Last updated: 25 October 2026
1. Who we are
Floorin Gmadeez ("we", "us") runs the website flooringmadeez.com. We are the data controller for the personal data described in this policy. You can reach us about privacy at any time by email at [email protected] or through our contact page (choose "Privacy question").
2. What we collect
| Data | When | Why |
|---|---|---|
| Username, email address | When you create an account | To create and run your account |
| Password (stored only as a one-way hash) | Email sign-up | To let you sign in securely |
| Google account ID and verified email | If you use "Continue with Google" | To link your Google sign-in to your account |
| Coins, XP, level, daily bonus time, recently played games, sign-up and last sign-in dates | While you use your account | To provide account features |
| Failed sign-in count and temporary lock time | When a wrong password is entered | To protect your account |
| Name, email, topic and message | When you use the contact or Player Care form | To reply and help you |
| Form activity record (date, form, outcome, email, partly masked IP address) | When a form is submitted | Security, fraud prevention and support |
| Age confirmation and cookie choice | On your device only | So we don't ask every visit |
We never ask for or store payment details, and we never log your password.
3. Our legal bases
- Contract: to provide your account and its features when you sign up.
- Legitimate interests: to keep the Service secure, prevent misuse, answer messages and improve our games.
- Legal obligation: where the law requires us to keep or share information.
- Consent: for any optional cookies (we don't currently use any).
4. How we store and protect your data
Your account is stored on our own web server in a private area that cannot be opened from the internet. Nothing about your account is published on the site or kept in your browser; pages ask our server for your details only after you've signed in.
- All pages are served over an encrypted HTTPS connection.
- Passwords are stored only as strong one-way hashes, so even we cannot read them.
- Sign-in uses a secure, HTTP-only session cookie that page scripts cannot read.
- Accounts lock for 15 minutes after 5 wrong passwords.
- Forms are processed on our server with spam protection, and records are kept in restricted files.
5. Who we share data with
We don't sell your data and we don't share it for advertising. We only use these service providers:
- Our web hosting provider, which runs the server the site and your account live on.
- Brevo (email delivery), which delivers contact and Player Care messages to our inbox.
- Google, only if you choose "Continue with Google", to confirm your identity.
Where a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Account data: until you delete your account, or after 24 months without a sign-in.
- Contact messages: up to 24 months after the conversation ends.
- Form activity records: up to 12 months.
When you delete your account from your account page, your account file is removed from our server straight away.
7. Your rights
Under UK data protection law you can ask to access, correct, delete, restrict or move your data, object to how we use it, and withdraw consent. Send requests through our contact page. We'll reply within one month.
You can also complain to the Information Commissioner's Office: ico.org.uk or 0303 123 1113. We'd appreciate the chance to help first.
8. Under 18s
The Service is only for adults aged 18 or over. We don't knowingly collect data from anyone under 18. If you believe a child has created an account, please contact us and we will delete it.
9. Changes
We'll update this policy if the way we handle data changes. The date at the top shows the latest version.