Who we are
Kena Graphy runs kenagraphy.com and is the controller of the personal data described here under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Registered details: , company no. , .
What we collect
| When | What we keep |
|---|---|
| You create an account | First and last name, email address, UK phone number, a one-way hash of your password (never the password itself), sign-up date and method. |
| You sign in with Google | Your name, verified email address and Google account ID. We never see your Google password. |
| You play as a member | Coin balance, XP and level, games recently opened, last sign-in time, daily bonus time and failed sign-in count (to block password guessing). |
| You send a message | Your name, email address, topic and message, plus the date and whether it was delivered. |
| You use the site | A session cookie, your IP address in our security log, and standard web server logs (browser type, pages requested, time). |
| You play as a guest | Nothing on our server. Guest coins, level and recent games stay in your own browser storage. |
We don't collect payment details, because there is nothing to buy.
How we use it and why
- To run your account (sign you in, save your coins and level): necessary to provide the service you asked for.
- To keep the site secure (blocking password guessing, spotting misuse, keeping a security log): our legitimate interest in protecting players and the site.
- To answer messages and handle requests such as a break, restriction or deletion: necessary to provide the service and our legitimate interest in supporting players.
- To check you're an adult in the UK: our legitimate interest and our responsibility to keep the site for adults only.
- Optional cookies: only with your consent.
We don't sell your data, we don't send marketing, and we don't use your details for advertising profiles.
Where and how we store it
Accounts are stored as individual private files on our own web server, not in a public or shared database. The folder is locked so it can't be opened from the web, every account file starts with a guard that refuses to display it, and file names are a scrambled hash of your email address.
- Passwords are hashed with PHP's password_hash (bcrypt) and can't be turned back into the original password.
- The site runs over encrypted HTTPS.
- Your sign-in cookie can't be read by scripts on the page and is only sent to our own site.
- All forms are processed on our server, which checks every field before anything is saved or sent.
- After five wrong passwords an account is locked for 15 minutes.
Who we share it with
- Our hosting provider, which stores the server our site runs on.
- Brevo (Sendinblue SAS), our email delivery provider, which passes contact form messages to our inbox.
- Google, only if you choose Continue with Google, to confirm your sign-in.
- Authorities, if the law requires it.
Some of these providers may process data outside the UK. Where they do, we rely on UK adequacy regulations or the International Data Transfer Agreement or Addendum to protect it.
How long we keep it
- Accounts: until you delete your account, or 24 months after your last sign-in, whichever comes first.
- Contact messages and the message log: up to 24 months, so we can follow up on requests such as breaks and restrictions.
- Security log: up to 12 months.
- Session cookie: until you close your browser or sign out.
When you delete your account from My account, your account file is removed from the server straight away. If you asked for a break or restriction we may keep a minimal note of that request so we can honour it.
Your rights
Under UK GDPR you can ask us to:
- give you a copy of your data;
- correct anything that's wrong (you can update most details yourself in My account);
- delete your data;
- restrict or object to how we use it;
- move your data to another service.
Send requests through the contact form with the topic "Privacy question". We reply within one month. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Under 18s
Kena Graphy is only for adults aged 18 and over. We don't knowingly collect data from anyone under 18. If you think a child has created an account, contact us and we'll delete it.
Cookies
We use one strictly necessary cookie and some browser storage. Full details are in our Cookie policy.
Changes to this policy
We'll update this page if the way we use data changes. The date at the top shows when it last changed.
Contact
Write to us through our contact form or the , or email .