Who we are
This Privacy Policy explains how Copos Gelato ("we", "us", "our") collects, uses and protects personal information when you use coposgelato.com (the "Site"). We are the data controller for the personal information described here.
You can reach us about anything in this policy through our contact form (choose the topic "Privacy question") or by email at [email protected].
What we collect
We only collect what we need to run the Site:
| Information | When | Why |
|---|---|---|
| Username, email address | When you create an account | To identify your account and contact you about it |
| Password (stored only as a one-way hash) | When you sign up with email | To let you sign in securely |
| Google account ID, name and verified email | Only if you choose "Continue with Google" | To sign you in with Google |
| Coin balance, XP, level, games played, sign-in times | While you use your account | To show your progress and run the daily bonus |
| Name, email, topic and message | When you use the contact or Player Care form | To answer your message |
| IP address, browser type, date and time | When you submit any form | Security, fraud prevention and a record of form submissions |
We do not collect payment details, bank details, identity documents, your date of birth or your location. There is nothing to buy on the Site.
How we use it and our lawful bases
- To provide your account and games (contract): creating your account, signing you in, keeping your coins, XP and level.
- To answer your messages (legitimate interests): replying to contact and Player Care requests, including breaks, restrictions and deletions.
- To keep the Site safe (legitimate interests): limiting wrong password attempts, blocking spam and keeping a log of form submissions.
- To meet legal duties (legal obligation): for example, keeping records we are required to keep.
We do not use your information for advertising, we do not build marketing profiles and we never sell your personal information.
How your data is stored and protected
Everything is server-based. Every form on the Site (sign up, sign in, contact, Player Care, daily bonus, account deletion) is sent to and processed on our server. No account information is kept in your browser, shown in public tables or exposed through queries in the page.
- Accounts are stored in protected files on our server that cannot be opened from the web.
- Passwords are stored only as one-way hashes. Nobody, including our team, can read your password.
- All pages are served over an encrypted HTTPS connection.
- Your sign-in uses a secure, HTTP-only session cookie that page scripts cannot read.
- Repeated wrong passwords lock the account for 15 minutes to stop guessing.
- Only the account owner can see their own username, email, balance and level.
Who we share it with
We only share information with service providers who help us run the Site, under contracts that require them to protect it:
- Our hosting provider, which stores the Site and its files.
- Our email delivery provider, which delivers contact and Player Care messages to our inbox.
- Google, only if you choose to sign in with Google. Google's own privacy policy applies to that sign-in.
We may also share information if the law requires it. We never sell, rent or trade your personal information.
How long we keep it
- Account information: until you delete your account, or 24 months after your last sign-in.
- Contact and Player Care messages: up to 12 months after your request is resolved.
- Form logs: up to 12 months.
When you delete your account from the My Account page, your account file is removed from our server straight away.
International transfers
Our main systems are hosted in the UK or the European Economic Area. If any provider processes data outside the UK, we make sure appropriate safeguards are in place, such as the UK International Data Transfer Agreement or an adequacy decision.
Your rights
Under UK data protection law (UK GDPR and the Data Protection Act 2018) you have the right to:
- access the personal information we hold about you;
- ask us to correct anything that is wrong;
- ask us to delete your information;
- ask us to restrict or stop using it;
- object to how we use it;
- receive a copy in a portable format.
To use any of these rights, write to us through our contact form or email [email protected]. We will reply within one month. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Under-18s
The Site is only for adults aged 18 or over who live in the UK. We do not knowingly collect information from anyone under 18. If we find that an account belongs to someone under 18, we will delete it.
Cookies
We use one strictly necessary cookie and a little browser storage. See our Cookies Policy for details.
Changes to this policy
If we make important changes we will update the date at the top of this page and, where appropriate, tell signed-in players on the Site.