Last updated November 1, 2026

PRIVACY POLICY

LimiLetter is operated by Heise Meadows LLC, an Idaho limited liability company ("LimiLetter," "we," "us," or "our"). This Privacy Policy explains how we collect, use, disclose, and retain personal information when you use limiletters.com and related LimiLetter services (the "Service").

In brief: we use personal information to provide and secure the game, accounts, leaderboards, and reminders you request. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising.

1. Information we collect

We collect the following categories of personal information. Some information is collected only if you create an account, play the Daily Puzzles challenge, or enable an optional feature.

Account and profile information

This includes your email address, account identifier, authentication provider, authentication and verification records, public username, and the country and, for U.S. players, state you select. If you sign in with Google, Google provides the account information you authorize, such as your email address and profile identity. Authentication credentials are processed by Amazon Web Services (AWS); we do not receive your Google password or have access to your account password in readable form.

Gameplay and activity information

This includes puzzle outcomes, scores, moves and bans, achievement counts, active and elapsed time, streaks, stars, Daily Puzzle history, custom puzzles you create or complete, leaderboard results, campaign progress, tutorial completion, and related timestamps. Unfinished attempts, accessibility settings, and similar preferences may also be stored locally in your browser.

If you play through a supported AI assistant or connected app, the provider sends LimiLetter only the tool inputs needed for the requested game action. For an account-free agent game, we store an opaque game identifier, the selected puzzle, moves, current status, version, and timestamps. These games are separate from human attempts, accounts, history, and leaderboards. LimiLetter does not receive the rest of your assistant conversation through the game tools.

Device, network, and approximate location information

When the Service receives a request, we and our providers may process technical information such as IP address, browser and device type, timestamps, request and security logs, and a coarse country and region inferred by our delivery provider. The inferred location is private telemetry and does not replace the leaderboard location you select. Daily Puzzle records store a keyed, non-reversible network-address fingerprint rather than a raw IP address.

Reminder and communication information

If you enable Daily Puzzle reminders, we process your verified account email and reminder preference or the push endpoint and encryption keys issued for each enabled browser. If you enable custom-puzzle updates, we process your per-puzzle in-app and email choices and create an update when another signed-in player first completes that puzzle. We maintain consent, dismissal, unsubscribe, and delivery records for Daily reminders so we can honor your choices, avoid duplicate messages, and monitor reliable delivery. Daily reminder emails do not use open pixels or tracked links. If you send feedback, we collect your rating, category, optional comment, related game result, application version, basic device information, coarse location, and a pseudonymous account or browser-session identifier. If you contact us, we collect the contents of your message and the information needed to respond.

Sources of information

We collect information directly from you, automatically from your browser or device when you use the Service, from your gameplay and account activity, and from providers involved in delivering the Service, such as AWS, Google when you choose Google sign-in or use LimiLetter as a Google Connected App, and browser push services.

Browser storage

We use local storage, session storage, and IndexedDB for authentication sessions, account preferences, game progress, attempt recovery, and other functions necessary to provide the Service. Choosing "keep me signed in" keeps authentication tokens in local storage; otherwise, they are kept in session storage. You can remove locally stored information through your browser settings, although doing so may sign you out or reset locally saved progress. We do not use third-party advertising cookies or third-party analytics on the Service.

First-party aggregate measurement

We record limited first-party events to understand how people find and use the Service. These events use fixed categories such as page type, referral category, anonymous or signed-in play mode, and completed or lost outcome. They do not include an email address, account identifier, target word, puzzle payload, precise location, raw referrer, or search query. Session storage keeps a coarse referral category and prevents duplicate events within a browser tab; we do not set an analytics cookie or create a persistent analytics visitor identifier.

2. How we use information

We use personal information only as reasonably necessary and proportionate to:

• create, authenticate, maintain, and delete accounts;
• provide gameplay, save progress, calculate results, and operate regional and global leaderboards;
• send email, browser, or in-app updates that you affirmatively request;
• secure the Service, prevent abuse and duplicate submissions, investigate errors, and enforce our terms;
• support users, respond to requests, and communicate about the Service;
• understand aggregate performance and improve reliability and features; and
• comply with law, protect rights and safety, and establish or defend legal claims.

We do not use automated decision-making to make legal, employment, lending, housing, educational, insurance, or similarly significant decisions about you.

3. When we disclose information

We disclose personal information only in the following circumstances:

• Public leaderboard. If you participate in the Daily Puzzles challenge, leaderboards may display your public username, selected country or state, points, move score, achievement counts, streak, star, bans, and active time. They do not display your email, authentication provider, IP address or fingerprint, observed location, or notification endpoint.
• Service providers. AWS provides hosting, content delivery, database, account authentication, security, email delivery, and reminder scheduling. Google provides sign-in when you select it and the Google Connected Apps interface when you invoke LimiLetter in a supported Google product. Browser and operating-system push services route notifications to enabled devices. These providers process information to perform services for us and under their own applicable privacy terms.
• Legal, safety, and enforcement. We may disclose information when we reasonably believe disclosure is required by law or necessary to protect the rights, safety, or security of users, the public, the Service, or LimiLetter; investigate fraud or abuse; or establish or defend legal claims.
• Business transfer. Information may be disclosed as part of an actual or proposed merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate confidentiality protections.
• At your direction. We may disclose information when you request or consent to the disclosure.

In the preceding 12 months, we have not sold personal information or shared it for cross-context behavioral advertising. We have disclosed identifiers, customer-record information, internet or other electronic activity, approximate geolocation, authentication-related information, and gameplay data to service providers for the business purposes described above. We do not knowingly sell or share the personal information of anyone under 16.

4. Retention

We retain each category of personal information only as long as reasonably necessary for the purposes described in this policy, including security, fraud prevention, dispute resolution, and legal compliance. Our principal retention periods are:

• account, profile, Daily Puzzle history, leaderboard, coarse location, and stored network-fingerprint data are generally retained while the account remains active and are removed from active systems when the account is deleted;
• active reminder preferences and push subscriptions are retained until disabled or the account is deleted; invalid push endpoints are removed when a push service reports that they are unusable;
• custom-puzzle notification preferences are retained with the puzzle while your account is active; in-app custom-puzzle notifications expire after approximately 90 days;
• reminder delivery records used to prevent duplicate messages expire after approximately 45 days;
• player feedback and its pseudonymous gameplay and device context are retained while reasonably useful for improving and supporting the Service;
• account-free agent game records expire automatically after approximately 48 hours;
• restricted delivery and access logs that may contain raw IP addresses are retained for approximately 30 days; and
• browser-stored data remains on your device until the Service removes it or you clear it through your browser.

We may retain limited information longer when reasonably required by law, to resolve disputes, prevent fraud or abuse, enforce agreements, or preserve security records. Deletion may not immediately remove information from short-lived backups maintained for continuity and disaster recovery.

5. Security and location of processing

We use reasonable administrative, technical, and organizational safeguards designed to protect personal information, including access controls, encryption in transit, restricted logs, and replacement of raw network addresses in Daily Puzzle records with keyed fingerprints. No system is completely secure, and we cannot guarantee that unauthorized access, loss, or misuse will never occur. We operate from the United States. Information may be processed in the United States and other countries where our providers operate, which may have different data-protection laws than your country.

6. Your choices and privacy rights

• Profile. You can review and correct your public username and selected leaderboard location in Account Settings, subject to the location-change limit shown there.
• Reminders. Email and browser reminders are off by default. You can disable either channel or all reminders in Account Settings. Reminder emails include an unsubscribe link, and browser notifications can also be blocked in your browser or operating-system settings.
• Custom-puzzle updates. You choose in-app and email updates separately for each custom puzzle when you create it, and can change either channel later in My Puzzles.
• Feedback. Sending feedback is optional. You can omit the written comment and contact us to request deletion of feedback that can reasonably be matched to you.
• Access, correction, copy, or deletion. You may request access to, correction of, a portable copy of, or deletion of personal information associated with you. Signed-in users can delete an account through Account Settings. You may also follow our account deletion instructions or email privacy@limiletters.com.

We may need to verify a request by asking you to sign in, respond from the email address associated with the account, or provide information reasonably necessary to match the request to our records. We use verification information only to process and document the request. An authorized agent may submit a request for you by emailing us and providing proof of authorization; we may also verify the request directly with you. We will not discriminate or retaliate against you for exercising a privacy right.

California disclosures

The California Consumer Privacy Act (CCPA) applies only to businesses that meet statutory criteria. Whether or not the CCPA currently applies to us, California residents may use the methods above to request that we disclose the categories and specific pieces of personal information we maintain, correct inaccurate information, provide a portable copy, or delete information, subject to applicable exceptions.

For purposes of the categories used in California law, the information described in Section 1 may include identifiers; customer records; internet or other electronic network activity; geolocation data at an approximate level; and sensitive personal information consisting of account log-in credentials used only to authenticate and secure the account. The sources, purposes, recipients, and retention criteria for these categories are described in Sections 1 through 4.

We do not sell personal information, share it for cross-context behavioral advertising, offer financial incentives for personal information, or use or disclose sensitive personal information to infer characteristics or for purposes that trigger a right to limit under the CCPA. For those reasons, we do not provide "Do Not Sell or Share" or "Limit the Use of My Sensitive Personal Information" links.

Browser privacy signals

Because we do not sell personal information or share it for cross-context behavioral advertising, opt-out preference signals such as Global Privacy Control do not change how we process information. We do not respond differently to legacy "Do Not Track" signals, which do not have a uniform industry meaning. We do not permit third parties to collect personal information across the Service over time for targeted advertising.

7. Children

The Service is for a general audience and is not directed to children under 13. You must be at least 13 to create an account. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and delete it.

8. Third-party services and links

The Service may link to or interoperate with third-party services. Their privacy practices are governed by their own policies, and this policy does not apply to information they collect for their own purposes.

9. Changes to this policy

We may update this policy to reflect changes to the Service, our practices, or law. We will post the revised policy with a new "Last updated" date and provide additional notice when required by law. Our use of information remains subject to the policy in effect when the information is processed.

10. Contact us

For privacy questions or requests, contact: