Privacy Policy

Last updated: 2 August 2026
Effective: 2 August 2026

This Privacy Policy explains what personal data The Verbarium
(“we”, “us”, “our”) collects when you use https://theverbarium.com
(the “Site”), why we collect it, who we share it with, and what rights you have over it.

It covers the whole Site: the articles, the comment section, the contact form,
player accounts, and the Find the Word game at
/play.

1. Who is responsible for your data

The data controller for the Site is:

• Kleoniq Kosova, operating as The Verbarium
• Pallatet Deli Jorgji, Tirana, Albania
• Email: TheVerbarium@gmail.com

We are established in Albania and process personal data in line with Albanian
Law No. 124/2024 “On Personal Data Protection”, which is aligned with the EU
General Data Protection Regulation (GDPR). Where you are in the European
Economic Area or the United Kingdom, we also process your data in line with the
GDPR and UK GDPR.

2. The short version

• You can read every article on this Site without giving us anything and without an account.
• You can play the game as a guest. Guest progress is saved on your own device, not on our servers.
• We collect personal data only when you choose to give it: by creating an account, leaving a comment, or using the contact form.
• We show advertising through Google AdSense and use analytics to understand how the Site is used. Both involve cookies.
• We never sell your personal data, and we don’t run a newsletter or share your email with advertisers.

3. What we collect, and why

3.1 Information you give us directly

Player accounts. If you create an account to save progress and
play 1v1, we collect and store:

• your email address;
• a display name of your choosing (this is visible to your opponent in 1v1 matches);
• your password, which is never stored in readable form — only as a salted cryptographic hash;
• your game statistics: highest level reached, number of 1v1 matches played, and number won.

We use this to authenticate you, sync your progress across devices, and run
head-to-head matches. Legal basis: performance of a contract — you asked
us to provide an account, and this data is what makes the account work.

Contact form. When you use the form on our
Contact page, you provide a name,
an email address, and a message. These are sent to us by email and are
not stored in the Site’s database. We use them only to read and
reply to you. Legal basis: legitimate interests — responding to people
who deliberately contact us.

Comments. If you leave a comment on an article, WordPress
stores the comment text, the name and email address you enter, an optional
website URL, your IP address, and your browser’s user-agent string. The IP and
user agent are retained to help detect spam. Your email address is not published.
Legal basis: legitimate interests — publishing and moderating reader
discussion.

If you tick “Save my name, email, and website in this browser”, WordPress sets
cookies on your device so you don’t have to retype them. These are a convenience
for you and are set only if you tick the box. Legal basis: consent.

Comment authors may have their profile picture served publicly by the Gravatar
service, based on an anonymised hash of the email address. Gravatar’s privacy
policy is available at
automattic.com/privacy.

3.2 Information collected automatically

Server logs. Our hosting provider records standard web server
logs: IP address, date and time, the page requested, referring page, browser and
operating system. These exist for security, abuse prevention and diagnosing
faults. Legal basis: legitimate interests — keeping the Site secure and
operational.

Analytics. We use Google Analytics (via Google Site Kit) to
understand how the Site is used in aggregate — which articles are read, how
people arrive, which devices they use. This uses cookies and processes a
truncated or full IP address depending on configuration.
Legal basis: consent where required, otherwise legitimate interests.

Advertising. See section 5 below.

3.3 Information stored on your own device

The game stores a small amount of data locally in your browser. This is
not transmitted to us and we cannot read it:

• fdw_level and fdw_best — your current and best level, kept in localStorage so guest progress survives a page reload.
• fdw_room — a temporary 1v1 room code and session token, kept in sessionStorage so you can rejoin a match if the page reloads. It is deleted when you close the tab.

You can clear these at any time through your browser’s “clear site data”
setting. Doing so resets guest progress.

3.4 What we do not collect

• We do not collect precise geolocation (GPS) data.
• We do not collect special-category data — health, biometrics, religion, political opinions, sexual orientation, and so on.
• We do not take payments and never see card details.
• We do not sell personal data, and we do not share it with data brokers.

4. Cookies and similar technologies

Cookies are small text files placed on your device. We and our partners use
them for the purposes below.

Managing your choices. If you are in the European Economic
Area, the United Kingdom or Switzerland, we ask for your consent before any
non-essential cookie is set. We do this using Google’s Privacy &
messaging European regulations message — a Google-certified Consent
Management Platform that is integrated with the IAB Europe Transparency &
Consent Framework (TCF v2.2). Your choices are recorded and passed to our
advertising partners through that framework.

You can change or withdraw your consent at any time using the
“Privacy and cookie settings” link at the bottom of any page,
which reopens the consent message. You can also block or delete cookies through
your browser settings, though parts of the Site — including saved game progress
and staying signed in — may then stop working.

Visitors outside the EEA, the UK and Switzerland will not normally see the
consent message, because it is region-targeted. Advertising and analytics
cookies may then be set on the basis described in section 5.

5. Advertising and Google AdSense

We use third-party advertising companies to serve ads when you visit the Site,
including Google AdSense. Advertising is how the Site stays free
to read.

• Third-party vendors, including Google, use cookies to serve ads based on your prior visits to this Site and other websites.
• Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this Site and/or other sites on the internet.
• You can opt out of personalised advertising by visiting Google Ads Settings.
• You can opt out of some third-party vendors’ use of cookies for personalised advertising at aboutads.info/choices or youronlinechoices.eu.
• Where you have not consented to personalised advertising, or where you are a visitor we treat as a child, we request non-personalised ads. These still use a cookie for frequency capping, ad measurement and fraud prevention, but are not based on a profile of your interests.

For details of how Google uses information from sites that use its services,
see How
Google uses information from sites or apps that use our services.

For visitors in the EEA, the UK and Switzerland, the consent you give through
Google’s certified Consent Management Platform (see section 4) determines which
of our advertising partners may process your data and for which purposes. The
full list of those partners, and the purposes each relies on, is shown inside the
consent message under “Manage options”. That list can change over time; the
message always reflects the current one.

Legal basis: consent for personalised advertising and any
non-essential advertising cookie; legitimate interests for basic ad
delivery, fraud prevention and measurement where permitted.

6. Who we share data with

We do not sell your personal data. We share it only with the service providers
we need in order to run the Site, and only for the purposes described here:

• Contabo GmbH (Munich, Germany) — website hosting and server logs.
• Google Ireland Ltd / Google LLC — advertising (AdSense) and analytics.
• Automattic Inc. — Gravatar profile images for comment authors.
• Google LLC (Gmail) — receiving and storing contact-form messages sent to us.

We may also disclose data where we are legally required to, or where it is
necessary to establish, exercise or defend legal claims, or to protect the
rights and safety of our users.

7. International transfers

The Site itself is hosted by Contabo GmbH on servers located in Germany. Some of our other
providers — notably Google and Automattic — are based outside Albania and
outside the EEA, principally in the United States.

Where personal data is transferred outside Albania or the EEA, we rely on
appropriate safeguards, including the European Commission’s Standard Contractual
Clauses and, where applicable, the EU–US Data Privacy Framework. You may request
a copy of the relevant safeguards by contacting us.

8. How long we keep things

9. Security

The Site is served exclusively over HTTPS. Passwords are stored only as salted
hashes and are never visible to us. Account changes — email, password, deletion —
require your current password. We keep software updated and limit administrative
access.

No method of transmission or storage is completely secure, so we cannot
guarantee absolute security. If a personal data breach occurs that is likely to
result in a risk to your rights, we will notify the Commissioner for the Right
to Information and Personal Data Protection, and you, without undue delay.

10. Your rights

Under Albanian Law No. 124/2024 and the GDPR you have the right to:

• Access the personal data we hold about you and receive a copy.
• Rectify data that is inaccurate or incomplete — you can edit your display name and email directly on the Account page.
• Erase your data. You can delete your account and all associated progress yourself, permanently, from the Account page.
• Restrict or object to processing based on our legitimate interests.
• Portability — receive your account data in a structured, machine-readable format.
• Withdraw consent at any time, without affecting processing carried out before you withdrew it.
• Not be subject to decisions based solely on automated processing that produce legal or similarly significant effects. We do not carry out such processing.

To exercise any of these, email
TheVerbarium@gmail.com. We will
respond within 30 days. We may ask you to verify your identity before acting on a
request, so that we don’t disclose your data to someone else.

Complaints. If you think we have handled your data
improperly, please contact us first — we would rather fix it. You also have the
right to complain to the Albanian Commissioner for the Right to Information
and Protection of Personal Data (idp.al),
or, if you are in the EEA or UK, to your local data protection authority.

11. If you are in the United States

We do not sell personal information, and we do not share it for cross-context
behavioural advertising in exchange for money. Depending on your state, you may
have the right to know what personal information we collect, to request its
deletion or correction, and not to be discriminated against for exercising those
rights. Use the contact address above to make a request.

We honour the Global Privacy Control (GPC) signal where your
browser sends one.

12. Children

The Site is intended for a general audience and is not directed at children
under 13 (or the applicable minimum age in your country, which is up to 16 in
parts of the EEA). We do not knowingly collect personal data from children, and
we do not permit personalised advertising to be targeted on the basis of activity
by users we know to be under 13.

If you believe a child has provided us with personal data, contact us and we
will delete it promptly.

13. Links to other sites

Our articles and the game’s share buttons link to third-party sites. Following
those links takes you outside our control; we are not responsible for their
content or their privacy practices. We recommend reading the privacy policy of
any site you visit.

14. Changes to this policy

We may update this policy as the Site changes or the law does. The revised
version will be posted here with a new “Last updated” date. If a change
materially affects how we use your personal data, we will make that clear on the
Site.

15. Contact

Questions about this policy, or about your data:

Kleoniq Kosova — The Verbarium
Pallatet Deli Jorgji, Tirana, Albania
TheVerbarium@gmail.com