Words of Islam

Privacy Policy for Words of Islam

Last updated: 28 September 2026

This policy covers the app "Words of Islam: Word Connect" on iPhone. It is written for players, not lawyers. Where a technical term cannot be avoided, it is explained on the spot.

The short version

There are three points where data leaves your device:

1. Ads. Google receives your IP address, from which your approximate location can be told, how you interact with the ads, and technical performance data from the app. Google does not get your iPhone's advertising ID, because the app never asks for it. Google uses this for advertising, statistics and fraud prevention. It starts at the first launch of the app and happens at every start after that, even if you decline personalised ads.
2. Purchases. At every start the app asks the billing service RevenueCat whether purchases belong to your installation, even if you never buy anything. RevenueCat receives an anonymous user ID, your device type and your purchase history. Payment itself runs through the App Store.
3. Your email to me. Tapping "Help & contact" in the settings opens your own mail app with a few details already filled in. You see them before sending and can change or delete them.

In the European Economic Area, the UK and Switzerland, Google asks you in a dialog whether ads may be personalised. If you decline, ads still appear, just not personalised ones, and Google still receives your IP address and technical data. You can change your answer at any time under Settings, "Privacy settings". Outside those countries no dialog appears.

I never see your payment details; they stay with Apple. These services are based in the USA, and so is the company responsible. What that means and what you can do about it is in the section "Does data go to the USA?".

Everything else stays on your device. Your progress is never uploaded anywhere. There is no account, no server of mine and no cloud. I do not sell data. The ad software does send data to Google, which Google also uses for its own purposes. More on that in the advertising section.

Who is responsible?

NOMAD AGENCY FOR MARKETING & CONSULTING LLC

2880 W Oakland Park Blvd, Ste 225C

Oakland Park, FL 33311, USA

represented by Mustafa Ali (Authorized Member)

Email: support@na4mc.de

Representative in the Union: [OPEN: the company is based in the USA and has no establishment in the EU. Article 27 GDPR therefore requires a representative in the Union, whose name and address belong here under Article 13(1)(a) GDPR. To be clarified with a lawyer and filled in before publication.]

Words of Islam is published by this company. The law calls the body that decides about your data the "controller" — here that is the company, and it is who you can turn to. There are no employees: one person works on the app, Mustafa Ali. Where this policy says "I", he is meant, running the app for the company. There is no data protection officer. Questions about privacy go to the address above.

What happens with the ads?

The app shows ads from Google AdMob. That is what pays for the game.

This is exactly what happens: at every start of the app, while you can already play, the app first asks Google's consent service. It is called UMP, short for User Messaging Platform. That request already goes to Google: Google sees your IP address and technical details about the app and device, and uses them to decide whether consent is needed in your region. Then:

• In the European Economic Area, the UK and Switzerland Google shows a dialog the first time. There you decide whether Google may use your data for personalised ads.
• If you agree, the app starts the advertising software, and ads may be tailored to you.
• If you decline, the app starts the advertising software anyway. You keep seeing ads, but not personalised ones; Google calls these ads with limited data processing. Google still receives your IP address and technical data and uses them to deliver ads, count them and detect fraud.
• Outside those countries no dialog appears, and the advertising software starts without asking.
• If the app cannot reach the consent service, for example without internet, it goes by your last saved answer. If there is none yet, the advertising software only starts once the app reaches the service. It tries again when you start a video, and at every start.

What Google receives:

• Device identifiers: on iPhone, Apple only releases the advertising ID with your permission. The app never asks for it, so Google does not get it.
• Your IP address, the number your device is reachable under on the internet. It gives away your approximate location, such as your city or region.
• How you interact with the ads: whether an ad was loaded and shown, whether you tap it or watch a video, and when the app starts.
• Technical performance data: for example how long the app takes to start, whether it hangs and how much energy it uses, plus details about your device such as model and operating system.

What for: to deliver and select ads, with your consent also matched to your interests; to count and bill which ads were shown and tapped; for statistics at Google and for me, where I only see aggregated figures in AdMob and no individual people; and to detect fraud and abuse, such as fake clicks.

Sharing, plainly: Google processes this data not only for me but also for its own purposes, and is responsible for that itself. I do not sell data, neither to Google nor to anyone else.

Legal basis: for personalised ads, your consent, Article 6(1)(a) GDPR. For storing and reading information on your device for that purpose, additionally section 25(1) of the German TDDDG. For the request to the consent service and for ads without personalisation, Article 6(1)(f) GDPR: the controller's legitimate interest in financing the free game with ads, in obtaining the consent this requires, and in fending off ad fraud.

Recipients: Google Ireland Limited (Ireland) and Google LLC (USA). Google also processes this data for its own purposes and is responsible for that itself. Details: policies.google.com/privacy

Other ad partners: Google's ad auction also lets other advertising companies bid for the ad spaces in the app. In the European Economic Area, the UK and Switzerland the Google dialog lists these partners by name ("List of partners", or "Manage options"). If you agree, they may also receive the data listed above and use it for the purposes you allowed there. Some partners rely on legitimate interest instead of consent for certain purposes, such as measuring ads; you can object to that in the same place, partner by partner and purpose by purpose. Each partner is responsible for its own processing; its privacy policy is linked in the list.

Retention: decided by Google. I have no access to it and no influence over it.

Changing your answer: open Settings and tap "Privacy settings". The same Google dialog opens again, at any time. Withdrawal applies going forward and does not make the earlier processing unlawful retroactively. Outside the countries where Google shows the dialog, this item is not in the settings.

How many ads you see: The first five completed levels are ad free. After that a banner appears below the letter wheel, and roughly every two to three levels a full-screen ad follows when you leave a completed level. Videos for coins only start when you tap them. The one-time purchase "Remove ads" switches the banner and the ads between levels off for good; voluntary videos stay available. That is why the app keeps starting the advertising software after this purchase and keeps loading ads in the background; the only ones it shows you are the videos you start yourself. Google keeps receiving the data listed above.

SKAdNetwork: the app lists 54 SKAdNetwork identifiers. SKAdNetwork is Apple's method for letting ad networks measure whether an ad led to an install. How Apple designs that measurement is documented by Apple.

What happens when you buy something?

There is a one-time purchase, "Remove ads", there are coin packs, and there are bundles of coins, hints and word reveals. The purchase runs through the App Store. I never see your payment details. Card number, address and invoice sit with Apple, who is responsible for them.

To manage purchases I use the service RevenueCat. At every start the app checks in with RevenueCat, even if you never buy anything. RevenueCat receives:

• an anonymous user ID, meaning a random number for your installation with no name and no email address. This policy also calls it your purchase ID.
• your purchase history: which purchases from this app belong to your Apple account, when they were made, at what price and under which App Store transaction number
• your device type and the versions of the operating system and the app, and, as with any internet connection, your IP address

What for: to verify your purchase with the App Store and match it to your installation; to unlock "Remove ads", credit coins, hints and word reveals you bought, even if the app closes right after payment, and restore "Remove ads" after a reinstall; and for purchase and revenue statistics that RevenueCat compiles for me from this data, such as how often a pack was bought. I do not see names or email addresses there.

Legal basis: Article 6(1)(b) GDPR, performance of the purchase contract, for verifying, unlocking, crediting and restoring. For the check at start when you have not bought anything, and for the statistics, Article 6(1)(f) GDPR, the controller's legitimate interest in recognising purchases reliably and knowing which offers are used.

Recipients: RevenueCat, Inc. (USA) as my service provider, and Apple as the operator of the App Store. See revenuecat.com/privacy and apple.com/legal/privacy

Retention: as long as your purchase has to stay valid and restorable, or until you ask for deletion; how that works is described under "How do you delete your data?" below. Apple sets its own periods. Tax and bookkeeping obligations for the payment itself fall on Apple, not on me.

What happens when you write to me?

Tapping "Help & contact" in the settings opens your own mail app with a prepared text. The subject holds the version of the app. Below it stand your purchase ID (the anonymous user ID at RevenueCat, see above; it is left out if RevenueCat does not answer within two seconds), your coin balance, how many levels you have completed in German and in English, and your operating system and its version. That saves me from asking, and lets me find your purchases at RevenueCat when your message is about a purchase or a deletion. You see this text before sending and can edit or delete it. The app never sends anything on its own. If no mail app can be opened, the app simply copies the support address to your clipboard.

Once you send the mail, I also learn your sender address and whatever you write in it.

Legal basis: Article 6(1)(b) GDPR where your message concerns a purchase or the app itself, otherwise Article 6(1)(f) GDPR, the controller's legitimate interest in answering you and fixing bugs.

Recipients: your own mail provider when sending, and SiteGround Spain S.L., Calle de Prim 19, 28004 Madrid, Spain. SiteGround receives the message, filters spam and puts it in my mailbox. There is a data processing agreement with SiteGround under Article 28 GDPR; it forms part of their terms of service and includes the standard contractual clauses for the case that data reaches a third country.

Retention: until your issue is settled and no follow-up questions are expected, and no more than six months after that. If your message concerns a purchase, a refund or a complaint, I keep it until the end of the third calendar year after the matter is closed: claims arising from it can be brought during that period, and I need to be able to defend against them (Article 17(3)(e) GDPR). After that I delete it, attachments included. You can ask me at any time to delete it sooner; if nothing prevents it, I will.

Where is your progress stored?

On your device, and nowhere else, in the storage the operating system gives every app. I never see it.

This is the complete list of what the app stores, entry by entry:

• your coins (coins)
• how far you are, per language: the highest level you completed in German and in English (completed_level_<language>)
• your hints and word reveals from bundles, which are used before any coins (free_hints, free_reveals)
• how many bonus words you have found in total, for the bonus chest (bonus_words_found)
• which collection cards you have already been shown (seen_cards)
• for the weekly report: per day, how many levels you completed, and up to 30 words from them; the app keeps the last 120 days at most and deletes older ones by itself (activity_log)
• whether ambient sounds and effects are on (music_on, sfx_on)
• which language you chose last, German or English (language); until you choose once, the app follows your iPhone's language
• how many levels you have played in total, replays included, and how many since the last full-screen ad (levels_played, ads_since_last)
• whether "Remove ads" was bought, so that no ads come back without internet (ads_removed)
• at which level removing the ads was last offered to you (remove_ads_offered_at)
• which purchases of coins and bundles were already credited to you, as store transaction ids (purchases_credited), so no purchase gets lost and none counts twice

On top of that, the billing service RevenueCat keeps a cache with your anonymous user ID and the last known state of your purchases. It also stays on your device and is deleted with the app. Google's ad software likewise keeps its own entries on your device, including your answer in the consent dialog, so that it still applies at the next start. They are also deleted with the app.

You never type anything about yourself into the app: there is no field for a name, an email address or anything else.

That is all. There is no database, no further files with user data, and no server anything is copied to.

Legal basis: Article 6(1)(b) GDPR, because without stored progress there is no game to install. For the storage on your device, additionally section 25(2) no. 2 TDDDG, since it is strictly necessary for the service you asked for.

Recipients: none.

Retention: until you delete the app.

Does data go to the USA?

Yes, in two ways. First, Google, RevenueCat and Apple are US companies or belong to one; whatever reaches them may also be processed in the USA. Second, the controller itself is a company based in Florida. Whatever you send to the support mailbox therefore also ends up in the USA.

The European Commission has adopted an adequacy decision for the USA under the EU-US Data Privacy Framework. It only covers companies that have certified under it. As of 9 September 2026, Google LLC appears on the official list with an active certification. Apple Inc. and RevenueCat, Inc. do not; for those, the transfer relies on standard contractual clauses under Article 46(2)(c) GDPR. You can obtain a copy of those clauses from the provider concerned, or write to me and I will point you to it. You can check the current status yourself at dataprivacyframework.gov/list.

About the entities behind this: within the European Economic Area, Google's services are provided by Google Ireland Limited in Dublin, and your App Store purchase runs through Apple Distribution International Ltd. in Cork. Both are based in the EU. Certification and standard contractual clauses only concern the onward transfer from there to Google LLC and Apple Inc. in the USA.

No sugar coating: a residual risk remains. Under certain conditions US authorities can access data processed there, and the legal remedies against that do not match the European level in every respect. Declining the advertising consent only prevents personalised ads, not every transfer to Google. The only way to avoid transfers entirely is to play without an internet connection: every level works offline, and while your device is offline nothing goes to Google or RevenueCat. There are no videos for coins and no purchases then, though.

Does the app track you across other apps?

The app itself does not. I do not link data from this app with data from other apps or websites, and there is no tracking component of my own.

With the ads, it depends on Google and on your choice. The app never asks for tracking permission through Apple's App Tracking Transparency, so Google does not get the advertising ID. What Google draws on to select ads is described in Google's privacy policy. The rest of the data listed in the advertising section reaches Google either way.

What the app deliberately does not do

• no account, no sign in, no password
• no server of my own, no cloud, no sync between devices
• no tracking across app boundaries
• no friend lists, no leaderboards, no chat, no profile pictures
• no selling of data; that Google also uses the ad data for its own purposes is covered in the advertising section
• no newsletter and no marketing email from me
• no notifications to your device
• no component of its own for crash reports or usage statistics

Permissions: the app asks for no permission on your iPhone at all: no location, no camera, no microphone, no contacts, no photos, no notifications, no tracking.

Analytics from Apple: if you allowed sharing analytics with app developers in your iPhone's settings, Apple passes crash reports and aggregated usage figures on to me. You decide that there; the app itself has no say in it.

How long is data kept?

What rights do you have?

You can ask for access to the data processed about you (Article 15 GDPR), correction of wrong data (Article 16), erasure (Article 17), restriction of processing (Article 18) and a copy in a common format (Article 20). You can object to processing based on legitimate interests (Article 21), which here means the ads without personalisation and the request to the consent service, the check with RevenueCat and the handling of your email. You can withdraw consent at any time with effect for the future (Article 7(3)). What happened lawfully before that stays lawful.

Honestly, what this means in practice:

• If you have written to me, your email is in my mailbox. All the rights above apply to it. Write to me and I will give you a copy or delete it.
• Your purchase data at RevenueCat is processed by RevenueCat for me, so you get access and deletion through me: write to me, ideally via "Help & contact" in the settings, which puts your purchase ID in the mail.
• Beyond that I hold nothing about you. There is no account and no identifier that would let me recognise you without your help. If you believe something of yours is with me anyway, send me what allows me to match it, for example your purchase ID.
• For data held by Google or Apple, go to those providers directly, since that is where the data sits and I have no access to it. If you need help with that, write to me and I will point you to the right place.

You can also complain to a data protection supervisory authority (Article 77 GDPR): the authority where you live, where you work, or where the alleged infringement took place. You do not have to contact me first.

How do you delete your data?

• Everything on your device: delete the app from your device. That removes your progress and everything RevenueCat and Google's ad software keep on the device. It cannot be undone and I cannot restore any of it. The app has no reset button of its own. Whatever is already at RevenueCat or Google stays there.
• Purchase data at RevenueCat: write to support@na4mc.de, ideally via "Help & contact" in the settings, which puts your purchase ID in the mail. I delete your record at RevenueCat within 30 days and confirm by email. As long as the app is installed, it checks in with RevenueCat again at every start, and a new record is created there. Your purchases themselves stay with Apple, and you can get "Remove ads" back at any time with "Restore purchases". Records that Apple must keep for tax purposes stay with Apple; I have no influence over that.
• Advertising data at Google: covered by Google's privacy policy (policies.google.com/privacy); I have no access to it.

Children and young people

I do not ask for your age and do not know it. Nothing in the app puts children in touch with other people: no chat, no friend lists, no profiles.

The one point that matters is the advertising consent. In Germany, young people can only consent on their own from the age of 16, and in some other EU countries the limit is lower (Article 8 GDPR). Below that age, parents decide.

For parents, concretely: decline personalised ads in Google's consent dialog. Ads still appear, but they are not tailored to your child. You can reopen that dialog at any time under Settings and "Privacy settings" and change the answer. If you want the banner and the ads between levels gone entirely, buy "Remove ads".

The app is not a children's offering. It is not in Apple's Kids Category. The age rating the App Store shows is on the store page. If I learn that someone under 13 has sent me data, in a support email for example, I delete it without anyone having to ask.

Do you have to provide any data?

No. You need not provide anything to play, and you need not agree to personalised ads. If you decline, the game carries on as normal, ads included, only they are not personalised. Google still receives your IP address and technical data, as described in the advertising section, and RevenueCat still receives your anonymous user ID at start. The only way to send nothing at all is to play without an internet connection; every level still works then. Without a purchase, "Remove ads", the coin packs and the bundles stay locked, and that is all that happens.

Are decisions made about you automatically?

No. I make no automated decisions in individual cases and no profiling within the meaning of Article 22 GDPR. What Google does to select ads is described in Google's own privacy policy.

Will this policy change?

Yes, whenever the app changes. If a service is added or dropped, I write it in here and put a new date at the top. If a new kind of processing needs your consent, I will ask you in the app first. You can always open the current version in the app under Settings, "Privacy policy".

Contact

Write to support@na4mc.de. The easiest way is "Help & contact" in the settings, which brings your purchase ID along.

The website you are reading this on has its own short notice: Website privacy.