Privacy Policy

Archangel LLC, an Iowa limited liability company formed on September 28, 2026 and operating the WordCombi brand, is responsible for the processing described here. Contact: info@wordcombi.com, or PO Box 1122, Fairfield, IA 52556. Word matching, rhymes, and text calculations run locally after their resources load. Do not enter sensitive or identifying information into the tools.

Opening a definition sends the selected word to Datamuse and, if necessary, Free Dictionary API. Those services receive your IP address and other normal request information. A returned definition can be cached on your device. The resource download hosts also receive normal request information, even though they do not receive your unscrambler letter input.

The word tools have no in-tool account feature. If a platform sign-in is required by the site's access configuration or you choose an administrative login, the hosting authentication service processes the sign-in information. We do not describe that processing as anonymous or as nonexistent.

The Contact form opens a draft in your own email application. Nothing is submitted by that form until you send the email. We then receive your sender address, any name you include, and your message. Correspondence can be copied into our owner-managed CRM.

Browser local storage holds your consent choice, theme, recent searches, and saved words. Session storage holds your Terms acknowledgement and, only with analytics consent, a random analytics session ID. IndexedDB caches dictionary, pronunciation, and definition data. These functional preferences and caches are separate from tracking. Remove individual saved items with the tool controls, or clear this site's browser data to remove all local copies. Hosting authentication may use essential storage if you sign in.

Optional usage statistics remain off until you choose Accept cookies in the banner. Decline, and Continue without cookies, refuse optional analytics; neither removes storage essential for a requested feature such as saved words. Cookie Preferences in the footer withdraws the saved analytics choice and reopens the banner. The page sets all four Consent Mode v2 signals to denied on load, and the banner sends an update whenever you make or change your choice. Advertising consent remains denied. We do not load our own Google measurement or advertising tags, and do not claim that cookieless requests from any future Google tag would be anonymous.

Your consent choice and functional local data persist until removed or cleared by your browser. Session storage normally lasts for the tab's session and may be restored by some browsers. Dictionary and definition caches persist until the site's browser data is cleared or the browser evicts them. Refusing analytics does not clear your saved words or revoke your Terms acknowledgement.

WordCombi is a general-audience service that is not directed to children, and we do not ask for or knowingly collect personal information from children. Content filtering is best-effort and is not a safety guarantee. Adults who allow a child to use the site should supervise that use, including external links and definition lookups. Network identifiers, session identifiers, and information received by service providers can be personal information even without an account. A cookie-banner click is not verifiable parental consent. We do not treat the absence of registration, a general-audience label, or an advertising flag as proof of a COPPA exemption. Any future advertising or material change to children's data processing requires a separate assessment before activation. Parents may contact us to ask about, correct, restrict, or request deletion of a child's information. We promptly investigate and remove information collected contrary to applicable law, subject to any legally required preservation.

Our own optional analytics uses the session identifier only for internal page and tool usage measurement, not to contact a child, build behavioral profiles, or recognize users across sites or devices. Infrastructure providers process connection information to deliver resources and secure the service. We do not assume every provider or proposed use qualifies for COPPA's internal-operations exception; purposes, contracts, and retention must satisfy the applicable requirements.

Depending on where you live and which laws apply, you may request access, correction, deletion, restriction, portability, or an objection to processing, and withdraw consent without losing access to the tools. We do not sell information or use it for cross-context behavioral advertising. We honor Global Privacy Control by keeping optional usage analytics off. Contact the operator using the Contact page; we may request proportionate verification, not unnecessary identity documents. We respond within the applicable legal deadline, ordinarily one month for GDPR requests or 45 days for applicable U.S. state requests, and explain any lawful extension or refusal. You may appeal a refusal through the same contact channel and complain to your competent regulator. Exercising rights does not result in discriminatory treatment.

Where GDPR or UK GDPR applies, we rely on consent for optional usage analytics; legitimate interests in providing requested tools, answering correspondence, honoring opt-outs, and maintaining security; and legal obligation where a specific law requires processing. Legal-claim preservation may rely on legitimate interests rather than automatically being a legal obligation. Our interests must be balanced against your rights, with particular care for children. You may object to legitimate-interests processing.

Being accessible from Europe does not by itself settle GDPR territorial scope. If GDPR Article 3(2) applies, Article 27 generally requires an EU representative unless an exception applies. Its occasional-processing exception has cumulative conditions; a small audience, no advertising, or a low perceived risk alone is not enough. UK representative duties require a separate assessment. We have not appointed an EU or UK representative and do not claim a verified exemption.

We do not make solely automated decisions producing legal or similarly significant effects, or use information for behavioral profiling.

Applicable rights and business obligations depend on each law's scope, thresholds, and exceptions. California rights can include access, correction, deletion, portability, and opting out of sale or sharing. We do not sell information, use it for cross-context behavioral advertising, or offer payment for personal information. Cookie Preferences and the Contact page are available regardless of whether a particular statute applies to us.

Global Privacy Control suppresses our own optional usage analytics even if an acceptance was previously saved. A legacy Do Not Track header has no separate effect; you can decline optional analytics in the banner. The availability of a rights-request contact does not mean that every state privacy statute necessarily applies to this business.

Base44/Wix provides the application, hosting, authentication, and CRM record storage. Google provides our connected Gmail mailbox. GitHub's raw-content and Gist hosts deliver dictionary and pronunciation resources. Google Fonts delivers the site's fonts. Datamuse and Free Dictionary API provide requested definitions. Media hosts deliver images and other site assets. Their networks and subprocessors can process connection and device information to deliver and protect those services. These are different from our own analytics records.

Amazon hosts the product pages we link to from our resource lists, and the Amazon Associates program is the affiliate network used when an affiliate tag is configured; Amazon receives ordinary connection information when you open such a link, and its own cookies apply once you are on its site. Following an external resource or affiliate link exposes ordinary connection information to that destination. Each provider's policies and actual contractual role govern its own processing. We do not promise that every provider acts only as our processor, has a particular deletion schedule, or is barred from all independent processing without verifying its terms.

We operate in the United States; providers may process information there and elsewhere. Where transfer restrictions apply, the actual recipient and service must be covered by a valid mechanism, such as an applicable adequacy decision or appropriate contractual safeguards. We do not assert that any named provider is certified under a transfer framework or that contractual clauses have been signed without checking the relevant service terms. Contact us about safeguards for your information.

Google AdSense and Google Analytics tags are not enabled in this version of the site. Our cookie banner currently controls our own optional usage statistics; accepting it does not activate advertising, authorize personalized ads, or provide parental consent. Before any advertising is introduced, its data practices, child-directed treatment, non-personalized delivery, and regional consent requirements must be assessed and implemented. We do not use browser time zones as proof of a visitor's country. A Google-certified consent platform is required where Google's policies require it; our custom banner is not a certified platform.

WordCombi does not currently use affiliate links, and no commission is earned from any link on this site today. If affiliate links are added, they will be labeled before you click, and we may earn a commission without changing the price you pay. Participation is subject to the relevant program's approval, and this disclosure is not a claim of enrollment or approval. Following an external link takes you to another site, where its own terms and privacy practices apply. We do not embed advertising pixels.

With analytics consent, we record a page path or tool name and a random session ID in Base44. We do not deliberately include search text, names, email addresses, or IP addresses in those usage records. Connection data is still processed by hosting providers; the session ID can distinguish visits within a browser session, so these records are pseudonymous rather than necessarily anonymous. Declining, withdrawing consent, or enabling Global Privacy Control stops new optional usage records and clears our local analytics session ID. Withdrawal does not undo prior lawful processing.

Our retention limit for ordinary support correspondence and pseudonymous usage records is 24 months, unless a shorter period is appropriate. The owner must review and delete active copies, including both CRM records and mailbox copies; a CRM warning is not automatic deletion. Records needed for a legal obligation or to establish, exercise, or defend a legal claim may be kept only as long as that purpose requires and reviewed when the matter closes. A minimal suppression record is kept as needed to honor an email opt-out. Provider-controlled logs and backup copies follow the provider's own retention and deletion arrangements; we cannot promise instant erasure from all backups. You may request earlier deletion, subject to applicable exceptions.

Administrative access and data-access restrictions limit who can use our CRM and business records. No website or transmission is guaranteed secure. Requests for deletion are handled across active systems we control, rather than by deleting a CRM row alone.

If a security incident affects personal information, we will notify affected individuals and the relevant authorities as required by applicable law, including Iowa's security-breach notification requirements (Iowa Code ch. 715C) and any other law that applies to a resident whose information is involved.

This is version 1.0 of these documents, last revised November 4, 2026, for the initial release. Changes do not retroactively alter rights under an earlier version. After launch, material changes to the Terms or data practices will be announced on the site at least 14 days before taking effect. Where fresh consent is required, continued use alone is not consent. Changes required sooner by law will be explained with as much notice as legally possible.

If the business or site is transferred, relevant records may pass to the successor only for legitimate purposes under applicable law, with notice of material changes. A business transfer is not permission to expand the use of personal information, disregard an opt-out, or evade a retention limit.