Privacy policy

Effective September 16, 2026.

Yapello is operated by Dylan Dale. For support, privacy questions, or a data request, email dylan@datathemis.com.

What we use

We create a guest identifier to run your games. We store your chosen display name, room membership, submitted words, scores, gems, match results, lifetime game statistics, solo adventure progress and earned gems, and reports or blocks. Other players at your table can see your display name and game activity.

A secure session credential identifies your guest on your device. The web version uses an HttpOnly cookie; iOS stores the credential in the system keychain. Sound, motion, and haptic preferences stay on your device. Session access lasts up to one year and is renewed while you use the service. Clearing storage or switching devices may make your guest record inaccessible; we currently do not provide registered-account recovery.

Service providers and sharing

Vercel hosts the website and game API. Neon stores game data. Expo builds and distributes the mobile application. Technical connection information, including IP addresses, may be processed by our hosting providers for operations and security. We use a hashed address for request limits. We do not sell player data. The web version contains no advertising SDK or ad tags. Paid gems are not offered.

When you share an invite or scorecard, your device sends the content to the destination you choose. Invite previews show Yapello artwork; they do not expose private match state. Anyone with a valid private-room invite can attempt to join while space remains.

Optional iOS reward ads

We are preparing optional Google AdMob ads for iOS; they are currently disabled. When enabled in a future iOS version, you can choose an ad instead of spending a gem for one Adventure hint or rotation. Google’s consent flow runs before requesting ads, and Ad privacy options in Adventure lets you revisit applicable choices. Declining an ad never prevents ordinary play or free retries.

The integration requests non-personalized ads. Google may still process IP addresses, device or app identifiers, ad interactions and diagnostic data to deliver ads, measure performance and prevent fraud, subject to your consent choices and device permissions. Non-personalized does not mean no data collection. See Google’s privacy policy. We send a guest identifier and an opaque offer ID to verify earned help. Our server stores reward transaction IDs and redemption state to prevent duplicate rewards; these records are removed when you delete your guest.

Retention and deletion

Game history and lifetime statistics are retained to operate the game and show your record. Temporary room and request data are eligible for operational cleanup. We do not promise that expiry of a session immediately erases its records or hosting backups.

In Settings, choose Delete guest profile to remove your guest session and lifetime statistics, delete your adventure progress and earned gems, remove your block relationships, and replace your display name in stored rooms with “Deleted player.” The app then starts a new guest. Completed-match totals and pseudonymous gameplay records may remain for game integrity. Safety reports may be retained to investigate abuse; hosting backups and logs follow the providers’ retention processes. Contact us for a request concerning these records.

Your choices

You can change your display name, control sounds and haptics, and report or block an opponent. Do not put sensitive information in your player name. Depending on where you live, you may have rights to access, correct, or delete personal information; contact the email above. We may need to verify your request without asking you to reveal your session credential.

Changes

If we add advertising, payments, or new data uses, we will update this policy and provide any required choices before those features are used.