Privacy policy

1. Who we are and what this policy covers

Scribble Games Ltd is the controller of personal information described as handled by “we”, “us” or “Scribble Games”.

This policy covers our websites, WordBuzz, Nutty Words, Word Burst: Garden Party and Let's Draw! on Android and iOS, support requests, WordBuzz multiplayer, and our retained recovery and drawing service. We no longer release browser versions of the games.

Version scope: the current controls described below apply to Android releases published from September 2026 and to iOS WordBuzz 2.0.12, Nutty Words 2.0.08, Word Burst: Garden Party 2.0.09 and Let's Draw! 2.0.12 after the relevant update is installed, including test builds. Availability depends on App Store review and rollout. Earlier installed iOS releases are described in section 5.

Google and Apple separately control information in your platform account and information they use for their stores, game services and some advertising functions. See the Google Privacy Policy and Apple Privacy Policy.

2. What information is used, why and on what basis

We use “contract necessity” below for processing needed to deliver a feature you ask to use or take steps at your request (UK GDPR and EU GDPR Article 6(1)(b)). “Legitimate interests” means a necessary and proportionate use to operate, secure or improve the games after balancing it against your rights, with children's interests given particular weight. “Consent” means you have a genuine choice and may change it later. “Legal obligation” covers records or disclosures the law requires.

If you do not provide optional information

You can play the offline parts of the games without sending a drawing, using multiplayer, contacting support or consenting to personalised advertising. Without platform sign-in, cloud restoration, achievements and WordBuzz multiplayer will not work. Without a drawing upload, other people cannot continue that drawing. Refusing advertising consent does not block play; eligible contextual or limited ads may still appear.

3. Optional and legacy game features

Cloud saves

On Android, supported games use Play Games Snapshots. WordBuzz cloud saves contain progress, scores and word histories, inventory, entitlements, language, platform, app build and save time. New WordBuzz saves omit the Play Games identifier and retired internal, name, email, Facebook, friends, invitations, device and notification fields; names are also removed from saved high-score entries. The other current Android games similarly remove retired identity, social and device fields before uploading game progress. The listed iOS versions use Apple Game Center and iCloud for optional platform saves, with progress and purchase entitlements retained and retired name, email, social, device and notification fields excluded. Offline play does not require sign-in. WordBuzz and Garden Party report their existing achievements to Game Center; Nutty Words and Let's Draw! do not define separate achievement catalogues.

You can manage or delete Google-held Play Games information using Google's Play Games controls, and Apple-held information using your Apple account and iCloud controls. Removing platform data does not automatically remove a separate drawing, recovery or multiplayer record controlled by us.

Retained recovery service

Let's Draw! uses a random game identifier with our Google Cloud recovery service. A recovery link contains an obscured form of that identifier, so keep it private. Garden Party, Nutty Words and current WordBuzz progress do not use this recovery service.

Some historic records created by old releases contained names, email addresses, Facebook identifiers or tokens, device identifiers and push-notification tokens. Those uses have been retired. Current clients strip those fields from new saves and syncs. Historic recovery records are retained for recovery and have not been deleted as part of the iOS update. You can ask us to locate and delete a recovery record; because there is no real-name index, we need the recovery link or in-game identifier.

Let's Draw! shared drawings

Let's Draw! is a general-audience drawing game used by children and adults. Before first using online sharing, a player must accept the current Community Rules. The app shows a clear reminder before each upload or re-share, and it does not ask for a date of birth for drawing sharing.

When a player chooses to send a drawing, we store its pixels or drawing instructions, opaque drawing and artist identifiers, links to its chain, and technical details such as colours, orientation and contributor count. The server also uses a random, server-issued upload capability to authenticate uploads. We do not store a player's name, date of birth or a report narrative. This processing is necessary to provide the requested collaborative feature and enforce its safety rules.

Current Android releases also use Google Play Integrity and a Play-developer-scoped App Set ID to limit automated abuse of drawing uploads and recovery sync. Google checks that the request comes from the recognised, licensed app on a genuine device. Our server immediately hashes the App Set ID and uses only short-lived quota and replay-prevention entries, normally for no more than three minutes; it does not add the raw ID, integrity token or verdict to the game record or application logs. This security check is separate from advertising and is not used for profiling or marketing.

Shared drawings are public, shareable content. Anyone who receives a drawing link can open, continue, copy and pass it on, so a player should upload only something they are happy for other people to see. Recovery links are different and should be kept private because they restore game state. The app's Report drawing control sends the opaque drawing reference and a fixed objectionable-content reason; it does not ask for a name, account or free text. To prevent repeated reports from the same source, the service uses a one-way hash of the network address for 24 hours, then deletes it during the next daily cleanup (normally within another 24 hours). Reports from three distinct network sources within 24 hours automatically make the reported panel or panels unavailable while an authorised operator reviews them. The operator can approve or remove the content; unavailable content is automatically purged after 90 days. See the Community Rules.

You can request deletion using the drawing link or identifier. Removal may break the collaborative chain, and we cannot erase screenshots or copies already saved by somebody else.

WordBuzz multiplayer and rating

Multiplayer is optional, shows a one-time privacy notice, and requires Play Games authentication on Android or Game Center authentication on iOS. The client sends Google's one-time server authorisation code on Android or Apple's signed Game Center identity-verification payload on iOS, together with the platform player identifier and gamer name, over an encrypted connection. The server verifies sign-in, issues a random session identifier, and then uses that session identifier for match traffic. Your opponent sees the gamer name and game actions needed for the match, not the raw platform identifier.

The authorisation code is not stored as a profile. The raw identifier, gamer name and live match state are kept in server memory only for the active connection and are normally removed within about one minute after disconnection. The persistent record contains a salted, platform-specific hash of the player identifier, game mode and dictionary language, the public 0–1000 score, an internal matchmaking rating, completed-game count, update time and at most the latest 100 win, loss or draw outcomes for that mode and language. A bounded record of completed results uses salted game and player hashes and resulting ratings to prevent a retry from counting the same game twice. It does not contain gamer names, raw identifiers, words played or match transcripts. In-app Delete multiplayer data removes the authenticated player's scoped and older ratings and related retry records.

Matchmaking and the 0–1000 rating are automated, but they affect only game pairing and a displayed game score. They do not make legal or similarly significant decisions about you.

4. Advertising, consent and diagnostics

Advertising in the listed Android and iOS versions

The games use Google Mobile Ads (AdMob) to fund free play. Before the first ad request, the app asks the player to choose 12 or younger, 13–17 or 18 or older. This is a neutral age screen, not an adults-only restriction. Only the selected band is saved, on that device; we do not receive it, and the app does not ask for a date of birth for advertising.

For players who select 12 or younger or 13–17, the app gives AdMob child and age-restricted treatment. The app blocks Android advertising-ID transmission and does not request ATT or access Apple IDFA for those players, and the app serves contextual or limited advertising. For players who select 18 or older, the app permits consent-based personalised advertising, measurement and frequency capping where Google's consent message, the law and device settings allow. On iOS, Apple's App Tracking Transparency (ATT) permission is also required before access to IDFA; declining it does not prevent play or eligible contextual advertising. All age groups receive ads capped at Google's G content rating. No ad is requested until an age band is known.

Google and participating ad providers can receive an IP address to deliver an ad and estimate broad location, app and device details, an app-specific rotating SDK instance identifier, consent signals, ad impressions and clicks, diagnostics and anti-fraud signals. For eligible adult players this can also include the Android advertising ID or Apple IDFA and attribution or conversion reports; on Android it can additionally include supported Ad Services signals such as coarse on-device Topics. It is used for ad selection and personalisation where allowed, delivery, measurement, frequency capping, security, fraud prevention and legal compliance. These features remain subject to consent, device settings and Google's controls. We do not receive a list identifying individual players.

Where the law requires permission to store or access information on a device, ads are not requested on the basis of our legitimate interests: the app first relies on a valid consent signal or uses only a legally exempt operation. Google's User Messaging Platform supplies the available choices and identifies participating providers. You can reopen it through Privacy choices when Google makes that control available. Refusing or withdrawing consent does not remove access to the game.

We have switched off AdMob's optional programmatic limited ads setting. Google states that ordinary limited ads still use an IP address to transmit an ad and may cache SDK code or creative files, but the disabled programmatic option avoids its unconsented invalid-traffic cookie or local-storage mode. Security, transmission and strictly necessary processing rely on legitimate interests or the applicable storage/access exemption; consent is used where an exemption does not apply.

See Google's limited ads explanation, Google's ad technology provider information and Google's Privacy Policy.

Firebase Analytics and Crashlytics

Current Android releases use Firebase Analytics to understand, in aggregate, which screens and features are used, where tutorials or levels are started and completed, game results and scores, language choice, virtual-currency activity, purchases, sharing actions, multiplayer progress, loading performance, and automatic ad impressions, clicks and revenue. This helps us improve gameplay, difficulty, stability and advertising performance. We do not send player names, email addresses, platform or game account IDs, purchase order numbers, words entered, drawings, chat, support messages or free-form error text to Analytics.

Firebase can receive app and device details, IP-derived broad location, consent state, event time and parameters, and a rotating app-instance identifier when Analytics storage is allowed. For eligible adults it can also use the Android advertising ID where consent and device settings allow. If Analytics storage is refused, or for a player in either younger age group, the app keeps Analytics and advertising storage denied and Google may receive limited identifier-free consent-mode signals used for aggregate measurement. We rely on consent for device storage or identifiers where required, and otherwise on our legitimate interest in understanding aggregate use and improving the games without identifying individual players. Analytics is not used to rank players or make legal or similarly significant decisions.

Current Android releases and all four listed iOS versions use Firebase Crashlytics for crash and stability reports. It receives crash traces, app state, time, app and operating-system versions, device model and architecture, memory or storage state, installation identifiers and related diagnostics. WordBuzz releases already in circulation may attach a random legacy game identifier. We use this to diagnose reliability and security problems—legitimate interests.

The listed iOS versions do not enable Firebase Analytics. They use Crashlytics for stability, alongside the measurement provided by AdMob. Facebook/Meta, AccountKit, AppsFlyer, legacy Google Analytics for Apps and retired drawing-completion messaging integrations have been removed.

Google states that Crashlytics retains crash traces and associated identifiers for 90 days before starting removal from live and backup systems. See Privacy and Security in Firebase.

5. Older installed releases

iOS versions earlier than those listed in section 1 do not use all of the new privacy controls. Their behaviour remains relevant until the update is installed. Apple separately operates App Store, Game Center, iCloud, StoreKit and device-permission services.

These older iOS versions may still contain retired integrations, and some retired server-backed features in those binaries no longer work:

• Let's Draw! iOS: contains AdMob and Firebase Messaging/APNs code and may request notification permission or create a Firebase installation and push token. The old binary can still retrieve some existing recovery/drawing data, but new drawing uploads from it are rejected because it does not send the current sharing safeguards, and our server no longer sends its drawing-completion notifications.
• Nutty Words iOS: uses AdMob and Firebase Crashlytics. Its shared Firebase startup code may create a Firebase installation and messaging token even though the title does not use drawing-completion alerts.
• Garden Party iOS: uses AdMob. Its older binary contains Facebook configuration and retired Meta sign-in or Audience Network components. If still responsive and activated, Meta can receive device/ad interaction information or return the public profile, email and app-using-friends fields that the old version requested. See Meta's Privacy Policy.
• WordBuzz iOS: uses AdMob and an older Google Analytics for Apps integration configured for screens, events, purchases and exception reporting, including advertising-identifier collection where iOS and your permission allowed it.

Depending on the older title above, providers can receive IP address, app and device information, advertising or installation identifiers where platform permission allows, ad and app interactions, crash information, platform player details, purchase status, recovery game data, or a push token. Operating-system tracking, notification and advertising controls continue to apply. Install the newest version available to receive the current controls, and contact us if you want help identifying or deleting data from a particular version.

6. Who receives information and in what role

We may also disclose relevant information where law requires it, to protect rights or safety, or during a business reorganisation with appropriate confidentiality and data-protection safeguards. We do not disclose your email, credentials or payment details to other players. We do not rent personal information or operate as a data broker.

7. International transfers

Some providers process information globally. In particular, WordBuzz multiplayer runs in Google Cloud's us-east1 (South Carolina, United States) region, while Firebase Crashlytics and other global Google services can process data at Google facilities in multiple countries. Google Cloud customer data is covered by Google's Cloud Data Processing Addendum, which incorporates the relevant EU and UK controller-to-processor Standard Contractual Clauses. Other platform and advertising transfers follow the provider terms presented for that service and, where applicable, an adequacy regulation or decision.

We record and review the provider, destination, information, necessity and safeguards. You can email us for a copy of or link to the safeguard relevant to your information; legally protected commercial or security details may be redacted.

8. How long information is kept

• On-device data: until you reset the game, clear its storage or uninstall it. Device backups controlled by you or the platform may remain longer.
• Platform saves and profile information: according to your Google or Apple settings and their retention rules. Use the platform controls to delete it.
• Crashlytics: Google states a 90-day period before removal of crash traces and associated identifiers begins.
• Firebase Analytics: event and user-level Android Analytics data is configured for 14 months; aggregate reports can remain after that period. We periodically review the setting and delete or shorten retention when detailed history is no longer useful.
• Advertising and consent: according to the consent choices and disclosed provider retention periods. Consent records may be retained while needed to honour and demonstrate the choice.
• Support and privacy correspondence: only while needed to resolve the matter and maintain a necessary record, then deleted or anonymised; longer only for safeguarding, a dispute or legal duty.
• Purchases: entitlement information while needed to restore a purchase, and legally required accounting, tax, fraud or claims records for the applicable period, commonly up to six years.
• Recovery records: the random identifier and minimum game state are kept while existing recovery remains available, or until a verified deletion request. The recovery code or random game identifier is needed to locate the record.
• Let's Draw! drawings: while the requested collaborative feature operates or until a verified deletion request; reported or removed content stays unavailable and is purged automatically after 90 days. The drawing link or identifier is needed to locate it.
• WordBuzz multiplayer: identity and session data normally until about one minute after disconnection; scoped and older pseudonymous ratings and related retry records until authenticated in-app deletion or two years of inactivity, whichever comes first. Retry records are also capped at 10,000 completed matches. The rating file is not separately backed up.
• Our Google Cloud service logs: App Engine and Cloud Logging records are retained for 30 days. The WordBuzz virtual machine journal is capped at 30 days and 100 MB, whichever limit is reached first. A relevant entry may be isolated for longer only for a documented security incident, safeguarding matter or legal claim.
• Website delivery logs: the hosting and edge-security providers keep ordinary request/security data for their documented operational cycles. We do not add website analytics, create visitor profiles or retain a separate copy; an incident-specific extract follows the documented-incident rule above.

When a period ends, information is deleted, anonymised or isolated from ordinary use. Provider-managed rolling backups can expire later under the provider's deletion cycle. A minimal record may be retained where required by law or needed to establish, exercise or defend a legal claim.

9. Security

Measures include encrypted network connections, platform authentication, access controls, data minimisation, preventing advertising-ID transmission before an adult age band is selected, age-restricted ad treatment for younger players, random session identifiers, and salted hashing of multiplayer identifiers at rest. No internet service is completely secure, so keep recovery links private. Drawing links are deliberately shareable and may be passed on by anyone who receives them; contact us if you believe a link or service has been misused.

10. Your choices and data-protection rights

Depending on where you live and the circumstances, you may ask for access, correction, deletion, restriction or portability, withdraw consent, or complain to a regulator. Rights can be limited where an exemption applies. Withdrawing consent does not affect earlier lawful processing.

• Use Privacy choices in a game to revisit advertising and analytics consent choices when available.
• Use Android or iOS privacy, ads and notification controls for device-level choices.
• Use Play Games controls or your Apple account controls for platform-held information.
• Use Delete multiplayer data in WordBuzz settings to erase the authenticated server rating record.
• Email support@scribble-games.com for information controlled by Scribble Games.

Tell us the game and feature involved. If possible, include the in-game random identifier, recovery or drawing link, or relevant platform player identifier. Never send a password or authorisation code. We may ask for proportionate verification so we do not disclose or erase another person's information. We normally answer rights requests within one month, subject to lawful extensions.

12. Children

Our games are general or mixed-audience products and are likely to be accessed by children; none is child-only. The Android and iOS versions listed in section 1 use a neutral, local age-band choice before requesting an ad. Both younger age groups receive child age-restricted treatment, no advertising-ID transmission and G-rated contextual or limited ads. Adults can receive consent-based personalised ads and advertising-ID measurement. Android Analytics storage is denied for both younger groups: only limited identifier-free consent-mode measurement may be sent, and Analytics never receives their names, account IDs, entered words, drawings or messages.

Let's Draw! is for children and adults. A player must accept the Community Rules before first using online sharing, and the app warns that each uploaded drawing is public to anyone with its link. The drawing-sharing flow does not ask for or store a date of birth. Parents and guardians should supervise younger players' use.

We do not knowingly use children's information for our own direct marketing, sell it, enable public chat or offer friend search. WordBuzz multiplayer shows the platform gamer name to one opponent, so a child should use a non-identifying gamer name and ask a parent or trusted adult before using multiplayer. A child with sufficient understanding can exercise privacy rights; a parent or guardian may also contact us. Put “urgent safeguarding” in the email subject for an urgent concern.

13. Data-protection complaints

Email support@scribble-games.com with the subject “Data protection complaint”. You do not need to use legal language. We will record and investigate the complaint, acknowledge it within 30 days, keep you informed where the investigation continues, and communicate a reasoned outcome without undue delay.

If you are dissatisfied, you can complain to the UK Information Commissioner's Office or, where applicable, the supervisory authority where you live, work or believe an infringement occurred. Contacting us first is not a condition of contacting a regulator.

14. Changes to this policy

We update this page when the games, providers or legal duties materially change. The effective date and version identify the current notice. Where required, a significant new use will receive a prominent or in-app notice before it begins.

15. Contact us

Questions, rights requests, complaints and child-safety concerns can be sent to support@scribble-games.com or posted to Scribble Games Ltd at the address in section 1.