Hollaah- Home
- Privacy policy
Privacy policy
What we collect, why, and how your account stays safe on our server.
Updated 27 October 2026
Who's in charge of your data
Hollaah (hollaah.com) is the controller of the personal data described here. For anything to do with your data, email [email protected] or use the contact page.
This policy explains what we collect, why, how long we keep it and your rights under the UK GDPR and the Data Protection Act 2018.
What we collect
| Information | When | Why, and the lawful basis |
|---|---|---|
| Username, email address and a hashed password | You sign up with email | To run your account (contract) |
| Name, email address and Google account ID | You use Continue with Google | To sign you in with Google (contract) |
| Coin balance, XP, level and recently played games | You use your account | To show your progress (contract) |
| Name, email address, topic and message | You send the contact or Player Care form | To answer you (legitimate interests) |
| IP address and time of each form submission | Any form is sent | Security and stopping misuse (legitimate interests) |
| Age confirmation and cookie choice | You visit | Kept only in your own browser |
We never ask for card or bank details and don't collect special category data.
Your password
We never keep your password as you typed it. Our server turns it into a one-way hash with PHP's password_hash function, so nobody can read it back, not even us. Passwords are never logged, never emailed and never shown again after you type them.
Five wrong passwords in a row lock the account for 15 minutes, which stops people guessing.
Where it lives
Every form on Hollaah (sign-up, sign-in, contact and Player Care) is handled by our own web server, not your browser. Account details are kept in private files on that server, which can't be opened from the web. Nothing about your account is written into the pages or shown to anyone else.
Messages to our team travel over an encrypted (TLS) connection through our email delivery provider, and the whole site runs on HTTPS.
Who else sees it
- Our hosting provider, which runs the server the site sits on.
- Our email delivery provider (Brevo), which brings contact and Player Care messages to our inbox.
- Google, only if you choose Continue with Google. Google's privacy policy covers that sign-in.
We don't sell your data, and we don't share it with advertisers.
How long we keep it
- Account data: for as long as your account is open. Delete your account and its file is removed from the server immediately.
- Contact and Player Care messages and form logs: up to 24 months, then deleted.
- Browser storage (age check, cookie choice): until you clear it.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, ask us to limit or stop using it, or ask for it in a portable format. You can delete your own account from My account at any time. For anything else, email [email protected] and we'll reply within a month.
Not happy with how we've handled your data? You can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
Under-18s
Hollaah is for adults only. We don't knowingly collect data from anyone under 18. If you think a child has given us their details, tell us and we'll delete them.
Updates
We may update this policy now and then. The date at the top shows the latest version.