Privacy Policy | Global Herbseg

In short: we collect only what we need to run your account and reply to you. Everything is processed on our server, stored in protected files, never sold and never used for advertising.

What we collect

When you sign up: a username, email address and password. Your password is turned into a scrambled hash before it is saved, so it is never stored as you typed it. We also record the date you joined, your last sign-in, your coin balance, XP and a count of failed sign-in attempts.
If you sign up with Google: your name, verified email address and Google account ID, which our server checks directly with Google. We never see your Google password.
When you contact us: your name, email, chosen topic and message.
Automatically: the IP address and browser type attached to form submissions, kept in a private server log for security.

Where it is kept

Your account is stored on our own server as a protected file that cannot be opened from the web (the folder is blocked and every file starts with a guard). We do not use a database, and no account data is written into page code, URLs or public tables.

Signing in sets one strictly necessary session cookie (gh_sid, HTTP-only, secure) and a one-time cookie (gh_login, deleted within two minutes) that shows your welcome message. Your age confirmation and cookie choice are kept in your browser's local storage.

Messages you send through the contact or Player Care forms are sent from our server to our support inbox over an encrypted SMTP connection, and a copy is kept in a protected log on our server so we can reply. We delete it once your request is dealt with.

We never ask for or store card or bank details.

Why we use it

To run your account, coins and level
To check you are 18+ and in the UK
To reply when you contact us
To keep the site secure and stop abuse

Our lawful bases are performance of our contract with you (your account), our legitimate interests (security, replying to you) and consent (Google sign-in, optional cookies).

Other services

Google Sign-In, only if you choose it. Google's privacy policy applies.
Google Fonts, which supplies the fonts used on the pages.
Our own game servers at globalherbseg.com/our-games, which load inside our pages.

We do not use advertising networks, analytics trackers or data brokers.

How long we keep it

Your account stays until you delete it from My account or ask us to. Form logs are removed once the request is closed. Security logs are kept for up to 90 days.

Your rights

Under UK GDPR you can ask to see, correct, delete or restrict your information, object to how it is used, or ask for a copy. You can delete your account yourself at any time. For anything else use the contact form with the topic "Privacy question", or email [email protected]. You can also complain to the Information Commissioner's Office at ico.org.uk.

Children

The site is for adults 18+. We do not knowingly collect data from anyone under 18; if you believe we have, contact us and we will delete it.

Changes

We will update this page if anything changes. The date at the top shows the latest version.