Privacy policy

Last updated: 17 October 2026

The short version

Children who play need no account, and we store no data about them. Their progress stays in their own browser.
Adults who create decks sign in with Google or Facebook. We keep their name, email, and the decks they make.
We never sell personal data. We log IP addresses to keep the service secure.
We may show advertising. Cookies used for ads or tracking are set only with your consent, and we never show ads based on profiling to children.
Word lists submitted by creators are processed by a third-party AI service to build a deck.

1. Who we are

MojiWords (mojiwords.com) is operated by MB Zarocloud, company code 306665294, VAT LT100019309716, Raudondvario plentas 182, LT-47149 Kaunas, Lithuania (zarocloud.com). MB Zarocloud is the data controller for the personal data described in this policy. You can reach us at mojiwords@pm.me.

We process personal data in line with the EU General Data Protection Regulation (GDPR) and Lithuanian law. This policy explains what we collect, why, how long we keep it, and the rights you have.

2. Players (children and anyone who plays a deck)

Playing a deck requires no account, name, email, or any other personal detail. We designed MojiWords so that we hold no personal data about players, who are often children.

Progress and preferences (such as the chosen language and which words were practised) are saved only in the player's own browser, using local storage. They are never sent to us. Clearing the browser's site data removes them.
Play counts. When a deck is played we increase an anonymous counter for that deck. The counter holds no information about who played.
Spoken words use the text-to-speech voice built into the browser or device. No audio is recorded or sent to us.
Third parties on play pages. Pages used by players load no social media code and no third-party fonts. If we show advertising on them, it is served without profiling (see section 4).

3. Creators (adults who sign in to make decks)

To create a deck you must sign in. Creating decks is intended for adults (parents, teachers, and other grown-ups), and you confirm that you are at least 18 years old when you first sign in.

What we collect

Data	Source	Purpose	Legal basis
Display name and email address	Your Google or Facebook account, at sign-in	Identifying your account and contacting you about it. Your name is shown on a deck only if you choose to; your email is never shown	Performance of a contract (Art. 6(1)(b) GDPR)
Time and version of your consent, age confirmation, interface language	You, at first sign-in	Proving consent and that creators are adults	Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f))
Decks you create: word lists, translations, titles, descriptions, learner language	You	Providing the service; published decks are public	Performance of a contract (Art. 6(1)(b))
Usage counters (decks created per month, rejected inputs per day)	Generated by us	Enforcing plan limits and preventing abuse	Legitimate interest (Art. 6(1)(f))
Submission record for each deck: your account identifier, IP address, and time	Generated by us when you submit a word list	Identifying who submitted a deck; handling abuse reports and lawful requests from authorities	Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c))
Generation logs: time, token counts, and whether the safety check flagged the input	Generated by us	Security, abuse prevention, and cost control	Legitimate interest (Art. 6(1)(f))
Interest in the Plus plan (a yes/no flag, your position in the interest counter, and whether you asked for one launch email)	You, when you ask for Plus	Counting demand for Plus; sending you one email when it launches. The "I want Plus" button says so right below it, so clicking it is your consent to that one email. You can withdraw it at any time by unticking the box on the thank-you page	Consent (Art. 6(1)(a)), given by clicking "I want Plus" and withdrawn by unticking the box on the thank-you page

Generation logs never contain the text you pasted or the model's output. We do not use your account data for advertising, profiling, or automated decisions with legal effects.

How decks are made

Word lists you submit are processed by a third-party AI service on our behalf to build the deck. The provider acts as our processor under a contract that limits its use of the text to providing the service. Please do not include personal data about yourself or others in a word list.

Published decks are public

Published decks, including their title, description, and word list, can be viewed by anyone and may appear in search engines. Decks are published anonymously: your name appears on a deck only if you choose to show it. Your email address is never displayed and never made available through our website or API. Drafts and deleted decks are not public. The submission record (account identifier, IP address, time) is never public.

Disclosure to authorities

We may disclose the submission record and account data to law enforcement, courts, or other competent authorities when we are legally required to, in response to a lawful request, or where necessary to protect children, other users, or our rights (Art. 6(1)(c) and 6(1)(f) GDPR).

4. Website visitors

Server logs. When you load a page or call our API, we and our host Vercel Inc. record the IP address, time, requested page, and browser type. We use these logs to keep the service secure, to detect and block abuse, and to enforce rate limits (legitimate interest, Art. 6(1)(f) GDPR). Logs are kept for 30 days unless needed longer to investigate an incident.
Analytics. We may use privacy-friendly, cookieless analytics (such as Vercel Web Analytics) that count page views without identifying visitors or tracking them across sites.
Advertising. We may show advertisements to help keep playing free. Advertising partners may use cookies or similar technologies to measure and, where you allow it, personalise ads. Such cookies are set only after you agree through our cookie banner, and you can withdraw your consent there at any time (Art. 6(1)(a) GDPR). We do not show advertising based on profiling on pages used by children, in line with the EU Digital Services Act. Advertising partners will be named in the cookie banner when advertising is active.
Necessary storage. Signing in as a creator uses the technically necessary storage of your login provider to keep you signed in. Players' progress and language choice are kept in local storage on their device. Neither requires consent.
Email. If you write to us, we keep the correspondence for as long as needed to handle your request.

5. Processors and transfers

We share personal data only with service providers that process it on our behalf and under our instructions:

Vercel Inc. (USA): hosting and delivery of the website.
Google LLC / Google Ireland Ltd: sign-in (Firebase Authentication) and database (Firestore).
A third-party AI service provider: processing of submitted word lists to generate decks.
Meta Platforms Ireland Ltd: sign-in with Facebook, only if you choose it.
Advertising partners, if and when we show ads: named in the cookie banner, and only with your consent.

Some providers process data outside the European Economic Area. Where they do, transfers rely on the European Commission's adequacy decisions (including the EU-US Data Privacy Framework) or standard contractual clauses. We do not sell personal data and do not share it with advertisers.

6. How long we keep data

Server logs, including IP addresses: 30 days.
Account data and published decks: for as long as your account exists.
Submission records (account identifier, IP address, time): for as long as the deck exists, and 90 days after its deletion.
Abandoned drafts: 7 days.
Generation logs (account identifier, IP address, time, token counts, screening scores; never the words): 1 year.
Abuse reports: 90 days after they are resolved.
Usage counters: the current period, then automatically removed.

7. Your rights

Under the GDPR you have the right to:

access the personal data we hold about you and receive a copy;
have inaccurate data corrected;
have your data erased ("right to be forgotten");
restrict or object to processing based on legitimate interest;
receive your data in a portable format;
withdraw consent at any time, without affecting processing done before the withdrawal;
lodge a complaint with a supervisory authority.

To exercise these rights, email mojiwords@pm.me from the address linked to your account. We answer within one month. Deleting your account removes your login, profile, usage counters, and generation logs; decks you published may remain available, without any link to you, unless you delete them first.

The supervisory authority in Lithuania is the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija), vdai.lrv.lt. You may also complain to the authority of the EU country where you live.

8. Children's privacy

MojiWords is made for children to play, but only adults can create accounts. We knowingly collect no personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. Security

All traffic is encrypted (HTTPS). Data is stored with established cloud providers, access is restricted to the operator, and the browser never has direct access to our database. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data with care.

10. Changes to this policy

We may update this policy as the service evolves. The date at the top shows the current version. For material changes affecting creators, we will ask for renewed consent at the next sign-in.