Trust, Security & Privacy

Scrubble is a word-finder, board solver, and Daily Challenge for Scrabble-style games. It is intended for casual reference and entertainment.

The public site does not require an account to use the word finder, word lists, strategy pages, or Daily Challenge. The Daily Challenge uses a random anonymous identifier stored in your browser so we can show your streak and place an entry on the leaderboard — it is not linked to an email or real name.

You can choose a display name for the leaderboard. You can clear your identity at any time by clearing site data in your browser.

• Daily Challenge results: puzzle date, puzzle type, your answer, score, and your chosen display name. Scores are recomputed on the server from your answer; the client cannot submit an arbitrary score.
• Local browser storage: your anonymous player id, a local secret used to prove ownership of your leaderboard entries, your chosen display name, and your puzzle history. These never leave your device except the player id and display name when they appear on the leaderboard.
• Standard request logs: routine information about requests (such as IP address and user agent) handled by our hosting provider for abuse prevention and reliability.

The Daily Challenge leaderboard is public and shows the display name (if any), score, answer, and submission time for each entry. Do not put personal information in your display name.

Only the holder of your local player secret can change the display name on your past entries.

Scrubble may show ads from Google AdSense on some pages. AdSense and similar third-party services set their own cookies and may collect data according to their own policies. We do not run our own behavioural-tracking analytics.

Scrubble is built and hosted on Lovable, which provides the application hosting, database, authentication primitives, and edge runtime. Lovable operates the underlying platform; the Scrubble team is responsible for the application code, data we store, and how features behave. Platform-level certifications, if any, are governed by Lovable and not claimed by Scrubble.

• Database access is gated by row-level security policies; clients can only read and write what those policies allow.
• Privileged operations (such as bulk word tagging) run on the server and require a server-side admin secret. Admin credentials are never persisted in browser storage.
• Daily Challenge scores are recomputed on the server from the submitted answer, so leaderboard scores cannot be fabricated by the client.
• Secrets and API keys are stored as server-side environment secrets and are never shipped in client code.

Daily Challenge entries are retained to power the leaderboard and streaks. To remove your entries or change your display name, contact us using the link below or clear your browser storage to detach your device from your entries.

Questions, deletion requests, or security reports: scrubbleadmin@gmail.com. We aim to respond to security reports promptly.