Warp Words privacy policy
Last updated 7 November 2026
In short
- Warp Words has no accounts, no adverts and no analytics, and does not track you.
- Your child's progress, handwriting and settings stay on your devices and move between them through your own iCloud. We cannot read them.
- Nothing about your child is sent to us: no name and no handwriting.
- If you turn on the AI features, saving a week sends the spelling words and their sentences to our server. The server uses AI services to make sentences, pictures, a planet name and a boss.
- Pictures and sentences are kept on the server by word and shared between families, so the next family with the same word gets the same picture.
- Apple handles all payments. We never see your payment details.
1. Who we are
Warp Words is published on the App Store by Jon Adair, because the developer account is in Jon's own name. The server that powers the AI features, and this website, are run by Caldair Creative Ltd, a company registered in England and Wales. Caldair Creative Ltd is responsible for the personal data described here. You can contact us at jon@caldair.com.
2. What stays on your devices
These stay on the iPhone and iPad, or in your own iCloud, and are not sent to our server:
- your child's progress, medals and the words they have practised;
- your child's handwriting;
- settings, including the grown-up PIN, which is stored only as a salted hash;
- the photo of the spelling sheet. If you photograph a sheet, the words are read on the device and the photo is not sent to us.
The iPhone app and the iPad game share this information through your own iCloud account (CloudKit sharing). It is stored by Apple. We do not have access to it.
3. What is sent to our server
If you allow the AI features (the question "Use AI to make pictures and sentences?" and the "Use AI features" switch in Settings), then saving a week sends the following to the Warp Words server, which is called Warp Drive:
- The spelling words and their sentences. The server uses them to make example sentences, word pictures, a planet name and a boss. Only the words and sentences are sent: not your child's name, handwriting or progress.
- An App Attest key ID. This is an identifier made by Apple's App Attest service for this installation of the app. The server uses it to check that a request comes from the real Warp Words app.
- A DeviceCheck token, for the free preview only. The server passes it to Apple, which records that this device has used its one free preview. We do not keep the token.
- Subscription information. The app sends the signed transaction for Warp Words Plus, so the server can check that the subscription is active. The server keeps only a hashed (scrambled) form of the original transaction number, to count each day's and month's requests.
If the AI features are off, none of this is sent. You type the sentences yourself, and planets and bosses are made on the device.
When your device connects to the server, the network connection carries its IP address, as it does for any internet service. Our own request logs do not record it (see section 4).
4. What the server keeps, and for how long
| What | Why | How long |
|---|---|---|
| Pictures, by word, sentence and picture number | So the same picture can be used again, by any family, without paying to make it twice. | No expiry is set. A picture that a parent reports is no longer used, and is kept for review. |
| Sentences, planet names and boss designs, by word list | The same reason. | 365 days. |
| App Attest key ID, public key and Apple's attestation receipt | To check that requests come from the real app. | No expiry is set. |
| Free preview record, kept against a hash of the key ID | To allow one free preview per device. | No expiry is set. |
| Daily request counters, kept against a hash of the subscription number | To limit use per subscription each day. | About 2 days. |
| Monthly cost counters, kept against the same hash | To limit what one subscription can use in a month. | About 40 days. |
| Picture reports: the word, sentence, reason, time and a short hash | So we can review a picture that a parent reported as unsuitable or wrong. | 1 year. |
| Request logs: which function was called, the result, whether the answer was cached, estimated cost, how long it took, and a short hash | To run and fix the service and control costs. | For as long as the hosting provider keeps function logs. |
| A one-time challenge used to attest a key | To prove a request is fresh. | 5 minutes. |
The request logs never contain the words, sentences, prompts, replies, transactions, keys or tokens. The only identifier in them is a short hash of the subscription number, which cannot be turned back into the number.
Pictures and sentences are not linked to a family or a child. They are kept against the word, and another family who enters the same word and sentence receives the same result.
We do not sell this data, use it for advertising, or build profiles from it.
5. Who else handles the data
We use these services to run Warp Words. They process data on our behalf.
- Vercel hosts the server and this website, and keeps function logs.
- Vercel Blob stores the cached pictures. The store is private.
- Vercel AI Gateway passes requests from our server to the AI providers below.
- Upstash Redis, supplied through Vercel, stores the cached sentences, the App Attest keys and the counters described above.
- Anthropic provides the AI model that writes the sentences, planet names and bosses. It receives the spelling words and, for planet names and bosses, the word list.
- OpenAI provides the AI model that makes the pictures. It receives a word, its sentence, and a fixed set of style pictures that we supply. Pictures are made by the model named "gpt-image-2".
The app does not mention these companies, but this policy does. We send them only what is described in section 3, and nothing that identifies a child.
Apple provides the App Store, purchases, iCloud sync, App Attest and DeviceCheck. Apple handles the data it receives under its own privacy policy.
6. Children
Warp Words is made for children to use, and is in the App Store's Kids Category. The parent sets it up and manages it. Purchases and the parent's screens sit behind a grown-up check (a 4-digit PIN). The app has no accounts, no adverts, no third-party analytics and no tracking. We do not collect any data about the child: no name, age, photo, voice, location or handwriting. The only information sent to our server is the spelling words and sentences that a parent saves.
Spelling words come from the parent. Please do not type a child's name or other personal details into a word or sentence, because words and sentences are sent to the server and may be shared as described above.
7. Purchases
Warp Words Plus is bought through the App Store. Apple handles payment, the free trial, renewal and refunds. We do not receive your name, card or Apple Account details. We receive only the signed transaction described in section 3.
8. This website
This website uses no cookies, no analytics and no advertising, and loads nothing from other companies: the fonts and images are served from the site itself. The hosting provider, Vercel, handles the IP address of each visitor in order to deliver the pages, and may keep it in its own server logs.
9. Where data is processed
The picture store is in the United States (Vercel's iad1 region, in Washington DC). Vercel, Upstash, Anthropic and OpenAI may also process data outside the United Kingdom. Where data goes outside the UK, we rely on the safeguards these providers offer for transfers under UK data protection law.
10. Your rights
Under UK data protection law (UK GDPR) you can ask us to tell you what personal data we hold about you, to correct it, to delete it, to restrict or stop our use of it, and to give you a copy of it. We do not run accounts and we do not know who a family is, so we cannot normally find data that belongs to you. If you want to use these rights, write to jon@caldair.com and give us the information we would need to find it, such as the word and sentence concerned. If we cannot identify your data, we will tell you.
We use the data described here to provide the app you asked for (a contract), and to keep the service secure and its costs under control (our legitimate interests).
Data in your iCloud, and the data on your devices, is under your control. Delete the app to remove what is on a device.
11. Complaints
If you are unhappy with how we have used your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint, or by phone on 0303 123 1113.
12. Changes to this policy
If we change what the app or server does with data, we will update this page and the date at the top. If a change is significant, we will say so in the app.
13. Contact
Caldair Creative Ltd, registered in England and Wales.
Email: jon@caldair.com