Word Search Generator
Privacy & data use
A plain-language overview of what Word Search Generator handles when you create, play, share, list, or print a puzzle. This describes current app behavior; it is not a jurisdiction-specific legal opinion.
Saved puzzle information
When you save a puzzle, the app stores its title, category, word list, generated grid, public listing state, and creation time. Ordinary creators and players do not need an account. Publicly listed puzzles can appear in Browse; unlisted puzzles are not in public listings but can still be opened by anyone with the share URL.
The creator edit token is kept in that browser’s local storage, while a hash of the token is stored server-side. Clearing browser storage may remove the browser’s ability to manage that puzzle. A creator can permanently delete a puzzle from its owner controls; deletion removes it from public listings and makes its share URL stop working. Turning off public listing alone does not delete the puzzle or disable its share URL.
Saved puzzles do not have an automatic expiration date configured in the app.
The app runs on Replit infrastructure, and its database stores saved puzzle records. See Replit’s Privacy Policy for information about its platform services.
When you list a puzzle publicly or share its URL, information in the puzzle may be visible to people who can access that listing or link. Avoid putting sensitive information in a title or word list.
Analytics
When configured, PostHog analytics runs only on the production site. It records page views and selected puzzle actions, such as generating, playing, sharing, completing, or printing a puzzle. Event details can include grid size, word count, and limited action or visibility information; they do not include puzzle titles or word text. Puzzle URLs are sanitized before being sent.
The app disables automatic click capture and session recording, uses session storage for PostHog session persistence, respects browser Do Not Track, and excludes admin routes. To opt out in this browser, open this privacy page with analytics=off; the preference is saved locally.
Advertising
Ads may be served by third-party advertising partners on production pages when advertising is configured. Depending on consent settings, the page may wait for a consent signal before loading ads. Advertising partners may process information through their own services and partners; review the privacy notices and controls provided with the advertising service.
Admin access and abuse prevention
Clerk provides verified-email sign-in for authorized site administrators only; ordinary puzzle creators and players do not need a Clerk account. See Clerk’s privacy policy.
To help limit abuse, the server uses a keyed hash of the request IP address for rate-limit counters. Those counters expire after their rate-limit window. This describes the rate-limit mechanism, not all processing that may happen in hosting or provider systems.
This is an operational overview of current app behavior, not a promise about every provider’s systems or a substitute for a legal notice tailored to your jurisdiction.