Privacy Policy.

What we collect

• When you sign up: first name, last name, email address, UK phone number and a password. Your password is turned into a scrambled code (a hash) before it is saved, so it isn't stored as you typed it. We also record the date you joined, your last sign-in and a count of failed sign-in attempts (five wrong tries lock sign-in for 15 minutes).
• While you play (signed in): your coin balance, XP and level, which games you open and how often, and when you last collected each free coin pack.
• If you sign up with Google: your name, verified email address and Google account ID from Google, checked by our server with Google. We ask you for your phone number separately.
• When you contact us: your name, email, topic and message.
• Form records: the date, the form used, your email and your IP address, so we can check that forms work and spot misuse. Passwords are never recorded.

Where it's kept

Your account is stored on our server as a protected file that can't be opened from the web. It stays there until you delete your account from My account or ask us to delete it.

Signing in sets one strictly necessary session cookie (mr_sid). Pages ask our server who is signed in, and the server only ever returns your own details to you. See the Cookie Policy.

Messages you send through the contact or Player Care forms are emailed from our server to our support inbox, and a copy is kept in a protected log on our server so we can reply and check the message arrived. We delete it once your request is dealt with.

We never ask for or store card or bank details.

Why we use it

• To run your account, coin basket and levels (to provide the service you asked for).
• To check you are 18+ and in the UK (legal obligation and our legitimate interests).
• To keep the site secure and prevent misuse (legitimate interests).
• To reply when you contact us and act on requests such as breaks or deletion.

We don't sell your information, we don't use it for advertising and we don't use analytics or tracking cookies.

Who we share it with

• Our email delivery provider (Brevo), which sends contact and Player Care messages from our server to our inbox.
• Google, only if you choose Google sign-in. Google's own privacy policy applies.
• Our hosting provider, which runs the server the site is stored on.

We only share what each provider needs to do its job, and they may not use it for anything else. We may also share information if the law requires it.

How long we keep it

• Account: until you delete it, or 24 months after your last sign-in if the account isn't used.
• Messages: until your request is dealt with, and no longer than 12 months.
• Form records: up to 12 months.

Your rights

Under UK data protection law you can ask to see, correct or delete your information, ask us to limit how we use it, or object to how it's used. You can delete your account yourself at any time from My account, which removes it from our server. Send other requests through the contact form. You can also complain to the Information Commissioner's Office (ico.org.uk).

Security

Every form is processed on our server. Passwords are hashed, account files are protected from the web, the sign-in cookie is HttpOnly and sent only over HTTPS, and messages are sent to our team over an encrypted connection. No system is perfect, so please use a password you don't use anywhere else.

Children

The site is not for anyone under 18. We don't knowingly collect information from children, and we delete any account we find that belongs to someone under 18.

Who is responsible

Mercury Roomyeg (mercuryroomyeg.com) is responsible for your information.

The data controller for this website is , .

Changes

We'll update this page if anything changes. The date at the top shows the latest version.