Last updated: 1 November 2026
1. Who we are
This Privacy Policy explains how Free Gex ("we", "us") collects and uses personal data when you use freegex.com. We are the data controller for this data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Free Gex is operated by .
You can reach us through our contact form or by email at [email protected].
2. What we collect
| When | What | Why |
|---|---|---|
| You create an account | Username, email address, a one-way hash of your password, your 18+/UK confirmation and acceptance of our Terms | To create and run your account |
| You sign in with Google | Your verified email, first name and Google account ID (sent by Google) | To sign you in without a password |
| You play | Coin balance, XP, level, number of games opened, your last 6 games, daily-bonus date, sign-up and last sign-in dates | To provide coins, levels and your account page |
| You send a form | Name, email, topic and message (contact and Player Care forms); form type, result, time and IP address (all forms) | To reply to you, keep a record of requests and protect the site against abuse |
| You browse | A session cookie and small browser-storage entries (see our Cookies Policy) | To keep you signed in and remember your choices |
We never collect payment card or bank details, because nothing on Free Gex is for sale.
3. How your data is stored and protected
Your account isn't stored in your browser or on any public page. It's handled entirely on our server:
- Server-side forms. Sign-up, sign-in, account and contact forms are sent straight to our server over an encrypted HTTPS connection and processed there. Account information is never shown on any public page.
- Protected account files. Each account is kept in its own protected file in a private folder on our server. These files are locked against access from the web.
- Hashed passwords. We never store your password itself, only a one-way hash created with PHP's built-in password hashing (bcrypt). Nobody, including us, can turn that hash back into your password.
- Secure sessions. When you sign in we set a session cookie that is HttpOnly (page scripts can't read it), SameSite (it isn't sent with cross-site form posts) and Secure over HTTPS. A new session ID is issued every time you sign in.
- Lock-out protection. After 5 wrong password attempts, sign-in to that account is paused for 15 minutes.
- Private logs. Form submissions are recorded in private log files on our server, locked against web access. Passwords and Google tokens are never written to any log.
- Secure email. Contact and Player Care messages are sent from our server using an authenticated, encrypted mail connection (SMTP with TLS).
4. Our lawful bases
- Contract: to provide your account, coins, levels and the games you ask to play.
- Legitimate interests: to keep the site secure, prevent abuse, answer messages and improve our games.
- Legal obligation: where the law requires us to keep or share information.
- Consent: for optional cookies or storage, if we ever use them. You can withdraw consent at any time.
5. Who we share it with
We don't sell your data, and we don't share it for advertising. We share it only with:
- our hosting provider, which runs the server the site lives on;
- our email delivery provider, which sends contact and Player Care messages to our inbox;
- Google, only if you choose "Continue with Google" (Google's privacy policy applies to that sign-in);
- authorities, where the law requires it.
Some providers may process data outside the UK. When they do, we rely on UK-approved safeguards such as adequacy regulations or the International Data Transfer Agreement.
6. How long we keep it
- Account data: until you delete your account. Accounts left unused for 24 months may be deleted.
- Messages and form logs: up to 12 months, unless we need them longer to resolve an issue.
- Session cookie: until you sign out or close your browser.
When you delete your account from My account, your account file is removed from our server straight away.
7. Your rights
Under UK data protection law you have the right to access your data, correct it, delete it, restrict or object to how we use it, and receive a copy of it in a portable format. To use any of these rights, contact us (choose "Privacy question"). We'll reply within one month.
If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put things right first. You can reach us through our contact form or by email at [email protected].
8. Under-18s
Free Gex is only for adults aged 18 or over. We don't knowingly collect data from anyone under 18. If we learn that an account belongs to someone under 18, we'll delete it.
9. Changes to this policy
We may update this policy from time to time and will change the "Last updated" date above. For important changes we'll let signed-in players know on the site.