KALIMĀTPrivacy policy
Your privacy
Effective 28 September 2026 · applies to the Kalimāt app (com.haqqword.app) and this website
- Offline play needs no account and sends nothing about you to us. Progress stays on the phone.
- Online play is off until you turn it on behind a simple check (a small sum written in words). Only then is a player account made on our server.
- We collect as little as possible: a first name or generated name, an emblem, an optional country, game results and a progress backup. An email only if you add one.
- No ads, no analytics or tracking tools, no in-app purchases, no chat. We never sell or share data for advertising.
- You can delete your player and all its data from inside the app at any time.
Who we are
Kalimāt is an Arabic word-search game for everyone, published on Google Play and the Apple App Store by the developer named on its store page. In this policy “we” means that developer. For any privacy question or request, write to privacy@haqqword.wees.bio.
Kalimāt is for everyone, including children, and follows the Google Play Families policy. We do not knowingly collect more information from anyone, a child included, than the game needs, and online features stay off until they are turned on behind a simple check.
1. Playing offline (the default)
When you play the journey, the word packs, the daily puzzle or the Qur’an words, everything is saved only on the phone: the first name typed at the start, the country picked from the list, stars, levels, the words learned, streaks and settings. We do not receive it.
To stay up to date, the app downloads public information from our server: game settings, seasonal events and the list of recorded word pronunciations. These requests carry no name, account or device identifier. Like every website, our server sees the phone’s IP address when it answers them (see “Server logs” below).
The daily reminder, if you turn it on, is scheduled on the phone itself.
2. Online play (turned on by you)
Races, challenges, friends, rankings and tournaments need a player account on our server. The app creates one only after online play is turned on behind the check. This is what the account holds:
| Information | Why we need it | Who can see it |
|---|---|---|
| Player name: a first name checked against a list of unsuitable words, or a generated name such as “Calm River 12” | To show who is playing in races and rankings | Other players |
| Emblem (one of 16 pictures, no photos) and country flag (optional, chosen from a list) | To show next to the name; country rankings | Other players |
| Friend code (random, 6 characters) | So friends can add each other | Anyone you share it with |
| Game results: type of puzzle, points, stars, time and number of words found, with the date | Leaderboards, the Jumuʿah ranking, the community masjid | Other players see scores, not the details |
| Progress backup: levels, stars, learned words, streak and settings | To restore the player on another phone | Only the player |
| Friends, friend requests, live game moves, challenge attempts and tournament entries | To run games between players | The players in that game |
| Preset phrases and reactions sent in a game (for example “Well played!”) | Friendly play without free chat | The players in that game |
| Sign-in key (random, stored only in scrambled form) and the time the player was last online | To keep the player signed in; to show friends who is online | Only our system |
| Push notification token and phone type (Android or iOS), only if notifications are allowed | To tell the player about a friend’s invite, a race or a tournament round | Only our system |
Nothing can be typed to other players. There is no free chat, no photos, no voice and no location. We never ask for your full name, email, phone number, address or school.
Email (optional)
You can add an email and a password so the player can be restored on another phone. We use the email only to sign in and to send a password reset code when asked. The password is stored only as a secure hash. We do not send newsletters or marketing.
3. What the app never does
- No advertising, no advertising ID, and no advertising or analytics tools of any kind.
- No in-app purchases or payment details.
- No access to the camera, microphone, contacts, photos or location. Word pronunciation uses the phone’s own text-to-speech voice or recordings uploaded by our team.
- No selling, renting or sharing of personal information for advertising or with data brokers.
4. Services that help us
- Our web host runs the server and database that store online accounts.
- Expo push service (Expo, with Google Firebase Cloud Messaging on Android and Apple Push Notification service on iPhone and iPad) delivers notifications. It receives the push token and the notification text, for example “Your friend invited you to a race”.
- Email delivery from our server is used only for password reset codes to the email you added.
- Google Play and the Apple App Store distribute the app. Google’s and Apple’s own privacy policies cover your Google account or Apple ID and downloads.
These providers only process data to provide their service to us. We may also disclose information when the law requires it.
5. Server logs and security
Like any website, our server keeps short technical logs of requests, including IP addresses, to run and protect the service. To stop abuse, we count sign-in attempts and new accounts per IP address for up to one day. All connections use HTTPS. Only a small team of administrators, each with their own sign-in and two-step verification available, can see player accounts, for example to answer a deletion request or to remove an unsuitable name.
6. How long we keep it
- An online player is kept until you delete it in the app or at our request.
- Sign-in keys unused for 180 days, in-game phrases and reactions after 30 days, and abuse counters after one day are removed during regular maintenance.
- When a player is deleted, its account, results, progress backup, friends, games, challenges, notifications and push tokens are deleted from our database straight away. Tournament brackets keep an empty place, and server backups roll over within a short time.
7. Your choices and rights (and parents’)
- Turn online play off: Me → gear icon → Online play & account → Turn off online play. The player is hidden from rankings and friends.
- Change the name, emblem or country: Me → gear icon → Online play & account.
- Turn notifications off: in Settings in the app, or in the phone’s settings.
- Delete everything: Me → gear icon → Online play & account → Delete this player. See delete your account for other ways.
- See or correct data, or ask a question: write to privacy@haqqword.wees.bio. We answer within 30 days. Depending on where you live (for example under the GDPR, UK GDPR or COPPA) you may have further rights, including to complain to your data protection authority.
Uninstalling the app removes everything stored on the phone. It does not delete an online player from our server, so please delete the player first.
8. This website
haqqword.wees.bio uses no cookies, no analytics and no trackers. Its fonts are loaded from Google Fonts, which receives your IP address to deliver them.
9. Changes
If we change what we collect, we will update this page and its date, and, for important changes, tell players in the app before they apply.