Privacy Notice

About us

Wild Floors is the data controller for personal information collected through wildfloors.com. We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Information we collect

• At sign-up: first name, surname, email address, UK mobile number and a password. The password is converted to a one-way hash before it's stored, so the original is never kept.
• If you join with Google: your name, confirmed email address and Google account ID, verified by our server with Google. Your mobile number is requested separately.
• As you use your profile: coin balance, level and XP, how many games you've opened and which ones recently, when you last claimed a daily bonus, when you joined, your most recent log-in and a count of failed log-in attempts (five in a row locks logging in for 15 minutes).
• When you contact us: your name, email, chosen topic and message.
• Form records: for every form submitted, our server keeps a short note of the date, form type, outcome and email address used. Passwords are never recorded.

Where it's stored

Your profile is saved on our own server as a protected file in a private folder that can't be opened or listed from the web. We don't run a public database, and profile information is never displayed in tables or pages on the site. It stays there until you close your profile from My profile or ask us to remove it.

Messages from the contact and Player Care forms are emailed by our server to our team inbox, and a copy is kept in a protected server log so we can reply and confirm delivery.

Logging in sets one essential session cookie (wf_sid). The Cookie Notice has the details.

We never request or store card or bank details.

Why we use it (legal basis)

We don't sell your data, use it for advertising or send you marketing emails.

Who we share it with

• Our hosting company, which runs the server holding the site and profiles.
• Our email delivery service (Brevo), which carries contact and Player Care messages from our server to our inbox.
• Google, only if you choose to sign in with Google, under Google's own privacy policy.
• Google Fonts, which serves the typefaces on our pages and receives your IP address to do so.
• Public authorities, where the law requires it.

Some of these providers may handle data outside the UK. When they do, we rely on UK adequacy regulations or approved safeguards such as the International Data Transfer Agreement.

How long we keep it

• Profile: until you close it or ask us to. Profiles that go unused for 24 months may be removed.
• Messages and form records: deleted once your request is resolved, and always within 12 months.
• Session cookie: until you log out or close the browser.

Security

We protect your information with HTTPS encryption, hashed passwords, locked server folders, secure session cookies, log-in lock-outs and spam traps on every form. No system is flawless, but we work hard to keep your data safe, and if a serious breach ever happened we'd tell you and the ICO as the law requires.

Your rights

Under UK data protection law you can ask to see, correct or delete your information, limit or object to how we use it, or get a copy in a portable format. You can close your profile yourself at any time from My profile. For anything else, use the contact form and pick "A privacy request". We'll respond within one month.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Under-18s

The site is for adults only. We don't knowingly collect information from anyone under 18, and if we discover we have, we'll delete it.

Updates

If anything changes we'll update this page, and the date at the top will show the latest version.