1. Who we are
This Privacy Policy explains how Noylaw (noy-law.com, "we") collects and uses personal information. We are the data controller. Contact us about privacy at [email protected] or through the contact form.
2. What we collect
When you join
- Username and email address.
- Password, turned into a one-way hash before saving, so it's never stored as you typed it.
- Your free coin balance, XP, rank, games played and recently played list.
- Your join date, last log-in, last daily deal and a count of failed log-in attempts.
If you use Google
- Your name, verified email and Google account ID, checked by our server directly with Google. We never receive your Google password.
When you message us
- Your name, email, topic and message.
Form log
- Each form submitted (joining, logging in, contact, Player Care, daily deal, deletion) adds a short entry on our server: date and time, which form, the outcome, the email or username, your IP address and browser type. Passwords and sign-in tokens are never logged.
We never ask for card or bank details. There's nothing to buy.
3. How our server keeps it safe
Everything is handled on our server. Our join, log-in, contact and Player Care forms send your details straight to our server over encrypted HTTPS. Personal data is never written into the page, kept in browser storage, or placed in any file, table or query a visitor can see.
- Account records live in a sealed server folder blocked from the web. Each record also starts with a guard line so it can't be opened in a browser even if folder settings fail.
- Passwords are stored only as a salted one-way hash using PHP's built-in hashing.
- Log-in uses a secure session cookie: httpOnly (scripts can't read it), SameSite and Secure over HTTPS. A fresh session ID is issued at every log-in.
- Five wrong passwords pause log-in for 15 minutes.
- Form logs sit in a protected folder that is also blocked from the web.
- Pages only receive what they need to show you, such as your username, coins and rank on My account, and only while you're logged in.
4. Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account, coins and ranks | Contract |
| Checking you're 18+ and in the UK | Legal obligation, legitimate interests |
| Replying to messages and Player Care | Legitimate interests, contract |
| Form logs, security and abuse prevention | Legitimate interests |
| Breaks, limits and deletion | Legitimate interests, your request |
5. Sharing
We don't sell your data or use it for advertising. We share it only with:
- Our hosting provider, which runs the server holding the website and account files.
- Our email delivery provider (Brevo), which carries contact and Player Care messages from our server to our inbox.
- Google, only if you choose Google Sign-In.
- Authorities, where the law requires.
Where a provider handles data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Accounts: until you delete yours or ask us to. Accounts unused for 24 months may be removed.
- Messages: while we handle your request, then up to 12 months.
- Form logs: up to 12 months.
7. Your rights
Under UK data protection law you can ask to access, correct or erase your data, restrict or object to how it's used, and receive a portable copy. You can delete your account yourself in My account. For anything else, email [email protected]. We'll respond within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
8. Cookies
We use one essential cookie to keep you logged in, plus small browser-storage items for your age check and cookie choice. See our Cookies Policy.
9. Under 18s
The Service is for adults only. We don't knowingly collect data from anyone under 18, and delete it if we find we have.
10. Updates
We'll update this page when anything changes. The date at the top shows the latest version.