- Home
- Privacy policy
Privacy policy
What we collect, why, how we protect it and what you can do about it.
Last updated: 12 October 2026
Who we are
This policy explains how Aitattab collects and uses personal information when you visit aitattab.com, create an account or contact us. We follow UK data protection law, including the UK GDPR and the Data Protection Act 2018.
What we collect
- When you sign up with email: username, first and last name, email address, date of birth and a password. The password is turned into a one-way hash before it's saved, so we never store or see it.
- When you sign up with Google: your name, verified email address and Google account ID, checked by our server directly with Google. We then ask you for a username and date of birth.
- While you play: your coin balance, XP, level, the date of your last daily bonus, the games you open recently and how many games you've opened.
- For security: the date of each sign-in, failed sign-in attempts, and the IP address and time of each form submission.
- When you contact us: your name, email, topic and message.
We never ask for or store card or bank details.
Where it's kept and how it's protected
Your account is stored on our own server as a protected file that the public web can't open. We don't use third-party account databases, and your data is never displayed on public pages. Account files, form logs and server code are kept in folders that are blocked from web access.
All forms (sign-up, sign-in, contact and Player Care) are processed on our server. Messages are emailed securely from our server to our support inbox through an encrypted (TLS) connection with our email provider, and a copy is kept in a private server log so we can reply and confirm delivery.
Signing in sets a strictly necessary, HttpOnly session cookie (aitattab_sid) that page scripts can't read. See the Cookies policy.
Why we use it
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, coins and levels | Contract |
| Checking you are 18+ and in the UK | Legal obligation and legitimate interests |
| Keeping accounts secure, preventing abuse | Legitimate interests |
| Replying to messages and Player Care requests | Legitimate interests |
We don't sell your data, use it for advertising profiles, or send marketing emails.
How long we keep it
- Account data: until you delete your account or ask us to delete it.
- Contact and Player Care messages and form logs: up to 12 months, or less once your request is dealt with.
- Security records: up to 12 months.
Who we share it with
- Our hosting provider, which runs the server your data is stored on.
- Our email provider, which delivers contact form messages to our inbox.
- Google, only if you choose Google sign-in. Google's own privacy policy applies.
We may share information if the law requires it.
Your rights
You can ask to see, correct, delete or move your data, or object to how we use it. You can delete your account yourself from My account, which removes it from our server. For anything else, use the contact form and choose "Privacy question". If you're unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.
Under-18s
Aitattab is not for anyone under 18. We don't knowingly collect data from under-18s and will delete any account we find belongs to one.
Changes
We'll update this page if anything changes. The date at the top shows the latest version.