Organisation assurance
This supplier overview supports local due diligence. It is not a substitute for an organisation's own DPIA, contract review or advice from its data-protection and safeguarding leads.
Tkintell Group operates World Word Search and handles account, game and subscription information needed to provide the service. A school, trust or church decides which learners may participate and may be a controller for that decision and related records. The parties should document their roles before organisation-wide use.
A user signs in through Google; the Worker creates a secure session and stores the account and learning record in Cloudflare D1. School or church join codes link an account to an organisation. Stripe receives checkout details and returns subscription status. The game links to reference sources without sending the user's World Word Search account record to them.
The database is designed around identifiers, usernames, optional avatars, broad region, organisation links, progress, scores and subscription status. The service does not need pupil rosters, dates of birth, home addresses, precise location, health data, safeguarding notes or private messages. Organisations should not upload those fields.
The live service uses HTTPS, a Content Security Policy, clickjacking protection, restricted browser permissions, HttpOnly Secure SameSite session cookies, server-side origin checks for state-changing requests, secret environment variables and access-controlled Cloudflare infrastructure. No online service is risk-free; suspected incidents should be reported promptly.
Cloudflare supplies hosting and D1 storage, Google supplies federated sign-in and Stripe supplies payments. The organisation should review those providers and any international-transfer safeguards relevant to its own use. World Word Search does not use ad networks or optional behavioural analytics in the current release.
Requests for access, correction, deletion or restriction, supplier-assurance questions and suspected incidents can be sent to tkintell@gmail.com or 07446 536899. Include the account email and organisation, but never a password or unnecessary pupil information.
Before a wider learner rollout, complete local DPIA and safeguarding review, approve display-name rules, test accessibility with representative users, confirm the permitted sign-in method, nominate support contacts and run a small supervised pilot. Keep a record of approval and review the arrangement when the service changes. The ICO says a DPIA must be embedded before launching an online service likely to be accessed by children; see its DPIA guidance.