Privacy Policy

1. Who we are

This policy explains how Cruises Online (cruises-online.com, "we") collects and uses personal information when you visit our site, create an account or contact us. We are the data controller for this information under the UK GDPR and the Data Protection Act 2018.

2. What we collect

When you sign up with email: your username, first name, last name, email address and password. Your password is converted into a one-way hash before it is saved, so it is never stored as you typed it.
When you sign up with Google: your name, verified email address and Google account ID, which our server checks directly with Google. We never receive your Google password. We ask you to choose a username.
While you play: your coin balance, XP, rank, number of games launched, the time of your last daily bonus, the date you joined, your last sign-in and a count of failed sign-in attempts (used for lock-out protection).
When you contact us: your name, email address, the topic and your message.

We do not collect payment details, as there is nothing to buy.

3. Where your data is kept

Your account is stored on our server as a protected file that cannot be opened from the web. We do not show account details, data tables or database queries anywhere on the site, and nothing about your account is stored in the page code.

Messages sent through our contact and Player Care forms are processed on our server and emailed to our support inbox through an authenticated, encrypted email service (Brevo). A copy is kept in a protected server log so we can reply and confirm delivery.

Account events (sign-ups, sign-ins, failed attempts, daily bonus claims, account deletion) are recorded in a protected server log with the date, time and email address. Passwords are never logged.

4. Why we use it (lawful basis)

Purpose	Lawful basis
Creating and running your account, coins and ranks	Contract - to provide the service you signed up for
Checking you are 18+ and in the UK	Legal obligation and legitimate interests
Replying to your messages and Player Care requests	Legitimate interests
Keeping accounts secure and preventing misuse	Legitimate interests

We do not use your data for marketing and we never sell or rent it.

Google - only if you choose Google sign-in.
Our email provider - to deliver your messages to our team.
Our hosting provider - which stores the server our site runs on.
Authorities - only where the law requires it.

6. How long we keep it

Account data: until you delete your account or ask us to delete it.
Contact messages and logs: for up to 12 months, or less once your request has been dealt with.
Inactive accounts may be deleted after 24 months without a sign-in.

7. How we protect it

All forms are server-side and sent over encrypted HTTPS. Passwords are hashed, sessions use a secure HttpOnly cookie, repeated wrong passwords trigger a temporary lock, and our account and log folders are blocked from public access. No system is perfectly secure, but we work hard to protect your information.

8. Your rights

Under UK data protection law you have the right to access, correct or delete your personal data, to restrict or object to how we use it and to data portability. You can delete your account yourself from My account. For anything else, use our contact form or by email at [email protected] with the topic "Privacy question".

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Under-18s

Our site is for adults only. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, please contact us and we will delete it.

10. Cookies

See our Cookies Policy for details of the cookie and browser storage we use.

11. Changes to this policy

We will update this page if anything changes. The date at the top shows the latest version.