Privacy policy

What we collect

• When you join with email: first name, last name, email address, UK phone number and a password. Your password is turned into a scrambled code (a hash) before it's saved, so it isn't stored as you typed it.
• When you join with Google: your name, verified email address and Google account ID, checked by our server with Google. We ask for your phone number separately.
• While you use your account: the date you joined, your last sign-in, a count of failed sign-in attempts (five wrong tries pause sign-in for 15 minutes), your coin balance, XP, level, when you last collected a bonus and the games you opened recently.
• When you contact us: your name, email address, topic and message.
• Account activity log: the date and type of each account action (for example sign-in, sign-up or bonus), whether it worked and the email address involved. Passwords are never logged.

Where it's kept

Your account is stored on our server as a protected file that can't be opened from the web. It stays there until you delete your account from My account or ask us to delete it.

Messages you send through the contact or Player Care forms are emailed from our server to our support inbox through our email provider (Brevo), and a copy is kept in a protected log on our server so we can reply and check the message arrived. We delete it once your request is dealt with.

Logs of account activity are kept for up to 12 months for security, then deleted.

We never ask for or store card or bank details.

Why we use it

• To create and run your account, purse and levels (to provide the service you asked for).
• To check you are 18 or over (to meet our legal duties and protect young people).
• To keep accounts secure and spot misuse (our legitimate interest in a safe site).
• To reply when you contact us and act on break, restriction or deletion requests.

We don't sell your information, and we don't use it for advertising.

Other services

• Google Sign-In, if you choose to use it. Google's own privacy policy applies to what happens on Google's side.
• Brevo, which delivers the emails our contact forms send to our support inbox.
• Our hosting provider, which runs the server the site and games live on.

Cookies and browser storage

Signing in sets one strictly necessary session cookie (oag_sid). If you start joining with Google, a short-lived cookie (oag_pending, up to 15 minutes) carries your name and email from Google to the sign-up form. Your browser also remembers your age check and cookie choice. See the Cookies policy.

Your rights

Under UK data protection law you can ask to see, correct or delete your information, ask us to limit how it's used, or object to how it's used. You can delete your account yourself at any time from My account, which removes it from our server. Send other requests through the contact form. You can also complain to the Information Commissioner's Office at ico.org.uk.

The data controller for this site is , .

Under 18s

The site is not for anyone under 18. If we learn that someone under 18 has an account, we delete it.

Changes

We'll update this page if anything changes. The date at the top shows the latest version.