Privacy Policy — Tilewright
This site is operated by the AI Agency. Last updated 13 September 2026.
What we collect
There is no account here: no sign-up, no email address and no profile, so we never ask you for anything that identifies you.
Like any website, our hosting records ordinary technical request logs (IP address, timestamp, the URL requested and your browser’s user-agent string) for security and diagnostics. We do not use them to build a profile of you. Advertising and analytics are covered in their own sections below.
What your browser sends us
No word you play, no score, no rack and no board position ever leaves your device. Tilewright has no game server. The rules, the scoring, the dictionary and the computer opponent all run inside your own browser, and there is nowhere for a game of yours to be sent: this site’s server hands your browser the page files and answers a health check, and it has no route that accepts anything from you.
Two things about your visit are counted, and we would rather say so plainly than leave you to find out. When the board becomes playable we send Google Analytics a game_start event carrying which mode you chose, and when the rules engine accepts your first tile placement we send a first_input event. Each carries a coarse device class and the screen orientation, and nothing else. There is no third event. What they are for, and what they do not contain, is set out in Analytics below.
Beyond loading the page itself, the game makes exactly one request of its own: a one-time download of the dictionary file (/dict/enable.dawg) from this site. It is the same static file for every visitor, it is fetched before you have done anything, and it tells us nothing about you beyond the ordinary request log described above. The game has no API and no database of any kind. The other requests your browser makes here are not the game’s: on the live site each page also loads Google’s advertising script and Google’s analytics script, which see your IP address and your browser’s user-agent as any request does. Those two are described in Advertising and cookies and Analytics below.
Anything the game remembers between visits stays in your browser’s local storage, on that device only, under five keys: tilewright.v1.game (the game you walked away from), tilewright.v1.stats (your lifetime counters), tilewright.v1.ladder (which opponent tiers you have unlocked), tilewright.v1.daily (your Daily Rack results and streak) and tilewright.v1.sound (sound on or off). We cannot read any of it, it is never uploaded or copied to us, and none of it travels with the two events above. Clearing your browser data deletes it permanently, and there is no copy anywhere for us to restore.
Share cards are drawn in your browser and handed to your own device’s share or download function. The image is never uploaded to us.
Advertising and cookies
We use Google AdSense to show ads. Google and its partners use cookies (including the DoubleClick DART cookie) to serve ads based on your visits to this and other sites. You can opt out of personalised advertising via Google Ads Settings, or opt out of third-party vendor cookies at aboutads.info/choices. Consent is collected by Google’s certified CMP before any ad cookies are set.
Analytics
We use Google Analytics 4 (measurement ID G-6X8XEWPK1C) to count how the game is used — how many people arrive, how many get a board dealt, and how many of those manage to place a tile. That last number is the one we actually need: a visit that starts a game and never places a tile is usually a build that is broken on that phone, and it is the only way we find out. We use it for that and for nothing else.
These are all of the events we send, and everything each one carries:
page_view— sent automatically by Google Analytics when a page loads, with the page address, the referring address if there is one, and your approximate location, device and browser as Google derives them from the request.game_start— a board is dealt and playable, with the mode you are playing (a full match, or the Daily Rack). Sent once per visit.first_input— the first tile placement the rules engine accepted in this visit. It carries nothing about the tile, the square or the word. Sent once per visit; every later placement is silent.
Both of our own events also carry a coarse device class (phone, tablet or desktop) and the screen orientation, so we can tell whether something is broken on phones held one way. That is the entire list. No word, no score, no rack, no board position, no name, no email address and no free text is ever sent — the game asks you for none of those and has nowhere for you to type anything, and what is saved on your device is not read into any event.
Google may set analytics cookies (such as _ga) in your browser to tell a returning visit from a new one. Google’s certified consent banner records your cookie choice and Google Consent Mode applies it to these cookies; you can change or withdraw that choice at any time through the banner, and clearing your browser’s cookies for this site removes them. How Google handles data from sites that use its services is described at policies.google.com/technologies/partner-sites.
Your rights (GDPR / CCPA)
Why we are allowed to process any of it. The advertising and analytics cookies described above, and everything Google collects through them, rest on your consent (Art. 6(1)(a) GDPR), which Google’s certified consent banner collects before those cookies are set and which you can withdraw at any time in that same banner. Until you consent, Google Consent Mode holds ad_storage, ad_user_data and ad_personalization denied for everyone, and analytics_storage denied as well for visitors in the EU, Iceland, Liechtenstein, Norway and the United Kingdom. The ordinary hosting request logs described in What we collect rest instead on our legitimate interest (Art. 6(1)(f)) in keeping this site available, secure and debuggable. Your saved games, statistics, ladder, Daily Rack record and sound setting are not a legal basis question at all: they never leave your device, and we cannot read them.
Who else sees it. Google is the only recipient of anything about your visit: Google Ireland Limited for visitors in the EEA and the UK, Google LLC elsewhere. It processes the Google Analytics measurement described in Analytics on our behalf under Google’s data processing terms, and handles the advertising data described in Advertising and cookies on its own account as well as ours. This site is hosted on Amazon Web Services in its Ireland (eu-west-1) region, which is where the request logs sit. Nobody else is given anything.
Transfers outside the EEA. The hosting logs stay in the EU. Data collected through Google’s ads and analytics is processed in the United States among other countries; Google LLC is certified under the EU–U.S. Data Privacy Framework and its UK extension, which is the transfer mechanism relied on here, and Google’s terms also incorporate the European Commission’s standard contractual clauses.
How long any of it is kept. Our Google Analytics property is set to Google’s shortest event-level retention, 2 months; the user-level record behind the _ga cookie is kept 14 months and its clock restarts on a new visit, so it expires 14 months after you last come here. Google deletes both on that schedule; the aggregate totals in its standard reports are not affected by the setting. Hosting request logs are deleted automatically 7 days after they are written. The five tilewright.v1 keys saved on your device stay until you clear your browser data for this site — we have no way to expire them for you and no copy to delete — and the ad and analytics cookies expire on Google’s own schedule or when you clear them.
Your rights. Where the GDPR applies you have the right to ask us for a copy of your personal data (access), to have it corrected (rectification), to have it deleted (erasure), to have its use restricted, to object to processing we base on our legitimate interests, and to receive data you gave us in a portable form. You can withdraw your consent at any time through the consent banner, without affecting what was lawful before you withdrew it. One honest limit: because there is no account here and we hold nothing that identifies you by name, we usually cannot pick your data out of the rest — if you can give us something that narrows it down we will do what we can, and we will tell you plainly when we cannot.
Complaints. If you think we have handled your data badly you can lodge a complaint with a supervisory authority — in the EEA the data protection authority of the country where you live, where you work, or where the problem happened (the list is at edpb.europa.eu), and in the UK the Information Commissioner’s Office (ico.org.uk). You do not have to come to us first, though we would rather you did.
Selling and sharing. We do not sell or share personal information for cross-context behavioural advertising, and we receive no payment for anything about you. ad_personalization is denied by default and only your own choice in the consent banner can change that; the same banner turns it off again. California residents can use that banner as their opt-out of sale and sharing.
Contact and data rights
To exercise your GDPR/CCPA rights, opt out of personalised ads, or ask a privacy question, email auto-ai-agency@quantum-solutions.hr. We respond to verified requests within 30 days.