Privacy Policy

Last updated: 1 November 2026

1. Who we are

Ehtiyag (“Ehtiyag”, “we”, “us”, “our”) runs the website at ehtiyag.com. You can contact us at any time through our Contact page or by email at [email protected].

We are the controller of the personal data described in this policy. This policy explains what we collect, why, how we protect it and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. The short version

In plain words: we only collect what we need to run your free account and answer your messages. All of our forms are processed on our own server — nothing you type is stored in your browser, shown on any page or sent to advertisers. Passwords are stored only as one-way encrypted hashes. We never ask for payment details and we never sell your data.

3. What we collect

When	What we collect	Why
You play as a guest	Nothing that identifies you. Our server keeps standard technical logs (IP address, browser type, pages requested) for security.	To keep the website secure and working.
You create an account with email	Username, email address, a hashed (encrypted, one-way) password, date of sign-up, your confirmation that you are 18+ and in the UK.	To create and run your account.
You sign in with Google	Your name, verified email address and Google account ID, as shared by Google. We never see your Google password.	To sign you in quickly and securely.
You use your account	Coin balance, XP, level, games opened, daily bonus time, last sign-in time, and a count of failed sign-in attempts.	To provide coins, levels and bonuses, and to protect your account.
You contact us	Your name, email, the topic you choose and your message.	To answer you and keep a record of support requests.

4. How our forms and systems keep your data safe

Every form on Ehtiyag — sign up, sign in, Google sign-in, daily bonus, contact and Player Care — is server-based:

Processed on our server, not in your browser. When you press a button, your details travel over an encrypted HTTPS connection to our server, which checks them and sends you back to the page. Your details are never written into the page or stored in your browser's storage.
No exposed tables or queries. Account records are kept as protected files in a private folder on our server that is blocked from public web access. There are no public database tables, query strings or account lists that anyone can view.
Passwords are hashed. We store passwords only as one-way hashes created with PHP's password_hash (bcrypt). Nobody — including our team — can read your password.
Sign-in protection. After five wrong passwords an account is locked for 15 minutes, and sessions use a secure, HTTP-only cookie that scripts can't read.
Spam protection. Our forms include hidden checks that stop automated submissions.
Secure email. Contact and Player Care messages are sent from our server to our support inbox over an encrypted (TLS) SMTP connection.
Submission log. Our server keeps a private log of form submissions (date, form, result, and the details you entered such as name, email and message — never passwords) so we can investigate problems and abuse. The log is stored in a folder that is blocked from public access.

No system is completely risk-free, but we review these protections regularly and limit access to our server to the people who need it.

5. Our lawful bases

Contract — to create and run your account and provide the website's features you ask for.
Legitimate interests — to keep the website secure, prevent misuse, answer messages and improve our games.
Legal obligation — where we must keep or share information by law.
Consent — for any optional cookies (see our Cookies Policy). You can withdraw consent at any time.

We never sell or rent your personal data and we never share it with advertisers. We use a small number of trusted service providers who process data only on our instructions:

Our web hosting provider, which runs the server that stores the website and your account.
Brevo (our email delivery provider), which carries contact and Player Care messages from our server to our inbox.
Google, only if you choose to sign in with Google.

We may also share information if the law requires it, or to protect the safety of our players or the public. Where a provider handles data outside the UK, we make sure appropriate safeguards (such as UK adequacy regulations or the UK International Data Transfer Addendum) are in place.

7. How long we keep data

Accounts — while your account is open. If you delete your account, its file is removed from our server straight away. Accounts unused for 24 months may be deleted.
Messages to us — up to 24 months after the conversation ends.
Form submission log and server logs — up to 12 months, unless needed longer to investigate abuse.

8. Your rights

Under UK data protection law you have the right to: access the personal data we hold about you; ask us to correct it; ask us to delete it; ask us to restrict or object to how we use it; and receive a copy of it in a portable format. You can delete your account yourself from My account, or contact us to use any of your rights. We will reply within one month.

If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to help first.

9. Children

Ehtiyag is only for adults aged 18 and over. We do not knowingly collect data from anyone under 18. If you believe a child has created an account, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. The date at the top shows the latest version. If we make a significant change we'll make it clear on the website.