PrivacyPolicy.

Who is responsible

Kuru Safaris (kuru-safaris.com) is the controller of the personal information described here. You can reach us through the contact form.

What we collect

• When you sign up: your username, email address and a password. The password is scrambled (hashed) before it is saved, so we can't read it. We also record when you joined, your last sign-in, and a count of wrong password tries (five wrong tries lock the account for 15 minutes).
• If you use Google: your verified email address and Google account ID, checked by our server with Google. We don't receive your Google password. You then choose a username with us.
• Your account progress: your coins, XP, level, when you last collected the daily bonus, and when you last opened each game (so rewards can be limited fairly).
• When you contact us: the name, email, topic and message you type into the form.
• In your own browser: your age confirmation, your cookie choice and your session timer. See the Cookies Policy.

We don't ask for or store card or bank details, and we don't use advertising or analytics trackers.

Where it's kept

Your account is stored on our server as a protected file that can't be opened from the web. There is no public database, so there are no tables or queries that could be seen from the site. Signing in sets one strictly necessary session cookie that keeps you signed in.

Form records. Every time a form is sent (sign up, sign in, contact), we add a short entry to a private log on our server so we can check it worked, deal with problems and keep the site secure. Passwords are never written to it. We keep entries only as long as needed for those purposes.

Contact messages are also emailed from our server to our support inbox through our email delivery provider (Brevo), who handles them only to deliver the mail.

Why we use it

• To create and run your account, coins and level (to carry out our agreement with you);
• To check you are 18+ and in the UK, to keep the site secure and to prevent cheating or misuse (our legitimate interests, and legal duties);
• To reply when you contact us (our legitimate interests, or your request).

Who else sees it

• Google, only if you choose Google sign-in. Google's own privacy policy applies to that step.
• Brevo, our email delivery provider, for contact messages.
• Our hosting provider, which stores the site and your account file for us.

Our games are hosted on our own domain, and our fonts are served from our own server, so they don't send your details to anyone else. We don't sell your information.

How long we keep it

Your account stays until you delete it from your account page or ask us to. Deleting removes your account file from our server. Contact messages and log entries are kept only as long as needed to deal with your request and keep the site safe.

Your rights

Under UK data protection law you can ask to see, correct or delete your information, ask us to limit or stop using it, and ask for a copy. You can delete your account yourself at any time. To use any other right, send a request through the contact form. You can also complain to the Information Commissioner's Office at ico.org.uk.

Keeping your information safe

All forms are checked and processed on our server. Account files are protected from web access, passwords are hashed, sign-in attempts are limited, and the actions that change your account carry a security token. No system is perfect, so please use a strong password you don't use anywhere else.

Age

The site is for adults aged 18 and over. We don't knowingly collect information from anyone under 18, and will delete it if we find out we have.

Changes

If we change this policy we'll update this page. The date at the top shows the latest version.