Privacy policy

Who we are

This policy explains how Opal Accessories ("we", "us") collects and uses personal information when you visit opalaccessories.com, create an account or contact us. We are the data controller for this information under UK data protection law (the UK GDPR and the Data Protection Act 2018).

You can contact us about privacy through our contact form or email [email protected].

What we collect

When you sign up with email: your first name, last name, email address, UK phone number and a password. Your password is turned into a one-way code (a hash) before it's saved, so it isn't stored as you typed it and can't be read back.
If you sign up with Google: your name, verified email address and Google account ID, which our server checks directly with Google. We ask for your phone number separately. We never receive your Google password.
While you have an account: your coin balance, level points, the date you joined, your last sign-in, the date you last collected daily coins, the games you've opened recently and a count of failed sign-in attempts.
When you contact us: your name, email address, the topic you chose and your message.
Form records: each time a form is sent (sign up, sign in, contact, daily coins, sign out or account deletion) our server writes a short record with the date, the form, whether it succeeded, your name and email where given, and the page it came from. Passwords are never recorded.

What we don't collect

We never ask for or store card, bank or payment details. There is nothing to buy.
We don't use advertising, tracking or analytics cookies.
We don't sell, rent or share your information for marketing.

How and where it's kept

Our forms are processed on our own server, not in your browser. When you sign up, your account is saved on our server as a protected file that can't be opened from the web. We don't use a third-party database. Only the details shown on your account page are ever sent back to your browser, and only while you're signed in.

Messages you send through the contact or Player Care forms are emailed from our server to our support inbox through our email delivery provider, and a copy is kept in a protected record on our server so we can reply and check the message arrived.

Form records are kept in a protected log on our server that can't be opened from the web.

Why we use it

To run your account (signing you in, keeping your coins, levels and recent games). Our lawful basis is that this is needed to provide the service you asked for.
To check you are 18+ and in the UK, and to keep the website safe from misuse. Our lawful basis is our legitimate interest in running a safe, adults-only service.
To reply when you contact us and to deal with requests like breaks, restrictions and deletion. Our lawful basis is our legitimate interest in helping our players.

How long we keep it

Account details are kept until you delete your account or ask us to delete it. You can delete it yourself from your account page at any time.
Contact messages are kept until your request is dealt with, then deleted within 12 months.
Form records are kept for up to 12 months to help us spot misuse and fix problems, then deleted.

We only share information with services that help us run the website:

Our web hosting provider, which runs the server where your account is stored.
Our email delivery provider, which delivers contact form messages to our inbox.
Google, only if you choose to sign in with Google. Google's own privacy policy applies to that sign-in.

We may also share information if the law requires it.

Keeping it secure

The website is served over an encrypted (HTTPS) connection.
Passwords are stored only as one-way hashes.
Account files, form records and our server code are protected so they can't be opened from the web.
Sign-in uses a secure, http-only session cookie and pauses after five wrong passwords.
Our forms check that they were sent from our own website.

Your rights

Under UK data protection law you have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, and to have it moved to another service.

To make a request, use our contact form or email [email protected]. We will reply within one month. You can delete your account yourself at any time from My account.

If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

Children

Opal Accessories is only for adults aged 18 or over. We don't knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

Changes to this policy

We'll update this page if anything changes. The date at the top shows the latest version.