The - Home
- Privacy policy
Privacy policy
What we collect, why we need it and how your account is kept safe on our server.
Who looks after your data
The Pines (thepinesbcs.com) is the controller of the personal data described in this policy. Contact us about your data at [email protected] or via the contact page.
Below we explain what we collect, why, how long we hold it and the rights you have under the UK GDPR and the Data Protection Act 2018.
What we collect
| Data | When we get it | Why, and our lawful basis |
|---|---|---|
| Username, email address and a hashed password | When you sign up with email | To provide your account (contract) |
| Name, email address and Google account ID | When you use Continue with Google | To sign you in with Google (contract) |
| Coin balance, XP, level and recently played games | While you use your account | To show your progress (contract) |
| Name, email address, topic and message | When you send the contact or Player Care form | To reply to you (legitimate interests) |
| IP address and time of each form submission | Whenever a form is sent | Security and preventing abuse (legitimate interests) |
| Age confirmation and cookie choice | When you visit | Stored only in your own browser |
We never ask for bank or card details and we don't collect special category data.
Keeping your password safe
We never store your password as you typed it. Our server turns it into a one-way hash using PHP's password_hash function, so it can't be read back, even by us. Passwords never go into logs or emails and are never shown on screen again.
If someone gets the password wrong five times in a row, the account is locked for 15 minutes.
Where your data is held
All our forms (sign-up, log-in, contact and Player Care) are processed on our own web server, not in your browser. Account details are saved in private files on that server, which are blocked from public access. Nothing about your account is placed in the page code or shown to other visitors.
Contact and Player Care messages reach our inbox over an encrypted (TLS) connection through our email delivery provider, and the whole site is served over HTTPS.
Who we share it with
- Our hosting company, which runs the server the site and its files sit on.
- Our email delivery provider (Brevo), which carries contact and Player Care messages to us.
- Google, only if you choose Continue with Google. Google's own privacy policy covers that sign-in.
We don't sell personal data and we don't share it for advertising.
How long we keep it
- Account data: as long as your account exists. Deleting your account removes its file from our server immediately.
- Contact and Player Care messages and form logs: up to 24 months, then deleted.
- Browser storage (age check, cookie choice): until you clear it.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, ask us to restrict or stop using it, or ask for it in a portable format. You can delete your own account from your account page at any time. For anything else, email [email protected] and we'll reply within a month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Children
The Pines is for adults aged 18 and over. We don't knowingly collect data from anyone younger. If you believe a child has given us their details, let us know and we'll delete them.
Updates to this policy
We may change this policy from time to time. The date at the top tells you when it was last updated.