Your data, explained simply.
What we gather, why, who helps us handle it and how you stay in charge, described as Celtic Spirit Journeys really works.
Last updated: 12 October 2026
In short: you can browse and play with no account and without handing over any personal details. If you make an account or write to us, we use what you give only to run that account and to reply. There are no ads, no analytics or tracking tools, no sale of data, and we never request payment or card details.
Who is responsible
The data controller for this website is (company number ), .
“We” and “us” mean whoever operates Celtic Spirit Journeys (celticspiritjourneys.com). For any question about your data, use the contact form and pick “A privacy question”, or write to .
What we collect
1. When you make an optional account
- Using email: your first and last name, a screen name, an email address and a password. Only a scrambled form of the password (a hash) is kept, never the password itself.
- Using Google: your name, verified email address and Google account ID, which Google passes to us once you approve the sign-in. We then ask you for a screen name and your date of birth.
- Date of birth: looked at once, at sign-up, to confirm you are 18 or older. It is not stored; we keep only the fact that your age was confirmed.
- Account records: when you joined, your most recent sign-in, how you signed up (email or Google), and a failed-attempt counter that pauses the account for 15 minutes after five wrong passwords.
2. When you write to us
The contact form gathers your name, email address, topic and message, plus the name of the game if you arrived from a game page. Please keep passwords and sensitive details out of your message.
3. When you reset a password
We create a single-use link that works for 60 minutes. Until it is used or lapses, we hold only a scrambled form of its secret code.
4. Technical and security data
- Abuse limits: to curb spam and password guessing, the server keeps short-lived counters tied to a hashed form of your IP address. They expire within a day.
- Mail results: a technical log noting whether each email was sent or failed, with any error text from the mail server. It does not contain your message.
- Server logs: as with most sites, our hosting provider’s web server may note standard technical details such as IP address, browser type and pages requested, for security and troubleshooting.
5. What we do not collect
No payment or card details (nothing here is for sale), no advertising or analytics tools, and no profiles built about you.
Why we use it, and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Create and run an account, keep you signed in | Account details, session cookie | Carrying out our agreement with you |
| Confirm you are 18 or older | Date of birth (not stored) | Legal obligation and our legitimate interest in keeping minors out |
| Reply to your messages and requests | Contact form data | Legitimate interest in replying, and your own request |
| Send a password-reset email | Email address, reset link | Carrying out our agreement with you |
| Prevent spam, abuse and password guessing | Hashed IP counters, failed-attempt counter | Legitimate interest in security |
Where it is kept and who else sees it
- Our server. Account details are held on our web server in protected files that cannot be opened from the web. There is no database.
- Email delivery. Contact messages and password-reset emails travel through our email provider, Brevo (SMTP relay), and land in our support mailbox. We keep messages only as long as needed to deal with your request and any follow-up.
- Google. Only if you choose “Continue with Google”. Google’s sign-in code loads only on the sign-in and sign-up pages, and Google handles sign-in under its own Privacy Policy.
- Hosting. Our host stores the site and its server logs.
- The games. Games are served from our own domain (celticspiritjourneys.com) and load inside our pages. A game may keep its own settings or progress in your browser’s storage on your device; we do not use that to identify you.
Some providers may process data outside your country. We do not sell personal data or share it for advertising, and we may disclose data where the law requires it.
How long we keep it
- Account: until you delete it in My account (immediate) or ask us to.
- Messages: as long as your request and any follow-up need, then deleted.
- Reset links: up to 60 minutes, or until used.
- Abuse counters: about a day at most.
- Sessions: until you sign out, or up to 30 days if you choose “Keep me signed in”.
Security
Passwords are hashed, account files are kept out of reach of the web, forms are protected against cross-site requests, and repeated wrong passwords briefly pause an account. No system is perfectly safe, so please choose a strong, unique password.
Your rights
Depending on where you live, you may be able to ask to see the data we hold about you, have it corrected or erased, limit or object to its use, receive a copy, or withdraw consent. If you made an account you can delete it yourself at any time in My account. For anything else, use the contact form and pick “A privacy question”. You may also complain to your local data protection authority.
Cookies and browser storage
Only strictly necessary cookies and storage are used. Details are in the Cookie Policy.
Children
Celtic Spirit Journeys is for adults aged 18 and over, and we do not knowingly collect data from anyone younger. If you believe a child has made an account, tell us and we will remove it.
Updates
If our practices change, we will revise this page and its date.