1. Who we are
Cool Animal Video (coolanimalvideo.com) is the data controller for personal data collected through this website. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You can reach us about privacy through our contact form, the Player Care form or by email at [email protected] (choose the topic "Privacy question").
2. The short version
- You can play every game without giving us any personal data.
- If you create an account we store your name, email, UK phone number and a hashed password (never the password itself).
- All forms are processed on our own server. Account details are kept in protected files that cannot be opened from the web. They are not stored in public tables and no data or queries are ever shown on the website.
- We do not sell, rent or share your data for marketing.
- We never ask for or store payment details, because there is nothing to buy.
3. What we collect
| When | What we collect |
|---|---|
| Creating an account with email | First and last name, email address, UK phone number, password (stored only as a secure one-way hash), confirmation that you are 18+ and in the UK, date created |
| Signing up with Google | Your name, verified email address and Google account ID, sent to us by Google after you agree. We then ask for your UK phone number. |
| Using your account | Coin balance, XP and level, date of your last daily bonus, last sign-in date and the last few games you opened |
| Contact and Player Care forms | Your name, email address, topic and message |
| Security logs | Date and time of form submissions, the type of form, the email entered, the result (for example "signed in" or "failed") and your IP address. Passwords and Google tokens are never logged. |
| Browsing | A session cookie to keep you signed in, and browser storage for your age check and cookie choice. See our Cookies Policy. |
4. Why we use it and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, coins, levels and bonus | Contract (to provide the service you asked for) |
| Checking you are 18+ and in the UK | Legal obligation and legitimate interests (protecting young people) |
| Replying to your messages and Player Care requests | Legitimate interests (helping you) |
| Keeping the website and accounts secure, preventing abuse | Legitimate interests (security) |
| Honouring breaks, restrictions and deletions you ask for | Legitimate interests and legal obligation |
5. How we keep your data safe
- Server-side processing. Sign-in, sign-up and contact forms are sent straight to our server over an encrypted HTTPS connection. Nothing is processed in public tables or shared spreadsheets.
- Hashed passwords. Passwords are hashed with PHP's
password_hash(bcrypt). We cannot see your password. - Protected account files. Each account is saved as a separate file on our server, named with a one-way code rather than your email, and blocked from web access.
- Protected logs. Form logs are stored in a private folder that cannot be opened from a browser.
- Sign-in protection. After five wrong passwords an account is locked for 15 minutes. Sessions use a secure, HTTP-only cookie.
- Google sign-in. Google's sign-in token is checked directly with Google before we accept it.
6. Who we share it with
We only share data with service providers who help us run the website, under contracts that protect your data:
- Our web host, which stores the website, account files and logs.
- Our email delivery provider (Brevo), which delivers messages from our contact and Player Care forms to our team.
- Google, only if you choose to sign in with Google.
We may also share data if the law requires it. We never sell your data.
7. International transfers
Some providers (such as Google and Brevo) may process data outside the UK. Where this happens we rely on UK adequacy regulations or the UK International Data Transfer Agreement / Addendum to keep your data protected.
8. How long we keep it
- Account data: while your account is open. If you delete your account, its file is removed from our server straight away.
- Contact messages: up to 24 months, then deleted.
- Security logs: up to 12 months.
9. Your rights
Under UK GDPR you have the right to access, correct or delete your data, to restrict or object to how we use it, and to data portability. You can delete your account yourself on the My account page. For any other request, contact us through our contact form, the Player Care form or by email at [email protected]. We reply within one month.
If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.
10. Children
The website is not intended for anyone under 18. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it.
11. Changes to this policy
We may update this policy. The date at the top shows when it last changed. Significant changes will be highlighted on the website.