Privacy Policy

1. Who we are

Mmf Services runs mmf-services.com and is the controller of the personal information described here. This policy explains what we collect, why, how we protect it and what your rights are under UK data protection law. To contact us about privacy, email [email protected], use the contact form and choose "Privacy question", or write to Player Care.

2. What we collect

If you create an account

player name and email address;
your password, stored only as a one-way hash (we can't read it). If you use Google sign-in we store your Google account ID instead of a password;
your Mmf coin balance, XP and level, your last daily-bonus date and the games you opened recently;
when the account was created and last used.

If you send us a message

your name, email address, the topic you chose and your message.

Records we keep for security and support

a log of form activity: date and time, the type of event (for example sign-up, sign-in, daily bonus, form sent), the email involved and a partly hidden IP address. Passwords are never logged;
if sending a contact email fails, the log may also note the error so we can fix it.

Technical information

one necessary session cookie that keeps you signed in;
your browser's storage, used to remember that you confirmed your age and your cookie choice (see our Cookies Policy).

We do not collect payment details (we never take payments), phone numbers, precise location or special-category data, and we do not run advertising or tracking tools on the site.

3. Why we use it

To run your account (contract): sign you in, save your coins and level, show your recent games.
To answer you (legitimate interests): reply to messages and requests, including break, restriction and deletion requests.
To keep the site safe (legitimate interests): prevent abuse, lock repeated wrong sign-ins, investigate problems and keep records of form activity.
To meet legal duties where the law requires it.
With your consent: when you choose to use Google sign-in.

We don't sell your information and we don't use it for advertising.

4. How we protect it

Forms are sent by POST to scripts on our server and are checked again there. Your details are not placed in page addresses and are not written into the pages you download.
Passwords are hashed with PHP's standard password hashing before they are stored.
We don't use a public database. Each account is a separate file kept in a protected folder that the web server does not serve to visitors, so there are no database tables or queries exposed in the site.
Sign-in sessions use a cookie flagged as HTTP-only and same-site. After five wrong passwords sign-in is paused for 15 minutes.
Contact messages are sent from our server through an authenticated email service.

No system is perfectly secure, but we keep our setup simple and review it regularly. If we ever believe your information has been put at risk in a way that matters to you, we will tell you and the regulator where the law requires it.

Only with the services we need to run the site:

our hosting provider, which stores the site and its files;
our email delivery provider (an SMTP email service), which carries your contact messages to us;
Google, only if you choose Google sign-in, to confirm your identity.
the authorities, if we are legally required to, or to protect people or our rights.

These providers act for us or under their own privacy terms. We never sell personal information.

6. Transfers outside the UK

Some of our providers (for example Google or our email provider) may process information outside the UK. When that happens we rely on appropriate safeguards such as UK-approved transfer mechanisms or an adequacy decision.

7. How long we keep it

Account information stays until you delete your account. Deleting it from the My Account page removes your account file straight away.
Messages are kept only as long as needed to help you and keep a record of what was asked.
Security and form logs are kept only as long as needed for security, support and fixing problems, then deleted.

8. Your rights

You have the right to ask us to: see the information we hold about you; correct it; delete it; restrict or object to how we use it; and give you a copy in a portable form. Where we rely on consent, you can withdraw it at any time. You can delete your account yourself on the My Account page, or send us a request through the contact form.

If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first.

9. Children

The site is for adults aged 18 and over and is not aimed at children. We don't knowingly collect information from anyone under 18. If you think someone under 18 has an account, please tell us and we will remove it.

10. Cookies

We use as little as possible. Details are in our Cookies Policy.

11. Changes to this policy

We may update this policy and will change the date at the top when we do. If a change is important we will make that clear on the site.