Privacy Policy.

Who we are

This policy explains how Nadael Oraby (nadaeloraby.com) collects and uses personal information, and your rights under UK data protection law (UK GDPR and the Data Protection Act 2018).

What we collect

• When you sign up with email: first name, last name, email address, UK phone number and a password. Your password is turned into a one-way hash before it's saved, so it is never stored as you typed it.
• If you sign up with Google: your name, verified email address and Google account ID, checked by our server with Google. We ask for your phone number separately. We never see your Google password.
• Account activity: the date you joined, your last sign-in, your coin balance, XP and level, games you've opened recently, when you last collected a bonus, and a count of failed sign-in attempts (five wrong tries lock the account for 15 minutes).
• When you contact us: your name, email, topic and message.
• Sign-in log: each sign-up, sign-in, sign-out, bonus and account deletion is recorded with the date, your name and email and whether it worked. Passwords are never logged.

Why we use it

• To create and run your account, coin basket and levels (performance of our agreement with you).
• To check you are 18+ and in the UK, and to keep the site secure and stop abuse (legitimate interests and legal obligations).
• To reply to your messages and act on break, restriction and deletion requests.

We don't sell your information, we don't use it for advertising and we don't send marketing.

Where it's kept

Your account is stored on our server as a protected file that can't be opened from the web. We don't use a public database. It stays there until you delete your account from My account or ask us to delete it.

Messages you send through the contact or Player Care forms are emailed from our server to our support inbox through our email delivery provider, and a copy is kept in a protected log on our server so we can reply and check the message arrived. We delete it once your request is dealt with.

Sign-in logs are kept in a protected file on our server for up to 12 months for security, then deleted.

In your browser we only keep your age confirmation and cookie choice. See the Cookie Policy.

We never ask for or store card or bank details.

How we protect it

• All forms are processed on our server, never in the page.
• Passwords are hashed with PHP's built-in password hashing.
• Account files and logs are blocked from web access.
• Your session cookie is HttpOnly, sent only over HTTPS and renewed on every sign-in.
• Repeated wrong passwords lock the account temporarily.

Other services

• Google Sign-In, if you choose to use it. Google's own privacy policy applies.
• Email delivery provider, which sends form messages from our server to our support inbox.
• Our hosting provider, which runs the server the site and games are on.

Our games are made by us and hosted on our own server, so playing them doesn't share your information with a third-party game supplier.

Your rights

You can ask to see, correct or delete your information, ask us to limit how it's used, object to how it's used, or receive a copy in a portable format. You can delete your account yourself at any time from My account, which removes it from our server.

Send your request through the contact form. We'll reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.

Children

Our site is only for adults aged 18 or over. We don't knowingly collect information about anyone under 18 and will delete any account we find belongs to someone under 18.

Changes

We'll update this page if anything changes. The date at the top shows the latest version.