Privacy policy

Who we are

Soul Retreat Yoga ("we", "us") runs soulretreatyoga.com and is the controller of your personal information under the data protection laws that apply to you, such as the GDPR or the UK GDPR.

You can contact us through our Contact page or the Player Care form at the bottom of every page. You can also email [email protected].

What we collect and why

We only collect what we need to run a free games site. You can play every game without giving us anything.

What	Why we use it	Lawful basis
Name, email, phone number	To create and run your account, check you are eligible and contact you about it	Contract
Password (stored only as a one-way hash)	To let you sign in securely	Contract
Google account ID, name and verified email (only if you use Google sign-in)	To sign you in with Google	Contract
Coins, XP, level, recently played games, sign-in and bonus times	To provide the coin basket, bonuses and levels	Contract
Contact and Player Care messages (name, email, topic, message)	To answer you and act on requests such as breaks or deletion	Legitimate interests; legal obligation where relevant
Form log entries (date, form, result, name and email where given, IP address)	To keep the site secure, prevent abuse and investigate problems	Legitimate interests
Failed sign-in count and lockout time	To protect your account from password guessing	Legitimate interests

We do not collect payment details, because there is nothing to buy. We do not sell your information, and we do not use it for advertising.

How your information is stored

Accounts are stored on our own web server. Each account is kept in its own protected file inside a folder that cannot be opened from the web. Passwords are never stored in readable form; we keep only a secure hash. All forms are processed on the server, and the site is served over an encrypted (HTTPS) connection.

Form submissions are recorded in a private server log so we can spot abuse and fix problems. Passwords and sign-in tokens are never written to the log.

Our hosting provider, which runs the server the site and accounts live on.
Brevo (Sendinblue SAS), our email delivery service, which carries contact and Player Care messages from our server to our inbox.
Google, only if you choose Continue with Google. Google confirms who you are and tells us your name and verified email. Google's privacy policy applies to that sign-in.
Authorities or advisers, if the law requires it or to protect people from harm.

Where a provider handles data in another country, we use the safeguards the law requires, such as adequacy decisions or standard contract terms.

How long we keep it

Account details: until you delete your account, or after two years without a sign-in.
Contact and Player Care messages: up to two years, longer if needed to honour a break or restriction you asked for.
Form log entries: up to 12 months.
Sign-in session: until you close your browser or sign out.

When you delete your account, its file is removed from our server immediately. Copies in routine server backups are overwritten in the normal cycle.

Your rights

You have the right to:

ask for a copy of your personal information;
ask us to correct it, or to delete it (you can also delete your account yourself);
object to or ask us to restrict how we use it;
ask us to transfer it to you in a common format.

To use any of these rights, contact us and choose Privacy question. We will reply within one month. If you are unhappy with how we handle your information, you can also complain to the data protection authority in the country where you live.

Under-18s

The site is only for adults aged 18 or over. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.

Cookies

We use one strictly necessary cookie and some browser storage. See our Cookie policy for details.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. Significant changes will be highlighted on the site.