1. About us
This Privacy Policy explains how Frio Calor (friocalorsevilla.com, "we") collects and uses personal information. We are the data controller. Contact us about privacy at [email protected] or through the contact form.
2. Information we collect
Account details
- Username and email address.
- Password, converted into a one-way hash before it is saved, so it is never stored as typed.
- Your free coin balance, XP, level, number of games opened and recently played games.
- When you joined, your last log-in, when you last collected the daily top-up and a count of failed log-in attempts.
Google Sign-In
- Your name, verified email and Google account ID, checked by our server directly with Google. We never receive your Google password.
Messages
- Name, email, topic and message when you contact us or Player Care.
Form log
- Each form submission (sign-up, log-in, contact, Player Care, daily top-up, deletion) adds a short record on our server: date and time, the form, the result, the email or username, your IP address and browser type. Passwords and sign-in tokens are never recorded.
We never ask for card or bank details. There is nothing to buy.
3. How our server keeps it safe
Everything runs server-side. Our sign-up, log-in, contact and Player Care forms send details straight to our server over encrypted HTTPS. Personal data is never written into the page, kept in browser storage, or placed in any file, table or query a visitor can see.
- Account records live in a sealed server folder that is blocked from web access, and each record begins with a guard line so it can't be opened in a browser even if folder settings fail.
- Passwords are kept only as a salted one-way hash using PHP's built-in hashing.
- Log-in uses a secure session cookie: httpOnly (scripts can't read it), SameSite and Secure over HTTPS. A new session ID is issued at every log-in.
- Five wrong passwords pause log-ins for 15 minutes.
- Form logs are stored in a protected folder that is also blocked from the web.
- Pages only receive what they need to display (for example your username, coins and level on My account), and only while you're logged in.
4. Why we use it
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Running your account, coins and levels | Contract |
| Checking you are 18+ and in the UK | Legal obligation, legitimate interests |
| Answering messages and Player Care requests | Legitimate interests, contract |
| Form logs, security and abuse prevention | Legitimate interests |
| Breaks, limits and account deletion | Legitimate interests, your request |
5. Who sees it
We don't sell data or use it for advertising. We share it only with:
- Our web host, which runs the server holding the site and account files.
- Our email delivery provider (Brevo), which carries contact and Player Care messages from our server to our inbox.
- Google, only if you choose Google Sign-In.
- Authorities, where the law requires it.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Accounts: until you delete yours or ask us to. Accounts unused for 24 months may be removed.
- Messages: while we deal with your request, then up to 12 months.
- Form logs: up to 12 months.
7. Your rights
Under UK data protection law you can ask to see, correct or erase your data, restrict or object to its use, and receive a copy to take elsewhere. You can delete your account yourself in My account. For anything else, email [email protected]. We reply within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.
8. Cookies
We use one essential cookie to keep you logged in, plus small browser-storage items for your age check and cookie choice. See the Cookies Policy.
9. Under 18s
The Service is for adults only. We don't knowingly collect data from anyone under 18 and will delete it if we find we have.
10. Changes
We'll update this page when things change. The date at the top shows the latest version.