Effective date: 5 August 2026 Last updated: 5 August 2026
Hang Five is a free daily word game. There’s no account to create, and you can play without telling us who you are.
The rest of this policy explains all of that properly.
Hang Five is operated by Hang Five Ltd, a company incorporated in England and Wales (company number 17213241), registered office 71–75 Shelton Street, Covent Garden, London WC2H 9JQ.
Hang Five Ltd is the data controller for personal information handled through:
We are registered with the UK Information Commissioner’s Office (ICO), registration number ZC175302.
We have a Privacy Officer, as required by New Zealand’s Privacy Act 2020. You can reach them, and us, at hey@hangfive.app.
Previously: Hang Five was operated by Zemobo Limited (New Zealand). Hang Five Ltd took over as operator and data controller on 5 August 2026. If you’re looking for the old policy, this one replaces it in full.
There are no accounts, logins or profiles, and we never ask for your name or email address.
A random ID for your device. The first time you play, we generate a random identifier — your Hang Five user identifier — and store it in your browser’s local storage or in the app. Your puzzle progress and statistics are saved on our servers against that ID, so that your streak and stats are still there when you come back. It also lets us show you how your results compare with everyone else’s, by counting each player once.
What this means in practice:
Also recorded when your device talks to our servers:
| What | Why |
|---|---|
| IP address | Security, abuse and fraud prevention, rate limiting, and diagnosing faults |
| Approximate location (country/region, worked out from the IP address) | Serving the right puzzle timing and the right consent experience for your jurisdiction |
| Device and browser type, operating system, app version | Making sure the game works on your device and diagnosing crashes |
| Requests you make to the game (which puzzle, when, whether it loaded) | Diagnosing errors and keeping the service up |
Playing the game doesn’t involve giving us your name, email address, phone number, contacts, photos or precise location, and we don’t collect any of it.
We use Google Analytics to understand how many people play, which features get used, and where the game is breaking. Google Analytics sets its own identifier on your device and collects device information and the pages or screens you view. We use it to look at patterns across all players, not to follow individuals. Where required, it runs only after you’ve given consent.
Advertising funds the game. We don’t operate the advertising ourselves. Two partners do, and each acts as an independent controller of the information it collects — meaning they decide for themselves how to use it, and their own privacy policies apply alongside this one:
To show and measure ads, these partners and the advertising companies they work with may collect:
Depending on your consent and your region, this information may be used for personalised advertising — meaning ads chosen based on inferences about your interests, including from your activity on other apps and websites. It may also be used for frequency capping, fraud detection and measurement.
We don’t receive this information in a form that identifies you. We see aggregate revenue and performance reports. If you want to know exactly what our advertising partners hold about you, their policies (linked above) explain how to ask them directly.
Separately from what our advertising partners collect, we keep our own record of which ads ran in the game — which advert, when, and in which country. At present these entries are recorded against your Hang Five user identifier.
We use them to check our advertising revenue against what was actually served, and to investigate complaints: if you tell us about an ad you’ve seen, this is how we work out which one it was and raise it with the partner responsible.
We never share your Hang Five user identifier with our advertising partners.
We’re changing this so that ad records use a separate, regularly-changing identifier that isn’t connected to your game progress. This policy will be updated when that’s done.
If you email us, we will hold your email address and the contents of your message. We use them to respond to you and for no other purpose.
| What | Where | How long | What it’s for |
|---|---|---|---|
| Hang Five user identifier | Local storage | Until you clear it | Your progress, streak and stats, and our record of ads shown |
| Your consent choices | Set by our consent tool | As set by that tool | Remembering what you’ve agreed to |
| Google Analytics identifier | Cookie or app storage | Up to 2 years | Understanding how the game is used |
| Advertising cookies and identifiers | Cookies, or your device’s advertising ID | As set by the partner | Choosing and measuring ads |
Because we’re a UK company, UK data protection law requires us to have a specific legal basis for every use of your information — for all our players, not only those in the UK and EU.
The basis is the same wherever you are, with one exception. Some countries have additional rules about storing things on your device: anything that isn’t essential to providing the game needs your consent there. Where those rules apply, consent is the basis for analytics and advertising. Where they don’t, we rely on legitimate interests. The table says which is which.
| What we do | Legal basis |
|---|---|
| Serving the game; keeping it available and secure; diagnostic logging | Legitimate interests — running and protecting a service you asked to use. Minimal data, kept briefly. |
| Storing the Hang Five user identifier, and saving your progress and stats against it | Legitimate interests — keeping your progress and streak so the game works as you’d expect when you return, and showing you how your results compare |
| Recording which ads ran, so we can check revenue and investigate complaints | Legitimate interests — being able to answer you when you tell us something was wrong, and to verify what we’re paid for |
| Analytics cookies and identifiers | Consent where you’re asked for it; legitimate interests elsewhere — understanding how the game is used so we can improve it |
| Advertising cookies, advertising identifiers, and personalised advertising | Consent where you’re asked for it. Elsewhere, our advertising partners set their own basis — see their policies, linked in section 2.3 |
| Replying to your email | Legitimate interests — answering the question you asked us |
| Meeting legal, tax and regulatory obligations | Legal obligation |
Where we rely on consent, you can withdraw it at any time — see Your choices. Withdrawing consent doesn’t affect anything done before you withdrew it, and it won’t stop you playing. You’ll still see ads; they just won’t be personalised.
If you’d rather we didn’t rely on legitimate interests for something, you can object — see Your rights.
We retain the minimum necessary, for no longer than needed.
| Data | Retention |
|---|---|
| Server access logs and diagnostic logs containing IP addresses | Kept only as long as needed for security and diagnostics, and cleared regularly |
| Puzzle progress and statistics | Kept while the game is in use. We’re introducing a process to remove records that have been inactive for a long period |
| Records of ads shown | Kept for a short period for revenue checking and complaint handling, then cleared |
| Aggregate statistics (totals, distributions, all-time figures) | Kept indefinitely. These are counts and averages across all players and can’t be traced back to any individual |
| Google Analytics data | As set in our Google Analytics configuration; aggregate reporting is retained longer and can’t be traced back to a device |
| Support emails | Kept while we may need them to deal with your query or a related legal, tax or regulatory matter |
| Data held by our advertising partners | Set by them under their own policies — see the links in section 2.3 |
We use a small number of providers, and we don’t share your information with anyone outside this list except as described below.
Working for us, under our instructions:
| Provider | What they do | Where |
|---|---|---|
| Amazon Web Services (AWS) | Hosting, infrastructure and game data storage | United States |
| Axiom | Diagnostic and error logging | United States |
| Google Analytics | Understanding how the game is used | United States and globally |
Each is bound by contract to protect the information they handle for us and to use it only for what we’ve asked.
Collecting information in their own right (see section 2.3):
| Partner | What they do | Where |
|---|---|---|
| Nitro (nitropay.com, Overwolf group) | Advertising and consent management on the website | United States and Israel |
| Google (AdMob) | Advertising in the iOS and Android apps | United States and globally |
We may also disclose information if we’re legally required to — a court order, a regulator, a valid law-enforcement request — or where we need to establish or defend legal claims. If Hang Five Ltd is ever sold or restructured, information may transfer to the new owner, whose use of it would remain subject to data protection law.
Hang Five has players all over the world, and our providers operate internationally. That means information about you may be processed outside the country you’re in.
This section covers transfers we make. Our advertising partners collect information directly through your device rather than receiving it from us, so where they send it is covered by their own policies, linked in section 2.3.
You can ask us for details of the safeguards that apply to a particular provider.
Advertising and analytics consent (UK, EU and EEA). On the website, use the “Update consent preferences” link in the footer. In the apps, tap “Privacy options” at the bottom right of the main screen. You can change or withdraw your consent at any time.
Do Not Sell or Share My Personal Information (California and other US states). Use the “Do Not Sell or Share My Personal Information” link in the website footer. This signals to our advertising partners that your information shouldn’t be used for cross-context behavioural advertising or sold as those terms are defined under California law.
Your device’s advertising identifier. You can reset or switch off your advertising ID at any time:
Your browser. You can block or clear cookies and local storage in your browser settings. Clearing browser data will also disconnect your device from your saved progress and statistics, permanently.
Because Hang Five Ltd is a UK company, UK data protection law applies to everything we do — including information about players outside the UK. So the rights below are available to you wherever you live, not only in the countries listed further down.
You have the right to ask us for a copy of the information we hold about you, to have it corrected or deleted, to restrict or object to how we use it (including where we rely on legitimate interests), to receive it in a portable format, and to withdraw consent where you’ve given it. Some countries add further rights, or a local regulator to complain to, and those are set out below.
How to make a request. Email hey@hangfive.app, including your Hang Five user identifier. Because there are no accounts, the identifier described in section 2.1 is how we locate your records. You can find it by tapping the version number at the bottom left of the main screen.
Without it we are usually unable to match any records to you.
For information held by our advertising partners, please contact them directly using the links in section 2.3.
We aim to respond within one month. If a request is particularly complex, or you’ve made several, we may need longer — we’ll tell you within a month if that’s the case.
If you’re unhappy with how we’ve handled your information, you can complain to us at hey@hangfive.app. We’ll acknowledge your complaint within 30 days, look into it as quickly as we can, keep you posted on progress, and tell you the outcome. You can go straight to a regulator instead if you’d rather — you don’t have to come to us first.
The rights above apply to you in full. You can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113), or to your local supervisory authority if you’re in the EU.
New Zealand is one of our largest markets, and the Privacy Act 2020 applies to us as an overseas agency carrying on business in New Zealand. We handle your information in accordance with the information privacy principles, and we have a Privacy Officer as the Act requires. Requests go to hey@hangfive.app, and we’ll respond within 20 working days.
If you’re not satisfied with our response, you can complain to the Office of the Privacy Commissioner (privacy.org.nz, 0800 803 909).
Under the CCPA (as amended by the CPRA), you have the right to know what personal information we collect and how it’s used, to request deletion or correction, to opt out of the sale or sharing of your personal information, and not to be discriminated against for exercising any of these rights. We don’t offer financial incentives in exchange for personal information.
Categories collected. We collect identifiers (IP address, the Hang Five user identifier) and internet or network activity (how you interact with the game), together with coarse geolocation derived from your IP address. Our advertising partners collect further identifiers through the service in their own right, and may draw inferences about likely interests from them.
Sale and sharing. We don’t sell personal information for money. However, when advertising identifiers and similar information are made available to advertising partners for personalised advertising, that counts as “selling” and “sharing” under California law. Use the “Do Not Sell or Share My Personal Information” link in the footer to opt out.
Sensitive personal information. We don’t collect it and don’t use it to infer characteristics about you.
Retention is described in section 4. An authorised agent may make a request on your behalf with written permission. Where we can’t verify a request, we’ll explain why.
Hang Five is a general-audience word game. It isn’t directed at children, and we don’t knowingly collect personal information from anyone under 13. Some EU countries set a higher age, up to 16, for consent to online services, and we apply the local age where it’s higher.
If you believe a child has provided us with personal information, email hey@hangfive.app and we’ll delete it.
We use HTTPS throughout, keep our systems patched, and restrict access to our infrastructure to a small number of authorised people. We also limit what we collect in the first place, which reduces what is at risk. No system is perfectly secure, but the volume and sensitivity of the information we hold are both low.
If a privacy breach occurred, we would notify the relevant regulators and, where required, affected individuals.
We update this policy when our practices change. The “last updated” date at the top always reflects the current version, so it’s worth checking back if you want to keep track.
Where the law requires us to tell you about a change before it takes effect, or to ask for your consent again, we will.
Hang Five Ltd 71–75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom Company number 17213241 · ICO registration ZC175302
Email us about anything, including privacy requests: hey@hangfive.app