1. Who we are
Evergreen Notes (“we”, “us”) runs evergreennotes.com. We are the data controller for the personal information described in this policy, and we handle it in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This website is operated by .
You can contact us about privacy through our contact form or by email at [email protected].
2. What we collect
When you create an account
- Username and email address.
- Password — turned into a secure one-way hash on our server before it is saved. We never store or see your actual password.
- Sign-up method (email or Google), the date you joined, your last log-in and a count of recent failed log-in attempts (used to lock the account for 15 minutes after five wrong tries).
If you sign up or log in with Google
- Your name, verified email address and Google account ID, which our server checks directly with Google.
When you play while logged in
- Your virtual coin balance, XP, level, the games you've opened and when, and when you last collected your daily bonus.
When you contact us
- Your name, email address, the topic you chose and your message.
Technical information
- Like almost every website, our hosting server keeps standard access logs (such as IP address, browser type and pages requested) for security and to keep the Website running.
We never ask for or store card, bank or payment details, because there is nothing to buy.
3. How and where it's kept
All account and form processing happens on our own server — not in your browser.
- Accounts are stored as individual protected files on our server. These files are blocked from public web access and are never published, displayed or shared.
- Contact and Player Care messages are sent from our server to our support inbox by secure email, and a copy is kept in a private log on our server so we can reply and confirm messages arrived.
- Account activity (such as sign-ups, log-ins and bonus collections) is recorded in a private server log for security. Passwords are never logged.
- Your browser stores only small, non-sensitive items: the session cookie that keeps you logged in, your 18+ confirmation and your cookie choice. See our Cookies Policy.
4. Why we use it (lawful bases)
| Purpose | Lawful basis |
|---|---|
| Creating and running your account, coins, XP and levels | Contract — to provide the service you asked for |
| Checking you are 18+ and in the UK | Legitimate interests and legal obligations |
| Keeping accounts secure, preventing misuse, server logs | Legitimate interests |
| Replying to your messages | Legitimate interests / contract |
| Optional cookies | Consent |
5. Who we share it with
We don't sell or rent your information. We only share it with service providers who help us run the Website, under contracts that require them to protect it:
- Our hosting provider, which runs the server the Website and your account live on.
- Our email delivery provider, which delivers contact and Player Care messages to our inbox.
- Google, only if you choose to sign in with Google. Google's privacy policy applies to your Google account.
We may also share information if the law requires it, or to protect the rights and safety of our players and the Website.
6. International transfers
Some service providers may process data outside the UK. Where they do, we make sure appropriate safeguards are in place, such as UK adequacy regulations or the UK International Data Transfer Agreement.
7. How long we keep it
- Account data: until you delete your account, or after 24 months of inactivity.
- Contact messages: until your request is dealt with, and no longer than 12 months.
- Security and activity logs: up to 12 months.
When you delete your account from My account, your account file is removed from our server immediately.
8. Keeping it safe
We use HTTPS encryption, hashed passwords, an HttpOnly session cookie, automatic lock-out after repeated wrong passwords, server-side checks on every form, and folders that are blocked from public access. No system is perfectly secure, but we work hard to protect your information and will tell you and the ICO if a breach puts your rights at risk.
9. Your rights
Under UK data protection law you have the right to:
- access the personal information we hold about you;
- have it corrected if it's wrong;
- have it deleted;
- restrict or object to how we use it;
- receive it in a portable format;
- withdraw consent where we rely on it.
You can delete your account yourself at any time from My account. For anything else, contact us through our contact form or by email at [email protected]. We'll reply within one month.
If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
10. Children
The Website is only for adults aged 18 and over. We don't knowingly collect information from anyone under 18. If we learn that we have, we will delete it.
11. Changes
We'll update this page if anything changes. The date at the top always shows the latest version.