Who is responsible
Engagement Weave (engagementweave.com) is the data controller for the personal data described in this policy. Engagement Weave is operated by , . For privacy matters, use the contact form or email [email protected].
Data we collect
| Situation | Data |
|---|---|
| Registering with email | First name, surname, email address, UK mobile number and password (stored only as a one-way hash), plus your registration date, last sign-in and a count of failed sign-in attempts. |
| Registering with Google | Your name, verified email address and Google account ID, confirmed with Google by our server. Your mobile number is requested separately. |
| Playing while signed in | Coin balance, XP, level, which games you have started and when, and the time of your last daily boost. |
| Contacting us | Your name, email address, subject and message. |
| Security records | A log of registrations, sign-ins and account actions (date, action, email address, result and a shortened IP address). Passwords are never recorded. |
We never ask for or store bank or card details.
Why we use it
- To provide your account, coins and levels (performance of a contract).
- To check that you're 18+ and in the UK and to prevent misuse (legitimate interests and legal obligations).
- To answer your messages and carry out pause, restriction or closure requests (legitimate interests).
- To keep the Site secure through logging and sign-in limits (legitimate interests).
We do not sell personal data or use it for third-party advertising.
Where it's stored and how it's protected
Account data is processed and stored on our own server, not in your browser, and is never published in a web page, public table or visible database query. Each account is a separate file in a protected folder that cannot be accessed from the internet. Passwords are hashed, the session cookie is HttpOnly and HTTPS-only, and Google sign-ins are verified with Google.
Messages are emailed from our server to our team inbox through our email delivery provider, and a copy is held in a protected server log so we can reply and confirm delivery.
Who we share it with
- Our hosting provider, which operates the server the Site runs on.
- Our email delivery provider (Brevo), which delivers messages to our inbox.
- Google, only if you choose Google sign-in.
- Public authorities, where the law requires.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or approved safeguards such as the International Data Transfer Agreement.
How long we keep it
- Accounts: until you close yours, or after 24 months without a sign-in.
- Messages: until your enquiry is resolved, and no longer than 12 months.
- Security logs: up to 12 months.
Your rights
Under UK GDPR you may request access to, correction or erasure of your data, restrict or object to its use, and receive a portable copy. You can close your account yourself from My profile. For anything else, use the contact form; we respond within one month.
You may also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
Under-18s
The Site is for adults only. We do not knowingly collect data from anyone under 18 and will delete any such account we discover.
Cookies
We use one essential cookie to keep you signed in, and browser storage for your age confirmation and cookie choice. See the Cookies Policy.
Changes to this policy
We'll update this page whenever our practices change. The date above shows the latest version.