Lexble is a word game. We keep data collection to the minimum that makes the game work — nothing else.
Who we are
Lexble is operated by Crilotech, an independent studio based in the United Arab Emirates. Crilotech is the data controller for the personal data described below.
What we store
Playing as a guest. We assign your device an anonymous identifier stored locally (browser localStorageon the web, secure on-device storage on mobile). This lets you rejoin an Arena room after a refresh without losing your seat. We don't read anything else from your device.
Signed-in accounts. If you sign in we store your email address and a username so you can appear on the leaderboard. Sessions are kept in an essential authentication cookie (web) or a secure on-device token (mobile).
Gameplay data. When you complete a daily or Arena run we store your score, the words you found, the path of each word on the grid, and the time you took. This is what powers the leaderboard and your streak.
Sign-in methods
On the web you can sign in with Google, Apple, or a magic-link email. On iOS you can sign in with Apple (native), Google (native), or an 8-digit email code. On Android you can sign in with Google (native) or the email code. When you use Sign in with Apple, Apple may relay a private email; we treat it like any other email.
Push notifications (mobile)
Push notifications are opt-in. We only ask after you've finished your first daily, never on cold open. If you accept, we store an anonymous push token, your timezone, and your in-app language so we can localise and time the messages. We use push only for two things: a morning reminder around 10 AM in your local time when a new daily board is available, and an async multiplayer reminder when one of your room rounds is closing soon and you haven't played your turn yet. You can turn push off anytime — in-app from the You tab or in the OS settings.
We don't use IDFA, advertising identifiers, or third-party SDKs for tracking on the mobile app.
Analytics
The web app uses Umami, a self-hosted, cookieless analytics tool we run on our own infrastructure. It counts page views in aggregate — no personal profile, no cross-site tracking, no data shared with third parties. The mobile app does not use analytics.
What we don't do
No third-party ad networks. No advertising cookies. No cross-site tracking. We don't sell or share your data.
Subprocessors
We rely on standard cloud providers in the EU and US for database hosting, authentication, web hosting, push delivery, and aggregate analytics. These providers may log technical metadata (such as IP address and user-agent) for security and abuse prevention. The current list of providers is available on request — write to us and we'll send it.
How long we keep data
Account data is kept while your account is active. Gameplay runs are kept indefinitely so the leaderboard and your streak make sense over time. You can ask us to delete everything at any moment.
Your rights
You can delete your account and all associated data at any time — from the app (Settings → Delete account) or from the web at lexble.app/delete-account. For access, correction, portability, or restriction of processing, email hello@lexble.app. We aim to handle requests within a few days. If you live in a jurisdiction with a data-protection authority (such as the EU/EEA under the GDPR), you also have the right to lodge a complaint with them.
Children
Lexble is not directed at children under 13 (or under 16 in jurisdictions that set a higher age for data consent). If you believe a child has given us personal data, write to us and we'll remove it.
Changes
If we change how we handle data we'll update this page and the "last updated" date at the top.
Contact
Privacy questions: hello@lexble.app.