1. Who we are
This Privacy Policy explains how Five Senses Tours (fivesensestours.com, "we", "us") collects and uses personal information. We are the data controller for the information described below. You can contact us about privacy through the contact form or by email at [email protected].
2. What we collect
When you create an account
- Username and email address.
- Password. It is turned into a one-way hash before it is saved, so it is never stored as you typed it.
- Your free coin balance, XP, level, number of games played and recently played games.
- The date you joined, your last sign-in, when you last collected the daily bonus and a count of failed sign-in attempts.
If you use Google Sign-In
- Your name, verified email address and Google account ID, checked by our server directly with Google. We never receive your Google password.
When you contact us
- Your name, email address, topic and message.
Form log
- When a form is submitted (sign-up, sign-in, contact, Player Care, daily bonus, account deletion), our server writes a short record: the date and time, the form, whether it succeeded, the email or username involved, your IP address and browser type. Passwords and sign-in tokens are never logged.
We do not ask for or store payment card or bank details. There is nothing to buy.
3. How our systems keep your data safe
Everything is handled on our server. Our sign-up, sign-in, contact and Player Care forms send your details directly to our server over an encrypted HTTPS connection. Your personal details are never placed in the page code, in your browser's storage, or in any file or table a visitor can open.
- Account records are kept in a protected folder on our server that is blocked from web access. Each record also starts with a guard line, so it cannot be opened from a browser even if the folder settings fail.
- Passwords are stored only as a salted one-way hash using PHP's built-in password hashing.
- Sign-in uses a secure session cookie that is httpOnly (JavaScript cannot read it), SameSite and Secure on HTTPS. Your session ID is renewed every time you sign in.
- Five wrong password attempts lock the account for 15 minutes.
- The form logs are kept in a protected folder that is also blocked from the web.
- Pages only receive what they need to show you (for example, your username, coins and level on your account page), and only while you are signed in.
4. Why we use it (legal bases)
| Purpose | Legal basis (UK GDPR) |
|---|---|
| Creating and running your account, coins and levels | Contract: to provide the service you signed up for |
| Checking you are 18+ and in the UK | Legal obligation and legitimate interests |
| Replying to contact and Player Care messages | Legitimate interests (helping you); contract |
| Form logs, security and preventing abuse | Legitimate interests (keeping the service and accounts secure) |
| Breaks, restrictions and account deletion | Legitimate interests and your request |
5. Who we share it with
We do not sell your data and we do not use it for advertising. We share it only with:
- Our hosting provider, which runs the server where the website and account files are stored.
- Our email delivery provider (Brevo SMTP), which delivers contact and Player Care messages from our server to our support inbox.
- Google, only if you choose Google Sign-In, to check your sign-in.
- Authorities, if the law requires it.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Accounts: until you delete your account or ask us to. Accounts with no sign-in for 24 months may be deleted.
- Contact and Player Care messages: for as long as needed to deal with your request, then up to 12 months.
- Form logs: up to 12 months, then deleted.
7. Your rights
Under UK data protection law you can ask to access, correct or delete your information, ask us to restrict or object to how we use it, and ask for a copy to take elsewhere. You can delete your account yourself at any time from My account. To make any other request, use the contact form. We reply within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
8. Cookies and browser storage
We use one strictly necessary cookie to keep you signed in, plus a few small browser-storage items that remember your age confirmation and cookie choice. Full details are in our Cookies Policy.
9. Under 18s
The Service is only for adults aged 18+. We do not knowingly collect data from anyone under 18. If we learn that we have, we delete it.
10. Changes
We will update this page if anything changes. The date at the top shows the latest version.