Data Processing Addendum

1. Parties

This Data Processing Addendum ("DPA") is entered into between:

• Word Wrangler ("Service Provider") — the operator of the Word Wrangler educational game service.
• The School/District ("School") — the educational institution whose teachers use Word Wrangler.

2. Purpose of Processing

Word Wrangler processes data solely for the purpose of providing an educational vocabulary game service for classroom use. The service enables teachers to create vocabulary review games and allows students to participate using anonymous aliases.

3. Types of Data Processed

3.1 Teacher Data

• Email address (required for account authentication)
• Password (stored using industry-standard encryption)
• Display name and school name (optional)

3.2 Student Data

• Anonymous alias only — no real names, emails, or student IDs
• Game performance data linked to alias only

4. Sub-processors & Data Residency

All data is stored in the United States.

5. Security Commitments

• Encryption in Transit: All data transmitted via HTTPS/TLS
• Encryption at Rest: Data encrypted on Firebase infrastructure
• Access Controls: Role-based access via Firestore security rules
• PII Prevention: Technical rules prevent storage of student PII

6. Data Retention & Deletion

• Teachers may delete game sessions at any time
• Automatic deletion configurable (24h, 7d, 30d, 90d)
• Account deletion removes all associated data
• Schools may request bulk deletion via privacy@wordwrangler.game

7. Prohibited Uses of Data

• No advertising: Zero ads displayed
• No data selling: We never sell user data
• No profiling: No behavioral profiles on students
• No social tracking: No tracking pixels or trackers

8. School & Teacher Rights

• Access: Request data copies
• Deletion: Request data deletion
• Export: Download results as CSV

9. Breach Notification

Word Wrangler will notify affected schools within 72 hours of discovering a data breach.

10. Contact