Privacy Policy

Who we are

Turf is run by [OPERATOR LEGAL NAME], [ADDRESS] ("we"). We are the data controller for your personal data. Contact: [CONTACT EMAIL].

What we collect and why

• Google sign-in: your Google account ID and email address. We use them to identify your account and to contact you about it. We don't receive your Google password, contacts or anything else.
• Your profile: the player name you choose, your colour, your settings, and when you accepted the rules and confirmed you're 13 or older.
• Location while the app is open: your phone sends its position about every 5 seconds. We keep only your latest position, to time how long you stay in a tile and to check for cheating. Each new position replaces the previous one.
• Game history: the tiles you own, the tiles you've visited (your private Explored map), the landmarks you've discovered, your XP and achievements, and your challenges (won, defended, abandoned).
• Your privacy zone, if you set one. Only you can see it.
• Moderation: reports you make or receive, and automatic flags when a position change looks impossibly fast.
• Technical logs: request times and error reports, with no locations in them. Your IP address is used briefly to limit abuse.

What other players can see

Your player name, your colour, the tiles you own and when you claimed them, your points and rank, and the outcomes of your challenges. Other players never see your exact position, your email, your Explored map or your privacy zone. Owned tiles can reveal places you spend time, so use the privacy zone and the "Ask me" / "Off" claim modes (see the rules).

Legal basis

Contract: to provide the game you signed up for. Legitimate interests: to keep the game fair and safe (anti-cheat, moderation, rate limits) and to fix errors. We don't sell your data and we don't use it for advertising.

Who we share it with

Only service providers that run the app for us: [HOSTING PROVIDER, e.g. DigitalOcean] (servers and database), Google (sign-in), [ERROR TRACKING, e.g. Sentry] (error reports) and [MAP TILE PROVIDER] (map images, which receives your IP address when your phone loads the map). Some of them may process data outside the UK under appropriate safeguards. We may disclose data if the law requires it.

How long we keep it

Your latest position is overwritten continuously. Your account and game history are kept until you delete your account. Sign-in sessions expire after 30 days of inactivity. Logs are kept for up to [30] days. Resolved moderation reports are kept for up to [12 months].

Your rights

You can download all your data and delete your account at any time from your profile (tap your name). Deleting your account removes your tiles, history and sessions immediately. You also have the right to correct your data, restrict or object to its use, and complain to the Information Commissioner's Office (ico.org.uk). Contact us first if you can, at [CONTACT EMAIL].

Children

Turf is for people aged 13 and over. If you think a child under 13 has an account, contact us and we'll delete it.

Cookies and storage

We use one essential cookie (turf_session) to keep you signed in. It can't be read by page scripts. Your map settings are also cached in your browser's local storage. We don't use advertising or tracking cookies. Google sets its own cookies during sign-in.