public: on leaderboards, a country flag and scores. Inside a friend league, the display name you chose.

Nobody: your player ID, your email if you gave one, and your push subscription. These are never shown, shared or sold. There are no adverts and no data brokers.

Where it is kept

On a server we run ourselves in the United Kingdom. Traffic passes through Cloudflare, which sees connection details the way any network provider does. Answer checking goes to Google's Gemini API as described above.

Deleting your data

Everything on your device: Settings → Reset all data. Everything on the server: email [email protected] from the address you signed in with, or include your restore code, and your submissions, league memberships and any sign-in record will be deleted within a few days. We need one of those two to know which player is you, because we hold nothing else that identifies you.

Children

The game asks for no personal details and is suitable for all ages. If you believe a child has signed in with an email address, use the address above and it will be removed.

Changes

If this page changes in a way that matters, the date at the top changes and the game's "What's new" panel will say so.