1. Who we are
This Privacy Policy explains how Rinyaya (rinyayahome.com, "we") collects and uses personal information. We are the data controller. Reach us about privacy at [email protected] or via the contact form.
2. What we collect
When you join
- Username and email address.
- Password, converted to a one-way hash before saving, so it's never stored as you typed it.
- Your free coin balance, XP, level, games played and recently played list.
- Your join date, last sign-in, last daily key and a count of failed sign-in attempts.
If you use Google
- Your name, verified email address and Google account ID, checked by our server directly with Google. We never receive your Google password.
When you message us
- Your name, email, subject and message.
Form log
- Each form submitted (joining, signing in, contact, Player Care, daily key, account deletion) adds a short entry on our server: date and time, which form, the result, the email or username, your IP address and browser type. Passwords and sign-in tokens are never logged.
We never ask for card or bank details. There is nothing to buy.
3. How our server-side systems protect you
Everything is processed on our server. Our join, sign-in, contact and Player Care forms send your details directly to our server over encrypted HTTPS. Personal data is never written into the page, stored in your browser, or placed in any file, table or query that a visitor can view.
- Account records are kept in a locked server folder that is blocked from the web. Each record also begins with a guard line so it can't be opened in a browser even if folder settings fail.
- Passwords are stored only as a salted one-way hash using PHP's built-in password hashing.
- Sign-in uses a secure session cookie: httpOnly (scripts can't read it), SameSite and Secure over HTTPS. A fresh session ID is issued each time you sign in.
- Five wrong passwords pause sign-in for 15 minutes.
- Form logs sit in a protected folder that is also blocked from the web.
- Pages only receive what they need to display, such as your username, coins and level on My account, and only while you're signed in.
4. Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account, coins and levels | Contract |
| Confirming you're 18+ and in the UK | Legal obligation, legitimate interests |
| Replying to messages and Player Care | Legitimate interests, contract |
| Form logs, security and preventing abuse | Legitimate interests |
| Breaks, limits and deletion | Legitimate interests, your request |
5. Sharing
We don't sell your data or use it for advertising. We share it only with:
- Our hosting provider, which runs the server storing the website and account files.
- Our email delivery provider (Brevo), which carries contact and Player Care messages from our server to our inbox.
- Google, only if you choose Google Sign-In.
- Public authorities, where the law requires.
Where a provider handles data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. Retention
- Accounts: until you delete yours or ask us to. Accounts unused for 24 months may be removed.
- Messages: while we deal with your request, then up to 12 months.
- Form logs: up to 12 months.
7. Your rights
Under UK data protection law you can ask to access, correct or erase your data, restrict or object to how it's used, and get a portable copy. You can delete your account yourself in My account. For anything else, email [email protected]. We'll respond within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies
We use one essential cookie to keep you signed in, plus small browser-storage items for your age check and cookie choice. See our Cookies Policy.
9. Under 18s
The Service is for adults only. We don't knowingly collect data from anyone under 18, and we delete it if we discover we have.
10. Updates
We'll update this page if anything changes. Check the date at the top for the latest version.