Privacy Policy.
What information we collect, where it's kept, why, and what you can do about it.
Last updated: 11 October 2026
What we collect
- When you sign up: first name, last name, email address, UK phone number and a password. Your password is turned into a scrambled code (a hash) before it is saved, so it isn't stored as you typed it. We also record the date you joined, your last sign-in and a count of failed sign-in attempts (five wrong tries lock the account for 15 minutes).
- If you sign up with Google: your name, verified email address and Google account ID, checked by our server with Google. We ask you for your phone number separately.
- While you play: your coin balance, XP, level and the date you last collected the daily bonus.
- When you contact us: your name, email, topic and message.
- When you submit any form: the date, which form it was, the result (for example "created" or "wrong password"), your IP address and browser type, written to a protected server log.
Where it's kept
Server-side only. Your account is stored on our server as a protected file that can't be opened from the web — we don't use a database, no tables or queries are exposed, and nothing about your account is kept in your browser apart from a session cookie.
It stays there until you delete your account from My account or ask us to delete it. Signing in sets one strictly necessary session cookie (csr_sid) — see the Cookies Policy.
Messages you send through the contact form are emailed from our server to our support inbox through an authenticated mail service, and a copy is kept in a protected log on our server so we can reply and check that the message arrived. We delete it once your request is dealt with.
We never ask for or store card or bank details.
Why we use it
- To run your account, coins and level
- To check you are 18+ and in the UK
- To reply when you contact us
- To keep the Site secure and spot abuse (form logs)
Our lawful bases under UK GDPR are performance of a contract (running your account), legal obligation (age checks) and legitimate interests (security and support).
Other services
- Google Sign-In, if you choose to use it. Google's own privacy policy applies.
- Google Fonts, which supplies the typefaces used on the page.
- Our mail provider, which delivers contact-form messages from our server to our inbox.
We don't use advertising or analytics trackers.
How long we keep it
Account data: until you delete the account. Contact messages: until your request is resolved. Form logs: up to 12 months, then deleted.
Your rights
Under UK data protection law you can ask to see, correct or delete your information, or object to how it's used. You can delete your account yourself at any time from My account, which removes it from our server. For anything else, send your request through the contact form or email . You can also complain to the Information Commissioner's Office (ico.org.uk).
The data controller for this website is , .
Changes
We'll update this page if anything changes. The date at the top shows the latest version.