Privacy Policy

Last updated 11 October 2026

We collect as little as the game needs to work. This page says exactly what that is.

Last Word is run by eveninglight.dev (“we”). This policy covers the game at lastword.eveninglight.dev and the pages around it. You can reach us at contact@eveninglight.dev.

What we store

Your player name

When you play as a guest, you type a name and we add 8 random letters to make it unique. If you create an account, you choose a username. Your name is shown to opponents and, if you rank high enough, on the public leaderboard. Please do not use your real name or anything personal.

Your password, if you create an account

We never store your password itself, only a one-way scrypt hash of it. We cannot read it or send it back to you. We do not ask for an email address.

Your game history

For each finished ranked or friendly game we store who played, the start word, every move, who won, how it ended, the trophy changes and the time. Your trophies, wins and losses are shown on the leaderboard. The longest-games list shows player names with the full chain of words. Practice games against the computer are not stored.

Your sign-in session

When you play or log in, your browser keeps a random token so you stay signed in after a refresh. On our server only a hash of that token is stored, with the time it was created. An account can have up to 10 sessions at once.

What stays in your browser

We use your browser's local storage, not cookies. Two items are saved:

• lw.token: your sign-in token, so you stay signed in.
• lw.theme: whether you picked the light or dark look.

These are needed for the game to work or to remember your choice. Clearing your site data removes them; a guest account without its token cannot be recovered. We do not set cookies.

Your IP address

To stop abuse, the server counts sign-up and log-in attempts per IP address. That count is kept in memory for about a minute and is not written to the database. Our web server does not keep an access log. Error messages can include an IP address, and those logs are rotated so that only the most recent are kept. The network and hosting providers that carry your connection can see your IP address as part of delivering the site.

Analytics, advertising and third parties

• Analytics: none at the moment.
• Advertising: none at the moment. If we add advertising, we will update this page first to say who the partners are, what they collect, and how you can choose.
• Fonts and scripts: all fonts and scripts come from our own server. Your browser does not contact Google Fonts or any content delivery network to show the game.
• Meanings: when a word is not in our stored dictionary, our server asks Wiktionary (run by the Wikimedia Foundation) for its meaning. Only the word is sent, from our server, not from your browser, and the answer is saved so each word is looked up at most once.

We do not sell your information and we do not share it for marketing.

How long we keep things

• Accounts, game records and leaderboard entries are kept until you ask us to delete them.
• Database backups are kept for 14 days and then removed.
• Server error logs are rotated and only recent entries are kept.

Your choices and rights

You can ask us to show you the data we hold about your account, correct it, or delete it. Write to contact@eveninglight.dev with your player name; we may ask you to prove the account is yours by signing in. When we delete an account we remove your sign-in details and sessions, and past games you played keep the result but show an anonymous name instead of yours.

Depending on where you live, you may have further rights under laws such as the GDPR or UK GDPR, including the right to complain to your data protection authority. We will respond to requests within a reasonable time, normally within 30 days.

Children

Last Word is not aimed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Security

Passwords are hashed, sessions are random and stored hashed, and the site is served over HTTPS. No system is perfectly secure, so please use a password you do not use elsewhere.

Changes to this policy

If we change this policy in a way that matters, we will update the date at the top. Big changes, such as adding advertising or analytics, will be made on this page before they take effect.

Contact

Questions about privacy: contact@eveninglight.dev.