Privacy Notice

Who we are

MN Nature School is the controller of the personal information gathered through mnnatureschool.com. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

• When you join: first name, surname, email address, UK mobile number and a password. The password is turned into a one-way hash before storage, so the original is never kept.
• If you use Google: your name, verified email address and Google account ID, checked with Google by our server. We ask for your mobile number separately.
• While you use your profile: coin balance, rank and XP, how many games you have opened and which ones lately, when you last took a daily bonus, when you joined, your latest sign-in and a count of failed sign-in attempts (five in a row blocks sign-in for 15 minutes).
• When you write to us: your name, email, chosen topic and message.
• Form records: for each form sent, our server keeps a brief note of the date, form type, result and email address used. Passwords are never logged.

Where it is kept

Your profile lives on our own server as a protected file in a private folder that cannot be opened or listed from the web. We run no public database, and profile data is never shown in tables or pages on the site. It remains there until you close your profile from My profile or ask us to delete it.

Messages sent through the contact and Player Care forms are emailed by our server to our team inbox, and a copy goes into a protected server log so we can reply and check delivery.

Signing in sets one essential session cookie (mn_sid). The Cookie Notice explains more.

We never ask for or keep card or bank details.

Why we use it (our legal basis)

We never sell your data, use it for advertising or send you marketing emails.

Who else sees it

• Our hosting provider, which runs the server that holds the site and profiles.
• Our email delivery service (Brevo), which moves contact and Player Care messages from our server to our inbox.
• Google, only when you choose to sign in with Google, under Google's own privacy policy.
• Google Fonts, which supplies the typefaces on our pages and receives your IP address in the process.
• Public authorities, where the law demands it.

Some of these providers may process data outside the UK. When they do, we depend on UK adequacy regulations or approved safeguards such as the International Data Transfer Agreement.

How long it is kept

• Profile: until you close it or ask us to. Profiles unused for 24 months may be deleted.
• Messages and form records: deleted once your request is dealt with, and never later than 12 months.
• Session cookie: until you sign out or close your browser.

Security

Your information is protected by HTTPS encryption, hashed passwords, locked server folders, secure session cookies, sign-in lock-outs and spam traps on every form. No system is perfect, but we work hard to keep your data safe, and should a serious breach ever occur we would tell you and the ICO as the law requires.

Your rights

UK data protection law lets you ask to see, correct or erase your information, restrict or object to how we use it, or receive a portable copy. You can close your profile yourself whenever you like from My profile. For anything else, use the contact form and choose "A data or privacy request". We will reply within one month.

You may also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Under-18s

This site is for adults only. We do not knowingly gather information from anyone under 18, and if we find we have, we will delete it.

Updates

If something changes we will edit this page, and the date at the top will show the newest version.