Word Play ("the service", "we") is a language-learning platform (English, Spanish, French) based in Catalunya, Spain. This policy explains what personal data we collect, why we collect it, and your rights under the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Spanish Ley Orgánica 3/2018 (LOPDGDD).
Until formal business registration is complete, Word Play is operated by an individual (Em) based in Catalunya, Spain, at the contact address above. This section will be updated with full legal entity details as soon as registration finishes — no other part of this policy depends on that.
| Data | Purpose | Legal basis |
|---|---|---|
| Email address | Account login, password reset, service emails | Contract (Art. 6(1)(b)) |
| Password (hashed, PBKDF2) | Authentication | Contract (Art. 6(1)(b)) |
| First name (required) | Personalise the experience, greetings | Contract (Art. 6(1)(b)) |
| Native language (required) | Route you to the right course | Contract (Art. 6(1)(b)) |
| Last name, date of birth, gender, country of birth, country of residence, phone number, other languages spoken, self-assessed level, learning goal (all optional) | Personalise your course further; date of birth is also used to apply age-appropriate safeguards (see Section 8, Children) | Consent (Art. 6(1)(a)) — you choose whether to provide these |
| Progress (chapter scores, XP, streak, mistake log) | Show your progress, enable cross-device sync, power the weak-spots review feature | Contract (Art. 6(1)(b)) |
| Lesson bookings | Schedule private lessons with the teacher | Contract (Art. 6(1)(b)) |
| IP address | Rate-limiting to prevent abuse | Legitimate interests (Art. 6(1)(f)) |
| Cloudflare infrastructure logs | Security and uptime monitoring (processed by Cloudflare) | Legitimate interests (Art. 6(1)(f)) |
| Error reports (Sentry) — technical data only (browser, stack trace); PII is scrubbed before sending | Fix bugs before they affect other students | Legitimate interests (Art. 6(1)(f)) |
| Product analytics (PostHog) — pages visited, features used | Understand what's working, improve the course | Consent (Art. 6(1)(a)) — only after you accept the cookie banner; see Section 3 |
We use two categories:
localStorage. This is functional storage needed for
the service to work, including offline. Exempt under the ePrivacy Directive.Word Play is currently free to use. A donation link may be shown to support running costs; donation platforms process their own payment data under their own privacy policy, not ours. If paid subscription tiers are introduced in the future, this section will be updated before they launch, naming the payment processor (e.g. Stripe) and what payment data it handles — Word Play itself never stores card details.
Account data is retained while your account is active. You can delete your account at any time (see Section 9). Rate-limiting logs are purged automatically after 24 hours. After account deletion, backups are removed within 30 days.
Cloudflare, Sentry, and PostHog process EU-region data primarily within the EU/EEA. Where any provider transfers data outside the EEA, they rely on Standard Contractual Clauses (SCCs). See Cloudflare's, Sentry's, and PostHog's privacy policies.
Word Play welcomes learners of all ages, including children and teens, with extra protection for younger users. Spanish law (LOPDGDD) sets the digital age of consent at 14; because Word Play serves learners across the EU where the GDPR default is 16, we apply the single, more protective threshold of 16 everywhere, to keep the rule simple and consistent.
To exercise any right (including a parent/guardian acting for a minor), email emi.dom123@gmail.com. We respond within 30 days.
Material changes will be notified by email at least 14 days in advance. The "Last updated" date at the top of this page indicates the current version.