Privacy policy
Last updated: August 2026
Summary
FiveLetterWords does not require an account. Preferences, game progress, the post-game scorebook and Wordle Wrapped statistics are saved in your browser. A separate Wordle Observatory accepts a minimized game record only when you explicitly tick its consent box and submit it. The site uses Google Analytics and Plausible to measure traffic, and Mediavine Grow supplies an optional engagement feature.
The site also carries advertising, sold and served through Journey by Mediavine. Advertising brings in further companies that this page does not list one by one, because the list changes; the Advertising section names the network, links its current partner list, and describes the consent tool that records your advertising choices. All of these third parties may receive the request and device data described below.
Cookies & similar technologies
The site uses the following browser storage:
- First-party localStorage: Theme, display settings, statistics and saved game state. These records are saved locally rather than synced to an account. A value may still be sent when you submit it to a server-backed tool, as explained below.
- First-party timezone cookie: The browser's IANA timezone name (for example,
Europe/London) is kept for up to one year so “today,” “yesterday,” and recent Wordle answers follow your local calendar. It is not a GPS location and is not used for advertising. - Third-party cookies and identifiers: Google Analytics 4 may set cookies to measure site use and traffic quality. Advertising partners may set cookies or read device identifiers to select, cap and measure ads. Other third-party services may use identifiers under their own policies.
- Consent records: The ad network's consent tool stores your advertising choices in your browser under its own names, so it does not have to ask again on every page. Those names are not prefixed like the site's own keys, so Settings → Clear All Data does not remove them.
You can remove localStorage and cookies through your browser. The analytics controls supported by this site are described under Analytics; advertising choices are handled separately and are described under Your advertising choices.
Data stored locally
The application uses your browser's localStorage for the following records. They are not synchronized to a FiveLetterWords account:
- Preferences: Theme (light/dark), color-blind mode, display settings
- Game Statistics: Games played, win rate, streak, guess distribution
- Game State: Current game progress (if you leave mid-game)
- Post-game scorebook: Imported or saved puzzle number, outcome, turn count, optional opener, optional Hard Mode status and decision summary. Wordle Wrapped calculates its recap from these local records without uploading the scorebook.
- Observatory withdrawal receipts: A separate random token for each contributed puzzle. Both contribution surfaces reuse the same puzzle token to avoid accidental duplicates. A scorebook export includes these withdrawal capabilities and should be kept private.
You can clear the records above anytime via Settings → Clear All Data, or by clearing your browser's site data. Clear All Data sweeps the keys this site writes under its own prefixes; it does not reach the consent tool's advertising choices or advertising cookies set by other companies, which are changed in the consent tool or cleared with your browser's site data. Clearing browser data does not contact the server to withdraw an Observatory record and removes its local withdrawal receipt, so withdraw any wanted contribution from Post-Game Review first.
Solver and review requests
Some tools run in your browser, while others use a FiveLetterWords API or fall back to it when the browser engine is unavailable. Those requests can include the guesses, tile feedback, pattern or word you submit so the server can calculate a response. Specific guesses are not included in the site's analytics events, and FiveLetterWords does not create a puzzle-history account or profile from these requests.
Optional Wordle Observatory contributions
Nothing is contributed merely by visiting, pasting a grid, requesting a review or saving a game locally. After a review, or on a verified current or former answer's word page, you may separately tick a consent box and submit one minimized record. The Observatory store retains:
- the puzzle number and whether it was solved, represented by a turn count from 1–6 or X;
- Hard Mode status, opener, 1–5 difficulty opinion and decision-efficiency bucket only when available or supplied; and
- a one-way hash of a random per-game token, used only to prevent a retry from creating a duplicate and let that game be withdrawn.
On a word page, the answer word and browser timezone are sent only so the server can verify that the selected puzzle is a genuine appearance of that answer; neither is copied into the stored Observatory record. The store does not retain the answer, colored grid, later guesses, account, email address, user-agent, IP address or a reusable visitor identifier. Ordinary hosting and security logs may still process request details as described in “Server logs” below, but those logs are separate from the Observatory dataset.
Puzzle and opener subgroups are published only after the displayed minimum sample, and live puzzles stay hidden until completed in every timezone. Each optional average or share must independently reach that sample, and low-count result cells receive complementary suppression. Decision efficiency is reduced to five-point buckets. The downloadable Observatory file contains aggregates, not individual records.
The browser-held per-game token can be used to withdraw a contribution from either contribution surface. Individual records remain while the Observatory operates unless withdrawn; already downloaded aggregate releases cannot be recalled. Because the server stores only the token's one-way hash and no account, losing every local copy of that token means FiveLetterWords cannot identify which anonymous row was yours.
Server logs
Like most websites, our server may log basic request information for operational purposes:
- IP address (may be anonymized)
- Request timestamp
- Requested URL path
- HTTP status code
- Browser user-agent string
Request logs are used for operation, debugging and security monitoring, not to build user profiles. Their retention and deletion follow the hosting provider's log configuration. API rate limits are shared across the site's machines using temporary Redis keys: before an address becomes a limiter key, the application replaces it with a secret-keyed digest. Those operational keys expire with their rate-limit window and remain separate from Observatory records.
Third-party services
- Hosting and Observatory storage: Fly.io runs the application, and its Upstash Redis integration stores the minimized Observatory records and aggregates shared by the site's two application machines. These providers process data under their own service terms; Redis credentials stay server-side and are never sent to the browser.
- Advertising: Journey by Mediavine sells and serves the advertising on this site and supplies the consent tool. Filling an ad slot involves other advertising companies, which your browser contacts directly and which act as independent recipients under their own policies. This list does not name them individually because the set changes; Mediavine publishes the current one at mediavine.com/ad-partners. See Advertising below.
- Analytics and audience engagement: Google Analytics 4 and Plausible measure site usage. Mediavine Grow supplies an optional audience-engagement feature. FiveLetterWords does not send names, email addresses, account data or specific word guesses through its own analytics events.
- Dictionary lookups: Word pages use a bundled offline Wiktionary-derived cache and do not make a third-party request. If the separate definition API is used for an uncached entry, the FiveLetterWords server may request that word from
dictionaryapi.dev; the provider receives the requested word and the server request, not a direct request from your browser. - Daily Wordle lookup: When the local answer record has not yet been updated, the FiveLetterWords server may request the puzzle for that date from the New York Times Wordle API. The request is made by the server and contains the date, not your guesses or browser identifiers.
- Daily Crossword page: /daily-crossword contains an isolated frame from Solve The Crossword. Visiting that page causes your browser to load the puzzle directly from
solvethecrossword.com. The provider can process request and device details, load its own services, and save puzzle progress under its own origin according to its policies. FiveLetterWords cannot read that cross-origin progress. Neither the site's Do Not Track and Global Privacy Control gate, which covers this site's own analytics scripts, nor the advertising consent tool governs anything inside the provider's frame. - Fonts: We self-host fonts to avoid external requests.
Analytics
This section covers measurement only. Advertising is described under Advertising.
Google Analytics 4 and Plausible measure page visits and feature use. Mediavine Grow may load an engagement widget. Depending on the service, they may process cookies or other identifiers, your IP address, approximate location, and basic browser or device information under their own policies. FiveLetterWords does not use its own events to build advertising profiles. An Observatory success event contains no puzzle number, result, difficulty opinion, Hard Mode status or withdrawal token. See Google's privacy policy for its handling of analytics data.
Your choices
The site's measurement scripts (Google Analytics, Plausible event loading and the Mediavine Grow initializer) are skipped when your browser sends a Do Not Track or Global Privacy Control (GPC) signal. You can enable one of those signals in a supporting browser or extension. These scripts also follow the choice recorded in the ad network's consent tool.
That signal gate applies to measurement only; it does not gate the advertising code. The advertising code is what loads the consent tool, so skipping it on a signal would take away the control rather than apply it. Advertising choices are made in the consent tool instead, as described under Your advertising choices.
Browser settings can also block third-party scripts or cookies, and can clear data already stored.
Data security
We implement reasonable security measures including:
- HTTPS encryption for all connections
- Security headers (Content-Security-Policy, X-Frame-Options, etc.)
- No account forms or requests for sensitive personal details
Your rights
You control the game data saved by the application in localStorage:
- Access: View your data in browser DevTools → Application → localStorage
- Delete: Use Settings → Clear All Data to remove the records this site saves under its own keys. It does not remove the consent tool's stored advertising choices or cookies set by advertising partners; clear those in the consent tool or with your browser's site-data controls
- Copy: Many saved game records use JSON and can be copied through the same browser tools
An Observatory contribution can be withdrawn with its browser-held per-game token as described above. Server logs and third-party analytics data are separate from localStorage. For a privacy question or a request concerning data held by FiveLetterWords, email [email protected]. Requests concerning a third-party service may need to be directed to that provider.
Children's privacy
FiveLetterWords is not directed specifically at children and does not offer accounts or ask visitors to submit personal details. It is not intended for children under 13, and the site does not knowingly collect personal data from them. Standard request logs, the advertising described above and the other third-party services may still process technical data when the site is visited. FiveLetterWords does not knowingly sell or share the personal information of anyone under 16 for advertising.
If you believe a child has provided personal data through this site, email [email protected] and it will be deleted.
Changes to this policy
We may update this privacy policy occasionally. Significant changes will be noted by updating the "Last updated" date at the top of this page.
Advertising
FiveLetterWords carries advertising. The ads are sold and served through Journey by Mediavine, an advertising network operated by Mediavine. The site does not sell ad space directly and does not choose which particular ad you are shown.
An ad slot is filled by an automated auction. That auction involves other advertising companies (demand partners, exchanges and measurement providers), and your browser contacts them directly rather than through this site's server. They are independent recipients: they decide their own purposes for the data they receive and handle it under their own privacy policies, not under this one. Mediavine publishes the current list of those companies at mediavine.com/ad-partners. The list changes, so this page links it instead of copying it.
In requesting, capping and measuring an ad, those companies can receive your IP address and an approximate location derived from it, your browser and device details, the page you are on and the page you arrived from, cookies or other device identifiers, and whether an ad was rendered, viewed or clicked.
Ads may be personalized using that data, which means an ad can be selected from a profile built up across other sites rather than from this page's subject alone. Where personalized advertising is not permitted, ads are selected from the page context instead. A non-personalized ad still requires a request to the ad network, and it is still counted and measured.
Journey by Mediavine also provides the consent management platform this site uses: the tool that asks for your advertising choices and records them, loaded by the advertising code itself. FiveLetterWords does not decide, and cannot report, what each partner does with the data once the request has left your browser.
Your advertising choices
Advertising consent is handled by the consent management platform described above, not by this site's Do Not Track and Global Privacy Control gate. That gate covers this site's measurement scripts only.
You can change a choice you have already made by reopening the consent tool with the Your privacy choices control, which also appears in the footer of every page. Advertising cookies and identifiers set by other companies can also be blocked or deleted in your browser's settings.
Several industry programs offer their own opt-out pages covering their participating companies:
- Network Advertising Initiative: optout.networkadvertising.org
- Digital Advertising Alliance: optout.aboutads.info
- DAA AppChoices, for mobile apps: youradchoices.com/appchoices
Those opt-outs are themselves stored as cookies, so clearing your browser data clears them as well and they have to be set again. The same is true of the consent tool's record and of any opt-out described below: with no account, every choice is recorded against the browser you made it in.
If you cannot find or use the consent tool, email [email protected].
Mediavine Programmatic Advertising (Ver 1.1)
The Website works with Mediavine to manage third-party interest-based advertising appearing on the Website. Mediavine serves content and advertisements when you visit the Website, which may use first and third-party cookies. A cookie is a small text file which is sent to your computer or mobile device (referred to in this policy as a "device") by the web server so that a website can remember some information about your browsing activity on the Website.
First party cookies are created by the website that you are visiting. A third-party cookie is frequently used in behavioral advertising and analytics and is created by a domain other than the website you are visiting. Third-party cookies, tags, pixels, beacons and other similar technologies (collectively, "Tags") may be placed on the Website to monitor interaction with advertising content and to target and optimize advertising. Each internet browser has functionality so that you can block both first and third-party cookies and clear your browser's cache. The "help" feature of the menu bar on most browsers will tell you how to stop accepting new cookies, how to receive notification of new cookies, how to disable existing cookies and how to clear your browser's cache. For more information about cookies and how to disable them, you can consult the information at All About Cookies.
Without cookies you may not be able to take full advantage of the Website content and features. Please note that rejecting cookies does not mean that you will no longer see ads when you visit our Site. In the event you opt-out, you will still see non-personalized advertisements on the Website.
The Website collects the following data using a cookie when serving personalized ads:
- IP Address
- Operating System type
- Operating System version
- Device Type
- Language of the website
- Web browser type
- Email (in hashed form)
Mediavine Partners (companies listed below with whom Mediavine shares data) may also use this data to link to other end user information the partner has independently collected to deliver targeted advertisements. Mediavine Partners may also separately collect data about end users from other sources, such as advertising IDs or pixels, and link that data to data collected from Mediavine publishers in order to provide interest-based advertising across your online experience, including devices, browsers and apps. This data includes usage data, cookie information, device information, information about interactions between users and advertisements and websites, geolocation data, traffic data, and information about a visitor's referral source to a particular website. Mediavine Partners may also create unique IDs to create audience segments, which are used to provide targeted advertising.
If you would like more information about this practice and to know your choices to opt-in or opt-out of this data collection, please visit National Advertising Initiative opt out page. You may also visit Digital Advertising Alliance website and Network Advertising Initiative website to learn more information about interest-based advertising. You may download the AppChoices app at Digital Advertising Alliance's AppChoices app to opt out in connection with mobile apps, or use the platform controls on your mobile device to opt out.
For specific information about Mediavine Partners, the data each collects and their data collection and privacy policies, please visit Mediavine Partners.
UK and EU data protection
Who is responsible. FiveLetterWords is an independent site run by an individual, Matthew, not by a company. He is the controller for the personal data described in this policy and can be reached at [email protected]. The site's terms are governed by the law of England and Wales, so the UK GDPR and the Privacy and Electronic Communications Regulations are the home regime; the EU GDPR applies to visitors in the EEA.
Advertising partners are separate controllers. The companies described under Advertising decide their own purposes for the data your browser sends them. For that processing they are controllers in their own right, and a request about it has to be made to them.
Why this site processes data, and on what basis:
- Running the site (legitimate interests): serving pages, request logs, debugging and the rate limiting that keeps the API available. Storage that is strictly necessary for a page to work, such as the timezone cookie and the game state your browser keeps, rests on that basis rather than on consent.
- Analytics and advertising storage (consent): Google Analytics, Plausible, the Mediavine Grow initializer and the advertising partners' cookies and identifiers are used on the basis of the consent recorded by the consent tool. You can withdraw that consent at any time; withdrawing it does not make the processing already carried out unlawful.
- Wordle Observatory contributions (consent): a game record is stored only after you tick its consent box and submit it, and it can be withdrawn using the token your browser holds.
How long data is kept. Records in your browser stay until you clear them. An Observatory record stays while the Observatory operates unless you withdraw it, and aggregate releases that have already been downloaded cannot be recalled. Request logs follow the hosting provider's log configuration, and rate-limit keys expire with their window. Data held by analytics and advertising partners is kept under their own retention rules, which this site does not set and cannot shorten.
Your rights. You can ask for access to your personal data, its correction or erasure, restriction of or objection to its processing, and a portable copy, and you can withdraw a consent you have given, including the consent that allows personalized advertising. There is no account here and no reusable visitor identifier, so for most records FiveLetterWords cannot tell which rows are yours. An Observatory withdrawal token is the one case where a record can be matched, and then only to remove it. That limit is a consequence of collecting as little as possible, not a refusal to help.
Data outside the UK. The hosting, analytics and advertising providers named in this policy are largely based in the United States, so using this site involves personal data being processed outside the UK and the EEA. Each provider sets out in its own terms how it covers those transfers. FiveLetterWords does not negotiate separate transfer terms with individual advertising partners, because those companies act as their own controllers.
Complaints. Raise a concern with the controller first, at the address above. You can also complain to the UK's supervisory authority, the Information Commissioner's Office, at ico.org.uk/make-a-complaint. If you are in the EEA, you can complain to the supervisory authority for your country instead.
California privacy rights
FiveLetterWords does not sell personal information for money. California law defines the terms more broadly than that: making personal information available to an advertising partner so it can select ads across different sites is "sharing" for cross-context behavioral advertising, and can also count as a "sale". The advertising described above works that way, so this site treats it as a sale and share and tells you how to stop it rather than arguing about the label.
The categories involved are identifiers such as cookie and device IDs, internet activity meaning the pages you view here and the page you arrived from, coarse location inferred from an IP address, and inferences an advertising partner draws from those. FiveLetterWords does not collect government identifiers, payment details, precise geolocation or the other categories California treats as sensitive personal information.
To opt out of sale and sharing: turn off personalized advertising in the consent tool — reopen it with Your privacy choices — described under Your advertising choices, and use the industry opt-out pages listed there. You can also email [email protected] with "Do Not Sell or Share" in the subject line; the request will be acted on and passed to the ad network. Because there is no account, an opt-out is recorded against the browser you set it in, so it has to be set again in another browser or after clearing site data.
California residents can also ask what personal information has been collected, ask for it to be deleted, and ask for it to be corrected, and will not be given a worse service for exercising any of these rights. Use the same email address. Where the data is held by an advertising partner rather than by this site, the request may have to be made to that company.