Privacy policy

Effective 11 October 2026. MJUKIS AB operates Ordus. Contact admin@ordus.lol with privacy questions or requests.

Practice and preferences

Practice can be played without an account. Preferences, round history and diagnostic breadcrumbs are stored on your device. After sign-in, saved rounds are uploaded to your account so that your statistics work across devices. Supported personal preferences, such as theme, game sounds and Practice settings, are also saved to your account and restored when you sign in on another device. Device permissions and diagnostic recording choices remain local.

Online play

We process your email address to sign you in, and store your nickname, friend code, account identifier, submitted gameplay and scores to provide accounts, matches and leaderboards. If you sign in with Apple, Apple shares an identifier for your Apple Account, an email address (yours or a private relay address) and, the first time, your first name, which is your temporary name until you pick a nickname. Friends and opponents can see your public nickname and shared match results. Public website leaderboards show nicknames, record scores and game languages. Community totals summarize synced rounds. Email addresses and sign-in credentials are not public.

Approximate-area group suggestions

When enabled, Ordus may use the country, region and city supplied by Cloudflare for the current network request to suggest nearby public groups. We do not read precise coordinates or postal codes, save the inferred area to your account, or join a group automatically. You can turn these suggestions off or choose a reviewed area yourself; an anonymous website choice is stored only in that browser until you clear it.

Word attempts and game improvement

For submitted matches and synced play sessions, including unfinished rounds, we store drawn letter sequences, rejected guesses, short draws and repeated words, together with tile paths, timing, scores, language, board, game rules, dictionary version and app build. We save session checkpoints, interruptions, active play time, board reveals and solution views to understand difficulty and repeat play. If you rate a board, we also store your optional reaction with its exact layout and round outcome. If you report a missing word, we also store your selected reason and optional note. Signed-out sessions and reports remain on your device until you sign in and they sync to your account. We use these records to improve word lists, study board difficulty and produce word statistics. Rejected guesses are private research data and are not published as a word list. Deleting your account also removes these attempt records.

App and website usage

PostHog processes screen views, which highscore categories are visible, time spent viewing them, scroll reach and ranking interactions, taps on selected inactive elements, flow completion, action failures, loading times and changes to selected personal preferences to help us improve navigation and reliability. These events include a random installation identifier, game language, platform, app version and operating-system information. They are collected when playing with or without an account. We use PostHog's EU cloud and do not send account identifiers, emails, nicknames, player identifiers, words, finger traces, sign-in links or screen recordings through this analytics stream. On the website, we measure page categories, app and store link clicks, board creation, publishing, sharing, loading and return visits. A random browser identifier is stored in local storage until you clear site data. If storage is unavailable, the identifier lasts only for that page. We do not collect page URLs, search terms, board contents or form values in these events. Website collection respects Do Not Track and Global Privacy Control. Analytics data expires under our configured PostHog retention schedule.

Abuse prevention

Online requests from the app include an identifier for your device: on Android, the identifier Android gives Ordus on that device; on iOS, a random identifier stored on the device. We store which devices each account uses and count how many changes an account makes each day. We use this only to limit abuse of the service and to block accounts or devices that cheat or overload it. Daily counts are deleted after two days, and device records are deleted with your account. On Android, ranked games and matches include a Google Play Integrity check: Google tells us whether the app is the version from Google Play, whether the device passes Google's integrity checks and whether apps installed outside Google Play can see the screen or control the device. We also keep how many of these checks the device has asked for in the past hour and whether Google Play Protect is on or has found harmful apps, which we only review. With each ranked game or match the app also sends whether another app's window covered the board while you played and how many accessibility services that are not assistive tools could read the screen; it sends a count, never app names. We keep each result for 30 days. While a round is in progress on Android, the app hides other apps' windows drawn over it and only lets assistive tools such as TalkBack read the screen.

We check each ranked round from how it was played: words found per minute, the share of the board's words found and the timing of each swipe. A round that looks implausible stays off leaderboards until we have reviewed it. These checks are deleted with your account.

When a timed practice round ends, the app sends it with the device identifier, with or without an account: the letters, your swipes and their timing. We use these rounds to see how play develops and to spot cheating; they never change a score or leaderboard. They are deleted 90 days after they arrive, or earlier when you delete an account that used the device.

Finger movement and app verification

When finger-trace collection is enabled, Practice, match and Daily rounds record finger positions relative to the board and the time of each sample. Signed-out recordings stay on the device for up to seven days and can upload after you sign in. We upload these recordings privately to Cloudflare to study play and review possible cheating. They are not shown to other players. Raw recordings are kept for up to 30 days in cloud storage and are removed when you delete your account. A recording by itself does not establish cheating.

Apple App Attest and Google Play Integrity help us verify the app sending a recording. We keep the verification result, installation-key identifier and app version with the recording. Verification identifies a trusted app installation; it does not guarantee that a round was played honestly.

Device security and persistent markers

To investigate abuse, we collect installation-key identifiers, app identity and build, integrity verdicts, and observations of debugging, jailbreak indicators, hooking tools, modified code and input patterns. During play, we also collect the count and timing of screenshot notifications from the operating system, and whether screenshot detection is available or capture protection is active. These observations do not include screenshot images or screen recordings and do not establish cheating. Bounded touch and button-action counts can include gestures produced by assistive technology. They do not reliably identify the input source; we do not use them to infer disability or health information. Android key attestation can provide certificate identifiers and serial numbers, hardware security level, bootloader state and security patch versions. Certificate identifiers may help associate device activity; they are not always unique to a device. We link these observations to your account and installation for review.

Apple DeviceCheck and Google Play Integrity device recall can retain limited abuse markers on a device after the app is reinstalled. Google device-recall markers may also survive a factory reset. Deleting an Ordus account removes our account-linked security records and retained tokens, but does not automatically clear these provider-held device markers. They are used for fraud prevention and may be reviewed or cleared separately; contact admin@ordus.lol about a marker.

Apple App Attest receipts can provide a risk metric estimating how many app attestation keys were created on the device over the preceding 30 days. We retain the receipt and latest metric with the installation while the account exists. When device-marker writes are enabled, we retain a verified Google Play Integrity token privately for up to 14 days to apply an explicit abuse review decision. Turning writes off removes retained tokens at the next hourly cleanup. We use these checks for service security, not advertising or tracking across other companies’ apps.

Service providers

Cloudflare hosts the service and processes network requests, operational logs and stored game data. Resend delivers sign-in email. If you sign in with Apple, Apple verifies the sign-in, and we keep a token from Apple so that deleting your account also ends Sign in with Apple for Ordus. If you enable notifications, Google Firebase Cloud Messaging and Apple deliver push notifications using device registration tokens and notification content, including the account identifier needed to open the right account. Older app versions use OneSignal, which also processes delivery and interaction data. Ordus stores device registrations and notification opens to provide notifications and measure their use. You can control notification preferences in the app and notification permission in your device settings. Sentry processes automatic crash reports, app diagnostics and sampled performance data to help us find and fix reliability problems, including when you play without an account. Reports include app and operating-system versions, device information, stack traces, and recent technical actions such as round saves and request identifiers. We do not attach your email, nickname, sign-in tokens, screenshots or session recordings to these automatic reports. Diagnostic records expire according to our configured Sentry retention. Apple provides TestFlight distribution, crash reports and tester feedback under its own privacy terms. The app does not use advertising trackers or sell personal data.

Questions and tests in the app

Ordus may ask you a question or offer a short test in the app, such as dragging one word several times as fast as you can. We store your answer or test result with your account, or with a random feedback identifier when you are signed out, together with the app version and build. A drag test also stores the tiles each drag selected, its timing, the size of the tiles on your screen and the finger positions relative to the board. We use these results to improve how the board responds to touch. Answers and results are deleted after 90 days and finger positions after 30 days, or earlier when you delete your account.

Diagnostics and camera

When you submit a bug report, we receive your description, attached screenshots, recent diagnostic logs, device and operating-system information, locale, app version and a session identifier. Review your report before sending it; screenshots or descriptions may contain personal information. Stored bug reports are pruned after 30 days. The camera is used on-device to scan friend codes; camera images are not uploaded.

Retention and deletion

Account and gameplay data are kept while your account exists. Delete account in the app removes your email, nickname, credentials, personal online rounds, saved account preferences and leaderboard entries, and ends Sign in with Apple for Ordus if you used it. Shared match records retain an anonymous player identifier and display Deleted player; unfinished matches are cancelled. Match cleanup is retried if temporarily unavailable. Local practice history stays on your device and can be removed by deleting the app. A new sign-in creates a new account. Infrastructure backups and provider operational records expire according to the configured provider retention schedules.

Your choices and rights

Contact us to request access, correction, export or deletion of your personal data, or to object to processing. Processing for accounts and gameplay provides the service you request; limited security and operational processing supports our legitimate interest in maintaining it. You may complain to your local data protection authority, including Sweden’s IMY. Providers may process data outside your country under their applicable data protection arrangements.