Privacy policy

Last updated: 1 November 2026

Who we are

Jalou Studio (“we”, “us”) runs jaloustudio.com and is the controller of the personal data described in this policy. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

You can reach us through our contact form or by email at [email protected].

What we collect

When you create an account

Your username and email address.
Your password, which is converted with one-way hashing before it is saved. We never store or see your actual password.
If you use Google: your Google account email and a Google ID number, which Google confirms to us. We don't receive your Google password.
Your confirmation that you are 18+ and live in the UK.

While you play signed in

Your coin balance, XP, level, number of games played, the last games you opened, when you collected your daily bonus, and when you signed in.
Failed sign-in attempts, so we can pause sign-in and protect your account.

When you contact us

Your name, email address, the topic you choose and your message.

Form records

Each time a sign-up, sign-in, contact or player care form is sent, our server writes a short record: the date and time, which form, whether it succeeded, your username and email, and for account forms your IP address. These records never include passwords.

We don't collect payment details, because there is nothing to pay for.

How your details are kept safe

Everything you send us is handled on our server, not in your browser:

Server-side forms. Sign-up, sign-in, Google sign-in, daily bonus, contact and player care forms are processed on our server over an encrypted HTTPS connection.
Protected account files. Each account is kept in its own file in a private folder on our server. These files are locked so they can't be opened or downloaded from the internet, and account data is never displayed publicly.
Hashed passwords. Passwords are hashed with a strong one-way algorithm. Even our team can't read them.
Secure sessions. When you sign in, your browser gets a session cookie that scripts can't read. It is replaced each time you sign in and removed when you sign out.
Private logs. Form records are kept in a private folder on the server that is not reachable from the web.
Only what's needed. The pages you see only receive the details they display, such as your username, email, coins and level.

Why we use your details

To run your account and the games (performing our contract with you): signing you in, saving your coins and level, and showing your recent games.
To answer your messages (our legitimate interest in helping you, or your consent).
To keep the site safe (our legitimate interest): stopping bots, protecting accounts and investigating misuse.
To check age and location (legal obligation and legitimate interest): our site is only for adults in the UK.
To support safer play (legitimate interest): acting on requests for a break, a restriction or deletion.

We don't sell your data, and we don't use it for advertising.

We only share personal data with service providers who help us run the site, under contracts that protect it:

Our hosting provider, which stores the site and its server files.
Our email delivery provider, which sends contact and player care messages to our team's inbox.
Google, only if you choose to sign in with Google. Google's own privacy policy applies to that sign-in.

We may disclose information if the law requires it. Where a provider handles data outside the UK, we rely on UK-approved safeguards such as adequacy regulations or the International Data Transfer Agreement.

How long we keep it

Account data: until you delete your account. If an account is unused for 24 months we may delete it.
Contact and player care messages: up to 24 months after our last reply.
Form records: up to 12 months, unless needed longer to investigate misuse.
Break and restriction requests: for as long as the restriction applies, and up to 12 months after.

Deleting your account removes your account file straight away. Remaining form records are removed on the schedule above.

Your rights

Under UK data protection law you can ask us to:

give you a copy of your personal data;
correct details that are wrong;
delete your data (you can delete your account yourself from My account);
restrict or object to how we use your data;
send your data to you in a portable format.

Send requests through our contact form and choose “Privacy question”. We reply within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies and browser storage

We use one essential cookie to keep you signed in, and your browser stores your age confirmation and cookie choice. Read our cookies policy for details.

Children

The site is not for anyone under 18. We don't knowingly collect data from children. If you think a child has created an account, please contact us and we will delete it.

Changes to this policy

We may update this policy. The date at the top shows the latest version. If we make important changes, we'll show a notice on the site.