Who we are
Loves Dasha operates lovesdasha.com and is the controller of the personal data described in this policy. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For any privacy question or request, email [email protected], use our contact form and choose "Privacy question", or .
What we collect
| What | When | Why |
|---|---|---|
| Username, email address and password (stored as a one-way hash) | When you create an account | To run your account and let you sign in |
| First and last name | Only if you add them, or if you sign up with Google | To personalise your account |
| Google account ID, name and verified email | If you choose "Continue with Google" | To sign you in with Google |
| Coin balance, XP, level, daily bonus dates and the games you open | While you're signed in | To keep your progress and show it on your account page |
| Date of sign-up, last sign-in and failed sign-in count | When you sign in | To keep accounts secure and lock them after repeated wrong passwords |
| Name, email, topic and message | When you use our contact or Player Care form | To answer you and keep a record of what was asked |
We don't ask for payment details, your address, your phone number or any official ID. Please don't send sensitive information through our forms.
How your data is kept safe
Your account and your messages are handled entirely on our server. Here is what that means in practice:
- Server-side forms. Every form on the Site (sign-up, sign-in, account changes, contact and Player Care) is sent to our server over an encrypted HTTPS connection and processed there. Nothing is saved in public tables, and no database queries are ever shown in your browser.
- Passwords are hashed. We never store your password as text. It's turned into a one-way hash that can't be reversed, not even by us.
- Private storage. Account records are kept in protected server files that can't be opened from the web.
- Secure sessions. Signing in creates one session cookie that scripts can't read (HttpOnly), that's sent only over secure connections, and that expires when you close your browser.
- Lockout. After five wrong passwords an account is locked for 15 minutes.
- Logs. We keep a private server log of form submissions and sign-in events (date, action, email and result) to investigate problems and misuse. Passwords are never logged.
Our lawful bases
- Contract: to provide your account and the games you choose to play.
- Legitimate interests: to keep the Site secure, prevent misuse, answer your messages and improve our games. We balance these against your rights.
- Legal obligation: where we have to keep or share data by law.
- Consent: for any optional cookies, which you can change at any time.
Who we share data with
We never sell your data or share it for marketing. We share only what's needed with:
- Our hosting provider, which stores the Site and its files in a secure data centre.
- Our email delivery provider, which delivers contact and Player Care messages to our team.
- Google, only if you choose to sign in with Google, under Google's privacy policy.
- Authorities, if the law requires it.
Where a provider handles data outside the UK, we make sure suitable safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
How long we keep it
- Account data: while your account is open. Deleting your account removes it straight away. Accounts unused for 24 months may be closed and deleted.
- Contact and Player Care messages: up to 24 months, then deleted.
- Server logs: up to 12 months.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of your data (access);
- correct data that's wrong (rectification);
- delete your data (erasure). You can also do this yourself from your account page;
- limit or object to how we use it;
- send your data to you or another organisation (portability);
- withdraw any consent you gave.
We'll reply within one month. If you're unhappy with how we've handled your data you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Children
The Site isn't for anyone under 18 and we don't knowingly collect data from children. If you believe a child has created an account, please contact us and we'll delete it.
Changes to this policy
We'll update this page when our practices change. The date at the top shows the latest version.