This policy explains what information Wham Bam collects, why we collect it, and what you can do about it. It applies to the game at whambam.games and to our mobile apps.
Nothing that identifies you. Your chosen game settings, free-word counters and local score history are stored only on your own device, in your browser's local storage. We cannot see them, and clearing your browser data erases them.
| Information | Why we need it |
|---|---|
| Email address | To create and secure your account, confirm it is yours, and let you reset your password |
| Nickname | To show who you are on the leaderboard (you can change it, or hide from the leaderboard, in your account) |
| Password | Stored only as a cryptographic hash — we never see or keep the password itself |
| Game results | Scores, rounds played and decks used, so your progress and leaderboard position follow you between devices |
| Purchases | Which pass you bought, for which category, its order reference and expiry date, so your purchase unlocks on every device you sign in on |
Google shares your email address, name and profile picture with us. We use only your email address to identify your account; your Google name and picture are not shown on the leaderboard. We do not receive your Google password and we have no other access to your Google account.
Payments on the website are handled entirely by Xsolla, our payment partner and merchant of record. In the iPhone and Android apps they are handled by Apple or Google, and RevenueCat confirms the store purchase to us. Card numbers never reach our servers. We receive confirmation that the payment succeeded and a transaction reference; we store that with the pass you bought and its expiry date, so we know what to unlock for you.
If you switch on voice commands, the game asks for microphone and speech recognition permission. What your team says is turned into text by your device's speech recognition service — Apple on iPhone, Google on Android, or your browser on the website — which may process the audio on its own servers under its own privacy terms. Wham Bam only reads the resulting text to spot words like "correct" or "skip" during a round. We never record, store or receive audio or transcripts.
Tilt controls read your phone's motion sensors to detect a tilt. That data is used on your device only and is never sent anywhere.
Our hosting provider records standard server information such as IP address, browser type and pages requested, for security and to keep the service running.
We use Cloudflare Web Analytics to understand how the website is used: how many visits it gets, which pages are viewed, which sites and countries visitors come from, the type of device and browser, and how quickly pages load. We use these totals to improve the game and keep the site fast.
Cloudflare Web Analytics does not use cookies, local storage or any other way of recognising you, does not follow you across other websites, and is not used for advertising. It reports only totals, never an individual visitor's activity. Because it does not identify you or store anything on your device, it runs whichever option you choose on the privacy bar. We rely on our legitimate interest in running and improving the website. It is only used on the website, not in the mobile apps.
The free iPhone and Android apps show a short ad between some rounds, served by Google AdMob. AdMob may use your device's advertising identifier, IP address and general device information to serve and measure ads. On iPhone the app asks permission first, and if you decline, ads are not personalised. In the UK and EU you are shown a consent choice before any personalised ads. All Access buyers see no ads. You can reset or limit your advertising identifier in your phone's settings.
The free website shows a short ad between some rounds, and an optional ad you can choose to watch for more free words, served by Google AdSense. Google may set cookies and use your IP address and browser information to serve, cap and measure ads. Ads are not personalised unless you choose "Accept all" on the cookie bar; in the UK and EU Google may also ask for your consent. All Access buyers see no ads. You can learn more and control ad personalisation at adssettings.google.com.
If the app crashes, Firebase Crashlytics sends a crash report (device model, operating system version, app version and the technical details of the crash) so we can fix it. Anonymous usage statistics through Firebase Analytics, such as which decks and game modes are played, are only switched on if you choose "Accept all" in the app's privacy choice.
We use a small number of third-party services. Each one only receives what it needs to do its job.
| Service | What it does | What it sees |
|---|---|---|
| Supabase | Accounts, authentication and database | Email, display name, scores |
| Hostinger | Website hosting and outgoing email | Email address, server logs |
| Cloudflare | Website delivery and security, and website visit statistics (Web Analytics) | IP address, browser and device type, pages visited, referring site — used only to produce totals |
| Xsolla | Payments on the website (merchant of record) | Billing details you give it directly; your account ID |
| Apple / Google | Payments in the mobile apps | Billing details you give them directly |
| RevenueCat | Confirms app-store purchases to us | Your account ID, store purchase records |
| Optional "Sign in with Google" | Only what you approve when signing in | |
| Google AdMob | Ads in the free mobile apps | Advertising identifier (if allowed), IP address, device information |
| Google AdSense | Ads on the free website | Cookies, IP address, browser information |
| Google Firebase | Crash reports, and usage statistics if you opt in | Device and app information, crash details, gameplay events |
The website uses Google AdSense advertising cookies to show and measure ads; they are only used for personalised ads if you choose "Accept all". The mobile apps use an advertising identifier for ads, as described in section 2.
Where consent is required in your region, we ask before storing anything that is not strictly necessary, and you can change your answer at any time from the game's menu.
Wham Bam is a party game for all the family, and anyone can play as a guest without giving us anything.
Accounts, purchases and personalised ads are for players aged 13 and over. Before any of them, the game asks for your month and year of birth, once on each device. We keep only the answer "13 or over" or "under 13" on your device; we do not store your date of birth. If you are under 13:
Until a player has answered the age question, ads are treated the same way as for a child. If you believe a child under 13 has created an account, contact us and we will delete it promptly.
Depending on where you live, you may have the right to:
You can delete your account yourself in the game (Account > Delete account) or at whambam.games/delete-account.html. For anything else, email us at the address below. We will respond within 30 days.
Traffic to and from the game is encrypted. Passwords are stored only as hashes. Access to production systems is restricted to the people who run the game, including contractors who develop it, and only for running and supporting it. No system is perfectly secure, but we take reasonable steps to protect your information and will tell you if a breach affects you.
Our providers may process data in countries other than yours. Where that happens, we rely on the safeguards those providers put in place for international transfers.
If we change this policy we will update the date at the top. Significant changes will be announced in the game.
Privacy questions, data requests and account deletion:
[email protected]