Last updated: 26 October 2026
1. About us
The Outdoor Exp operates theoutdoorexp.com and is the data controller for the personal data described in this policy. For privacy questions, email [email protected] or use our contact page and choose "Privacy and my data".
2. Information we collect
| Information | When we collect it | Why |
|---|---|---|
| Username and email | When you join | To create and manage your account |
| Password (one-way hash only) | Email sign-up | To let you sign in securely |
| Google account ID and verified email | If you continue with Google | To connect Google sign-in to your account |
| Coins, XP, level, last top-up time, recently played games, join and last sign-in dates | While you use your account | To provide account features |
| Failed sign-in count and lock time | After a wrong password | To protect your account |
| Name, email, subject and message | When you use the contact or Player Care form | To reply to you |
| Submission record (date, form, result, email, partly hidden IP address) | Each time a form is sent | Security, preventing abuse and support |
| Age confirmation and cookie choice | Stored on your own device | So we don't ask every visit |
We never ask for or keep payment details, and passwords never appear in any record.
3. Legal bases
- Contract: providing your account after you join.
- Legitimate interests: keeping the Service secure, preventing misuse, answering messages and improving the site.
- Legal obligation: where the law requires us to keep or disclose information.
- Consent: for optional cookies (none are used at present).
4. Storage and security
Accounts are held on our own web server in a private location that can't be reached from the internet. Your details are never displayed on the site or saved in your browser; pages request them from the server only after you sign in.
- Every page and form is served over encrypted HTTPS.
- Passwords are kept only as strong one-way hashes that nobody can read, including us.
- Sign-in uses a secure, HTTP-only session cookie that page scripts can't access.
- Accounts lock for 15 minutes after five wrong passwords.
- Forms are processed on our server with spam protection, and records are stored in restricted files.
5. Sharing
We don't sell personal data or use it for advertising. We use only these providers:
- Our hosting provider, which runs the server that holds the site and your account.
- Brevo, which delivers contact and Player Care messages to our inbox.
- Google, only if you choose to sign in with Google.
When a provider processes data outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
6. How long we keep it
- Account data: until you delete your account, or after 24 months without signing in.
- Messages: up to 24 months after the conversation ends.
- Submission records: up to 12 months.
Deleting your account from your basecamp removes your account file from our server immediately.
7. Your rights
Under UK data protection law you can ask to access, correct, erase, restrict or transfer your data, object to how we use it, and withdraw consent. Contact us and we'll reply within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd appreciate the chance to help first.
8. Children
The Service is for adults aged 18 or over. We don't knowingly collect data from anyone younger. If you think a child has an account, tell us and we'll delete it.
9. Updates
If our data practices change, we'll update this policy and the date at the top.