Three questions, answered plainly: what other people can see, what somebody could steal, and whether the leaderboard can be faked.
In the app, they can see:
Outside the app, someone with technical skill can read what the leaderboards show and nothing more: your name in the game and, for each day you played, how far you got, your points, your best chain and your total time, and how many times you replayed a past day. We do not publish what time you played, how long each word took, or which version of the app you use. The boards do update as results come in, though, so someone watching one closely can tell roughly when yours arrived.
Nobody else can see:
There is no profile picture, no bio, no message box, and no way for another player to contact you inside the app.
You never sign in to Wordtumbler. So there is no password, no reset email, and no login of yours that could leak from us and then be tried somewhere else.
Your account is held by a key the app keeps in the iOS keychain on this iPhone.
The honest cost: the account does not move to a new phone, and it does not survive deleting the app. Nobody can take it from you, and nobody, including us, can give it back.
When a run ends, your phone sends two things: which day you played, and how long each board took. That is all.
It does not send your result, your rank, or how far you got.
The server builds the same puzzle for the same day, works out how far those times get you, and calculates the result itself. There is no result in the message to inflate.
Somebody changing what their phone sends can only change the times. Times that a person could not have played are rejected. A board cleared faster than anyone can move is refused, not quietly accepted.
You get one ranked attempt at each day, and it is your first one. That is a fairness rule, but it also stops the simplest attack on a leaderboard: playing the same day two hundred times until the times look good.
The database and the small program that judges runs are kept at one hosting provider, in an account used for nothing else. Every connection uses HTTPS.
Each account can change only its own records. That is enforced by the database itself, not by the app choosing to behave. A modified app cannot change somebody else's results or friends, because the database does not ask the app for permission.
Write to support@wordtumbler.app. Include your name in the game and which day.
If you have found a security problem, please tell us before telling anybody else. We will fix it and thank you.