Privacy Policy

1. Who We Are

Data Controller: Astroshock SL, Barcelona, Spain.

Astroshock SL is the data controller responsible for processing personal data under applicable data protection laws, including the General Data Protection Regulation (GDPR).

2. Information We Collect

We collect only the data necessary to operate and improve the Service.

Account Information

When you create an account or sign in using third-party authentication providers (such as “Sign in with Apple” or “Sign in with Google”), we may receive:

• Your name (if shared)
• Your email address (if shared)
• A unique identifier provided by the authentication service

You are not required to use your real name.

User Content

We process content you choose to create in Wordbox, including:

• Boxes
• Words and meanings
• Notes
• Optional profile information
• App or Service settings

This content exists to provide the core functionality of the Service.

Usage Data

We collect usage data (such as screen views, session duration, and feature usage), which may be associated with an internal user or session identifier and does not directly identify you. This data is used solely to understand how Wordbox is used and to improve the Service.

Referral Information

If you arrive through a partner’s referral link, or open another user’s public page or box, we record where you came from: the partner’s referral code, or the user whose page you opened, and the date. We use it to credit the right partner or user if you later subscribe.

Before you have an account, this is stored on your device and only if you accept analytics cookies — without your consent it exists only until the page is reloaded or closed. It expires after 90 days. Once you create an account it is stored with your account.

This record contains no information about you: it identifies the person who referred you, not you.

3. How We Use Your Information

We use personal data to:

• Provide and operate the Service
• Authenticate users and manage accounts
• Sync and store content across devices and platforms
• Improve functionality, usability, and performance
• Respond to support requests and user inquiries
• Send service-related communications, such as important updates about Wordbox

If you choose to receive optional product updates or promotional communications, you may opt out at any time through your device settings or the unsubscribe instructions included in the relevant message.

4. Legal Basis for Processing

We process personal data based on one or more of the following legal grounds:

• Performance of a contract — to provide the Service you request
• Legitimate interests — to maintain, secure, and improve Wordbox
• Consent — where required by law, for optional communications or features

5. Data Sharing and Third Parties

We do not sell your personal data.

We may share your data with:

• Authentication providers (such as Apple or Google) to enable login
• Analytics providers for aggregated and pseudonymized usage analysis
• Payment providers — Stripe processes subscription payments on our behalf
• Our affiliate platform — Rewardful, so that partners who refer customers to us can be paid. Through our payment provider it receives your name and email address, the amount of a subscription payment, and the referring partner’s code. It does not receive anything you create in Wordbox. Partners themselves never see your email address, and on our plan they do not see names either. With your consent it also records visits arriving through a partner’s link.

Transfers outside the European Economic Area. Rewardful Inc. is established in Canada, and engages its own service providers in the United States and Ireland. Personal data transferred to them is protected by the European Commission’s Standard Contractual Clauses, which form part of our data processing agreement with them and which their agreement obliges them to pass on. Their current list of providers is published in their Trust Center.

We may disclose personal data if required to do so by law or valid legal process.

6. Data Storage and Security

Personal data is stored on secure servers and protected using appropriate technical and organizational measures, including encryption and access controls.

While no system can guarantee absolute security, we take reasonable steps to safeguard your data.

We do not store full payment card details on our servers.

7. Data Retention and Deletion

We retain personal data only for as long as necessary to operate the Service.

You may delete your account at any time. Upon account deletion, your User Content is removed from active systems used to operate Wordbox.

Limited retention may apply where necessary for backups, security, or legal obligations.

Referral information is stored with your account and is deleted when the account is deleted. We keep it to calculate partner commissions and to resolve any dispute about them.

Invoices and payout records relating to partner commissions are separate from this and are kept for as long as Spanish law requires commercial and accounting records to be retained.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access your personal data
• Correct inaccurate or incomplete information
• Delete your account and associated data

Please contact us at wordbox@astroshock.com for any such requests.

9. Children’s Privacy

Wordbox is not intended for children under the age of 13.

In jurisdictions where a higher minimum age for valid consent applies (up to 16), we do not permit use without appropriate parental consent.

If we become aware that personal data has been collected from a child without valid consent, we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time.

Material changes will be communicated through the Service or official Wordbox channels. Continued use of the Service after changes take effect indicates acceptance of the updated policy.

11. Contact

If you have questions or concerns about this Privacy Policy, please contact us at wordbox@astroshock.com.