Privacy policy

1. Who we are

Tunnelside is a football manager game that runs in the browser. This page says what personal data the game stores, why, and what you can do about it. For anything about your data, write to support@tunnelside.com.

2. What we store and why

• Your account: your email address, display name and password, and whether the address is verified. The password is stored only as a salted hash that cannot be turned back into the password. We also count failed sign-ins so that an account can be locked when someone guesses its password.
• Your sessions: a hash of the token that keeps you signed in, and when it was issued, used and revoked. It lets you stay signed in and lets us end a session that was stolen.
• Your club: its name, crest and colours, tactics, squad, results, bids and messages. This is the game itself. The club, its squad, its matches and the league tables are shown on public pages that search engines may list. You can hide your club from search engines in its settings.
• Purchases: for every order, the bundle, the amount, the currency and its status, with the references of the payment provider, and the date on which you confirmed that you are at least 18. We need them to deliver the coins and to keep the records that accounting rules ask for. We never see your card number: the payment provider handles it.
• Email: we send you the messages that the account needs, such as the link to verify your address or to reset your password. We keep a log of which messages were sent to your address, with the subject and the time but not the content.
• Technical data: your IP address is used to apply limits that protect the game from abuse, and is held in the memory of the server for that purpose only. The company that hosts the game may keep ordinary server logs.

3. Cookies

We use only the cookies that the game needs in order to work, so we do not ask for consent. There are no advertising or analytics cookies and no third-party trackers.

• ts-access and ts-refresh (with a security prefix on the secure site) keep you signed in. Browser scripts cannot read them.
• ts-csrf protects your actions against requests made by other websites.
• ts-session-present tells the page that you are signed in. It holds no information about you.

4. Who processes your data

The game runs on a hosting platform, which stores the database. Email is delivered by an email service, and payments, once they are open, by a payment provider. They receive only the data they need to do their job. We do not sell personal data and we do not use it for advertising. We may have to hand data over where the law demands it.

5. How long we keep it

We keep your account and club data for as long as you have the account. When you delete the account from the account page, your email address, name, sign-in details, sessions and the log of mail sent to you are deleted straight away. Your club stays in its league under a computer manager, and records of purchases stay without any link to you, because accounting rules require us to keep them.

6. Your rights

You can see and change most of your data in your account, and you can delete the account yourself. Under data protection law you may also ask us for a copy of your data, to correct it, to limit how we use it or to object to it. Write to support@tunnelside.com and we will answer. You may also complain to the data protection authority of your country.

7. Security

The game is served over an encrypted connection. Passwords are hashed, sign-in cookies cannot be read by browser scripts, every action that changes something is protected against forged requests, and sign-in attempts are limited. No system is perfectly secure, and if something that affects you goes wrong we will tell you.

8. Young players

Only adults can buy coins: before a first purchase you have to confirm that you are at least 18 years old.

9. Changes to this policy

If we change what we store or why, we update this page and its date, and tell players of important changes in the game or by email.