Privacy Policy
Vega Bell is a spelling game for everyone, including kids. This page explains exactly what we know about you. We wrote it so a 12-year-old can read it. If anything here is confusing, email us and we will fix the wording.
1. The short version
We collect the little we need to run a fair game, we never sell it, there are no ads and no trackers, and you can download or delete everything yourself at any time.
- To play, you give us an email, a nickname, a country, and a password we never actually receive.
- We save your scores and which words you got right, so the game can pick the right difficulty for you.
- Other players only ever see your nickname, your country, your score, your Orbit and your tier.
- We use one cookie. It is the one that keeps you signed in. That is the whole list.
- Nobody buys your data from us, because we do not sell data to anyone, ever.
- If you are under 13, a parent or guardian has to say yes first. See the Parents & COPPA page.
2. Who we are
Vega Bell is the game at vegabell.com. We are the people who decide what happens to your information, so we are responsible for it.
Vega Bell is run by Vega Bell. Under data protection law we are the "controller" of your information. That is a legal way of saying: we decide what is collected and we are the ones you can hold to account for it.
You can reach us any time at privacy@vegabell.com. Email is the way to contact us; we do not publish a postal address.
Data protection contact: [DPO OR EU/UK REPRESENTATIVE: NAME AND CONTACT, IF REQUIRED].
3. What we collect
A few things when you sign up, and how you do in the game while you play. Nothing else.
When you make an account
- Your email address. This is how you sign in and how we can reach you about your account.
- A password. We never receive it. See section 4. This one is unusual and worth reading.
- A nickname. This is public. Pick something that is not your real name.
- Your country, as a two-letter code like
BRorGB. This is public, and it is what puts you on your country's leaderboard. - Your school year (1 to 12), only if you want. It is switched off by default. It never changes how hard your words are. It is only shown to others if you turn it on yourself.
If you are under 13
- A parent or guardian's email address.
- A record that they agreed, plus the date and time they agreed.
- A scrambled version of the internet address the agreement came from. It is turned into a fixed jumble of letters and numbers (a "hash") that we cannot turn back into the original address. It exists so we can show the consent really happened.
While you play
- Which words you were given, which you spelled correctly, and which you missed.
- Your scores, your run history, your streaks, your difficulty tier and your Orbit.
- How long you took to answer, and how long the round took.
- A scrambled ("hashed") version of your internet address and a device hash. These exist for one reason only: catching cheating and stopping someone making hundreds of fake accounts. We do not use them to follow you around, and we cannot use them to work out who or where you are.
We do not ask for your real name, your birthday, your address, your phone number, or a photo. Please do not send those to us.
4. Your password never reaches us
Your password is scrambled inside your own browser before it is sent. We never see it, we cannot recover it, and we cannot tell anyone what it is.
Most websites receive your real password and then scramble it. We do not. Your browser scrambles it first, using a slow, deliberate process called PBKDF2-SHA256 that repeats 600,000 times. That is why signing in takes a moment.
Only the scrambled result leaves your device. Our server then scrambles that again before saving it. So:
- We cannot read your password.
- We cannot email it to you.
- If someone ever stole our whole database, they still would not have your password.
The trade-off is real and we will say it plainly: because we genuinely do not have it, nobody at Vega Bell can look your password up for you. Keep it somewhere safe.
5. What other players can see
Your nickname, your country, your score, your Orbit and your tier. Nothing else.
When you appear on a leaderboard, other players see exactly five things: your nickname, your country, your score, your Orbit and your tier. (If you switched your school year on yourself, that shows too. It is off unless you turn it on.)
Your email is never shown. Your parent's email is never shown. Your word history is never shown. Your times, your device and your internet address are never shown.
Be careful with your nickname
A nickname is public and can be seen by anyone in the world. Do not use your real full name, your school, your town, or your birthday. We say this at sign-up too, in the same plain words. Made-up names are more fun anyway.
6. What we never do
No adverts, no tracking, no selling, no profiling. This is not a promise we can quietly break. There is nothing in the game that does these things.
- No advertising. There are no ads in Vega Bell, and none aimed at children or anyone else.
- No analytics trackers. No Google Analytics, no pixels, no third-party scripts watching you play.
- No selling your data. Not to advertisers, not to data brokers, not to anyone, not for any price.
- No third-party marketing. We do not hand your email to other companies so they can message you.
- No profiling. We do not build a picture of who you are to target you with anything.
- No behavioural ads. Nothing you do in the game follows you to another website.
The only thing the game measures about you is how good you are at spelling, and it uses that to choose your next word.
7. Why we are allowed to hold your data
Mostly because we cannot run the game for you without it. For the anti-cheat parts, because a fair game needs them.
If you are in the UK, the EU, or somewhere with similar rules, the law wants us to name our "lawful basis" for each thing we hold. Here it is, in plain English:
| What | Why we are allowed to |
|---|---|
| Email, password material, nickname, country | Contract. You asked us to give you an account. We cannot without these. |
| Scores, words seen, streaks, tier | Contract. This is the game. Without it there is no progress and no leaderboard. |
| School year (optional) | Consent. Off by default. You choose to switch it on, and you can switch it off again. |
| Hashed IP, device hash, timings | Legitimate interests. Keeping the leaderboards honest and stopping fake accounts. We use scrambled values so this is the least intrusive version we could build. |
| Parent email and consent record (under-13s) | Legal obligation and consent. Children's privacy law requires us to get and keep this. |
9. Companies that help us run the game
Cloudflare runs our servers and database and follows our instructions. Our words and pronunciations come from Wiktionary and dictionaryapi.dev. That is the whole list.
Cloudflare
Cloudflare hosts the website, delivers it to you quickly, and stores the database. In legal terms Cloudflare is our "processor": they handle data on our behalf, under a contract, and they are not allowed to use it for their own purposes.
Cloudflare Turnstile
When you sign up, a small check called Turnstile makes sure you are a person and not a robot making thousands of accounts. Turnstile is built to be privacy-friendly: it does not follow you across other websites and it is not an advertising product.
Wiktionary and dictionaryapi.dev
The words, definitions and pronunciation audio in the game originally come from Wiktionary and dictionaryapi.dev. We copy and store them on our own servers ahead of time. That means that while you play, your browser is not talking to those services and they learn nothing about you.
Anyone else?
No. We may also share information if a law or a court genuinely requires it, or to protect someone's safety, but we are not going to volunteer it, and there is very little to hand over.
10. Children and parents
Kids are welcome here. If a player is under 13, a parent or guardian has to agree first, and they can see or delete everything.
Vega Bell is built for players from about age 6 upwards. We follow the US Children's Online Privacy Protection Act (COPPA) and similar rules elsewhere.
If you say you are under 13 at sign-up, we ask for a parent or guardian's email and their explicit agreement before the account is created. We collect nothing extra from a child beyond what section 3 lists: no real name, no photo, no location beyond a country.
Parents: everything you need (what we hold, how to see it, how to delete it, how to withdraw your consent) is written for you on the Parents & COPPA page.
11. How long we keep things
Account data until you delete it. Half-finished games disappear after 30 minutes. Sign-ins expire after 30 days.
| What | How long |
|---|---|
| Your account and game history | Until you delete your account. Then it is gone. |
| The state of a game you are in the middle of | Swept away 30 minutes after it goes quiet. |
| Your sign-in session | 30 days, then it expires and you sign in again. |
| Leaderboard rows after you delete your account | Kept, but anonymised: your nickname is replaced so past standings still add up. |
12. Your rights, and the buttons that do them
You can download everything we hold about you, and you can really delete your account, both from inside the game.
We did not want rights that only exist on paper, so two of them are buttons:
- Download my data. In your account settings. It gives you a file with your account details and your run history. (It is the
GET /api/account/exportroute, if you like knowing that sort of thing.) - Delete my account. Also in your account settings. You type your nickname to confirm, and then it is actually deleted: your account, your sessions, your word history and your runs are removed from the database, not just hidden. This cannot be undone. Old leaderboard rows stay, but with your nickname replaced by "deleted player" so past results still make sense. (Route:
POST /api/account/delete.)
You also have these rights, and you can use them by emailing privacy@vegabell.com:
- See what we hold (access).
- Fix something wrong (correction). Most of it you can edit yourself in settings.
- Ask us to stop using something (objection or restriction), especially the anti-cheat data.
- Take your data elsewhere (portability). The export file is designed for this.
- Take back a consent you gave, such as showing your school year. Turning it off in settings is enough.
- Complain to a regulator in your country if you think we have got this wrong. We would rather you told us first, but it is your right either way.
We do not charge for any of this, and we will not make you jump through hoops. We aim to reply within [RESPONSE TIME: e.g. 30 DAYS].
13. Where your data is stored
On Cloudflare's network, which spans many countries. If your data leaves your region, an approved legal safeguard covers it.
Vega Bell runs on Cloudflare, whose servers are all over the world. That is what makes the game fast wherever you are, but it also means your information may be handled outside the country you live in.
When information leaves the UK or the European Economic Area, we rely on [TRANSFER MECHANISM: e.g. STANDARD CONTRACTUAL CLAUSES + UK ADDENDUM] in our contract with Cloudflare. Our main database region is [PRIMARY DATABASE REGION]. You can ask us for a copy of these safeguards at privacy@vegabell.com.
14. How we protect it
Everything travels encrypted, passwords never arrive at all, and internet addresses are scrambled before they are stored.
- The whole site is served over HTTPS, so nothing you send travels in the open.
- Your password is scrambled in your browser and scrambled again by us (section 4).
- Your sign-in cookie cannot be read by scripts and is not sent to other sites.
- Internet addresses are hashed before storage. We keep the jumble, not the address.
- We hold as little as possible, on purpose. The safest data is the data we never collected.
No system is perfectly safe, and we will not pretend otherwise. If something goes badly wrong we will tell affected players (and, where the law requires, the relevant regulator) without dragging our feet.
15. Extra rights depending on where you live
Some places give you extra rights. We apply the strongest protections to everyone anyway.
UK and Europe (UK GDPR and EU GDPR)
Everything in section 12 applies to you, plus the lawful bases in section 7 and the transfer safeguards in section 13. You can complain to your national data protection authority. In the UK, that is the Information Commissioner's Office.
California (CCPA and CPRA)
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We have never done either, including for anyone under 16. There is no "Do Not Sell or Share My Personal Information" link because there is nothing for it to switch off. You still have the right to know what we hold, to delete it, to correct it, and not to be treated worse for asking, all covered by section 12.
United States, children
See the Parents & COPPA page. Under COPPA, parents can review their child's information, ask us to delete it, and refuse to let us collect any more.
Everywhere else
Vega Bell is played worldwide. Your local law may give you rights that are not named on this page: Brazil's LGPD, Canada's PIPEDA, Australia's Privacy Act and many others. If your law gives you a right, you have it here. Write to us and we will honour it.
16. Changes to this policy
If we change something important we will tell you in the game before it takes effect. For under-13 accounts we ask parents again.
We will update this page when the game changes, and the "Last updated" date at the top will always tell you when.
If a change actually matters (new data collected, a new company involved, a new purpose), we will show a clear notice in the game and email account holders before it starts. If the change affects what we collect from a child under 13, we will ask the parent or guardian to agree again. We will not sneak anything past you in a quiet edit.
Old versions are available on request from privacy@vegabell.com.
17. Contact us
Email privacy@vegabell.com. A real person reads it.
Privacy questions
- Email privacy@vegabell.com
Tell us your nickname (not your password; we could not use it anyway) and what you would like us to do. If you are a parent asking about a child's account, say so, and read the Parents & COPPA page first. It will probably answer you faster.