Legal

Privacy Policy

Last updated: 14 October 2026

The short version

Who we are: OzPlayHub is run by CTI DIGITAL LIMITED, which is responsible for your personal data.
What we collect: for an account, just a username, an email address and a password, which we store only as a secure hash. We never ask for payment details.
No selling, no spam: we never sell your personal data, and we don't send marketing emails or newsletters - only account and security emails.
No tracking cookies: we use only essential cookies - no analytics or advertising cookies.
Games: the games come from a third-party publisher, HTMLGames.com. Every game shows the publisher's own ads and asks for consent to its own cookies in its own window; the publisher and its ad partners receive information such as your IP address when you play.
You're in control: change your password or delete your account at any time on the Your account page, or email us about anything else.

This Privacy Policy explains how CTI DIGITAL LIMITED (“we”, “us”, “our”) collects, uses and protects personal data when you visit ozplayhub.com, create an account, play games or contact us. It applies wherever you live, with extra information for Australia and the United States. Please read it together with our Terms of Use and Cookie Policy.

1. Who we are

OzPlayHub is a free website of casual browser games at ozplayhub.com. It is operated by CTI DIGITAL LIMITED, which is the “controller” of your personal data - the organisation that decides how and why it is used - under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, where it applies to you, the EU General Data Protection Regulation (EU GDPR).

CTI DIGITAL LIMITED
Registered in England and Wales
Registered office: Central Buildings 11 Peter Street, Manchester, England, M2 5QR, United Kingdom
Email: support@ozplayhub.com
Website: ozplayhub.com

You can read more about us. For any question about this policy or your personal data, email support@ozplayhub.com (see also section 14).

2. The personal data we collect

We collect only what we need to run the site and your account.

When you create an account

To sign up, you choose a username, give us your email address and choose a password. We then hold:

Your username - it identifies your account. We do not show it to other users.
Your email address - so you can log in, reset your password and receive account and security emails.
Your password - stored only as a one-way bcrypt hash. We never store your actual password and cannot see it.
Account dates - when your account was created, when you last logged in and when your password was last changed.

When you sign up, you also confirm that you are 13 or older - by ticking a box, or, if you sign up with Google, by continuing after the notice next to the Google button. We never ask for your date of birth, real name, postal address, phone number or payment details to create an account.

Sign in with Google

We do not currently offer Sign in with Google. If your account was created or linked with Google while that option was available, we also keep your Google account ID with your account until you delete it.

When you contact us

If you use our contact form, we collect your name, email address and message. Each message is stored in our system and forwarded to our support mailbox so that we can reply. If you email us directly, we receive your email address and whatever you include in your email. Please don't send us sensitive information, such as health details - we don't need it.

Security and technical data

Server logs. Like almost every website, our web hosting provider automatically records basic technical details of each visit - your IP address, browser type, the pages requested and the date and time - to keep the site working and secure.
Rate limiting. To stop password guessing, spam and other abuse, we count attempts (such as failed logins, sign-ups, password-reset requests and contact messages) per IP address and per username or email address entered. We store these only as keyed (HMAC) hashes - not as readable IP addresses or names - and they are deleted automatically once they are 24 hours old (the clean-up runs whenever the rate limiter is used).
Spam trap. Our forms contain a hidden field that people never see. If it is filled in, we treat the submission as spam. It does not collect anything about you.

Cookies and similar technologies

We use one strictly necessary session cookie and save your cookie choice in your browser. We do not use analytics or advertising cookies. Our Cookie Policy has the details.

What we don't collect

We never collect payment card or bank details - there is nothing to buy.
We don't keep a record of your game scores or progress. A game may save your progress in your browser through its publisher (see section 5).
We don't knowingly collect personal data from children under 13 (see section 12).

3. How we use your data and our legal bases

Data protection law requires a valid reason - a “legal basis” - for each use of personal data. This is what we do with your data and why:

What we do	Data we use	Legal basis
Create and run your account, let you log in and play the games	Username, email address, password hash, account dates	Contract - needed to provide the service you sign up for
Send account and security emails: welcome email, password reset links, password-changed and account-deleted notices	Username, email address	Contract - part of running your account
Keep the site and accounts secure: rate limiting, preventing spam and abuse, server logs	Hashed IP addresses and login names, server log data	Legitimate interests - protecting our users and the service
Reply to your messages and support requests	Name, email address, message	Legitimate interests - answering you and helping with problems
Meet legal obligations, enforce our Terms of Use and deal with legal claims	Whatever is relevant to the matter	Legal obligation and legitimate interests

Where we rely on legitimate interests, we have balanced our interests against your rights, and you can object at any time (see section 11).
We do not currently use your data for analytics or advertising. If we ever do, we will ask for your consent first and update this policy before we start.
You don't have to give us any personal data, but without a username, an email address and a password we cannot create an account for you.
We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.

4. Emails we send

We only send emails connected with your account or your messages:

a welcome email when you create an account;
password reset links when you ask for one - each link works once and expires after 60 minutes;
security notices when your password is changed or your account is deleted;
replies to messages you send us.

We do not send marketing emails or newsletters. Our emails are sent through our email delivery provider.

5. Games from a third-party publisher

The games on OzPlayHub are made and hosted by a third-party publisher, HTMLGames.com (run by Zygomatic, based in the Netherlands). Games are available only after you log in. When you open a game, your browser loads it in a frame directly from the publisher's servers (cdn.htmlgames.com). This means that:

the publisher receives your IP address and standard device and browser information, as with any website you visit;
every game shows the publisher's own advertising - for example a short video advert before or during play - supplied through Google's advertising services and the publisher's other ad partners (such as Yolla Media and InMobi);
the game asks for your consent to the cookies of the publisher and its ad partners in its own consent window (an industry-standard “IAB TCF” dialog), where you can accept or refuse them;
the publisher may set its own cookies or use local storage - for example, to save your progress - and uses Google Analytics to measure how its games are played;
if you type a name into a game's high-score table, that name is sent to the publisher.

Because our page loads the game, we and the publisher each have responsibilities here, but the publisher decides how it and its partners use this information, under its own privacy policy: HTMLGames.com privacy policy. We do not send the publisher your account details, and we do not receive personal data about you from it. You can refuse the publisher's cookies in its consent window, and you can block third-party cookies in your browser settings.

6. Analytics and advertising

We do not currently use any analytics or advertising cookies or tags. If we decide to add them - for example, to measure how the site is used or how well our adverts work - we will update this policy and our Cookie Policy first, and we will only load them after you have agreed through our cookie banner.

Advertising on our pages

There are no adverts built into our own pages at the moment. The site is free to use, and in future we may show clearly labelled adverts to help cover our costs. If we do, advertising cookies and personalised adverts will be used only with your consent where the law requires it, and adverts will never be disguised as game content or download buttons. Games themselves may contain the publisher's own adverts (see section 5).

We never sell your personal data. We share it only as follows:

Our web hosting provider, which stores the website and its data on its servers and keeps server logs.
Our email delivery provider, which sends our emails.
The game publisher, HTMLGames.com, which receives information directly from your browser when you play a game (see section 5). We do not pass your account details to it.
Professional advisers and authorities - such as our lawyers, accountants or insurers, or the police, regulators or courts - when the law requires it or when it is necessary to protect our rights, our users or others.
A buyer or successor - if our business or this website is sold or reorganised, your data may pass to the new owner, who must continue to protect it as this policy describes.

Our hosting and email providers handle your data only on our instructions and must keep it secure.

8. International transfers

We are based in the United Kingdom. Some of our service providers may process personal data outside the UK and the European Economic Area (EEA), for example in the United States. When that happens, the transfer is protected by appropriate safeguards: UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum, or the EU Standard Contractual Clauses. You can ask us for more information about these safeguards.

9. How long we keep your data

Data	How long we keep it
Account data: username, email address, password hash, account dates	Until you delete your account. Deleting it on the Your account page removes it immediately, including from the site's own backup copy; copies in our hosting provider's backups may remain for a limited period until they are overwritten.
Password reset links	Each link works once and expires after 60 minutes. We store only a hash of the link's secret code.
Login sessions	Until you log out or close your browser. The server also ends a session after 2 hours without activity.
Rate-limiting records (hashed IP addresses and login names)	24 hours (deleted automatically by the next clean-up)
Contact form messages	Up to 24 months. Messages stored on our website are deleted automatically after 24 months, and we delete the copies in our support mailbox on the same schedule.
Error logs (technical errors; may include a username or a shortened email address)	Up to 3 months
Server logs kept by our hosting provider	A limited period set by the provider, typically up to 12 months
Your cookie choice (saved in your browser)	Until you clear it or change your choice

We may keep some information for longer if the law requires it or if it is needed to deal with a complaint or legal claim.

10. How we protect your data

The site is served over an encrypted HTTPS connection.
Passwords are stored only as one-way bcrypt hashes, so nobody - including us - can read them.
The login cookie is HttpOnly (scripts cannot read it), SameSite=Lax and, over HTTPS, Secure. Our forms are protected against cross-site request forgery.
Logins, sign-ups, password resets and the contact form are rate limited, and our forms include a hidden spam trap.
Password reset links work once and expire after 60 minutes, and changing your password signs out your other sessions.
Our data files cannot be reached from the web, and access to the admin panel is restricted to the operator.

No website can be completely secure, but if a personal data breach puts your rights at risk, we will tell you and the regulator where the law requires us to.

11. Your rights and choices

Your rights

Under the UK GDPR and the EU GDPR you have the right to:

Access - get a copy of the personal data we hold about you;
Rectification - have inaccurate or incomplete data corrected;
Erasure - have your data deleted;
Restriction - ask us to limit how we use your data;
Objection - object to any use of your data that is based on our legitimate interests;
Portability - receive the data you gave us in a structured, machine-readable format, or have it sent to another organisation;
Withdraw consent - at any time, with the “Change cookie settings” button on our Cookie Policy;
Not to be subject to automated decisions that have legal or similarly significant effects - we do not make any.

Do it yourself

On the Your account page you can change your password and delete your account at any time. Deleting your account removes your account data immediately, and we email you to confirm it.

Make a request

For anything else - such as a copy of your data or a correction - email support@ozplayhub.com or use our contact form. We may ask you to confirm your identity, for example by writing from the email address on your account. We will reply within one month. If a request is complex we may need up to two more months, and we will tell you if so. There is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to a data protection authority:

United Kingdom: the Information Commissioner's Office (ICO) - ico.org.uk
EU and EEA: the data protection authority in the country where you live or work - see the list of authorities
Australia: the Office of the Australian Information Commissioner (OAIC) - oaic.gov.au

Visitors in Australia

We aim to handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988. You can ask to access or correct the personal information we hold about you by emailing support@ozplayhub.com. Your information is handled outside Australia - by us in the United Kingdom and by service providers that may be in other countries, such as the United States. If you are not satisfied with how we respond to a privacy complaint, you can contact the OAIC.

Visitors in the United States

We do not sell your personal information. Depending on the state you live in (for example, California), you may have the right to know what personal information we collect, use and disclose, and to ask us to delete or correct it. Sections 2, 3 and 7 explain the categories of personal information we collect - identifiers such as your username and email address, and internet activity such as server log data - why we use them and who receives them. To use your rights, email support@ozplayhub.com; we may need to verify your identity first. We will not treat you differently for using your privacy rights.

12. Children

OzPlayHub is for people aged 13 and over, and signing up requires you to confirm that you are 13 or older. We do not knowingly collect personal data from children under 13. If you are a parent or guardian and believe that a child under 13 has given us personal data, please contact us at support@ozplayhub.com and we will delete it. If you are aged 13 to 17, please make sure a parent or guardian is happy for you to use the site.

13. Changes to this policy

We may update this policy from time to time - for example, if we add a feature or the law changes. We will publish the new version on this page and change the “Last updated” date at the top. If the changes are significant, we will also highlight them on the site.

14. Contact us

If you have a question about this policy or your personal data, please get in touch:

Email: support@ozplayhub.com
Online: our contact form
Post: CTI DIGITAL LIMITED, Central Buildings 11 Peter Street, Manchester, England, M2 5QR, United Kingdom

You can also read more about us, our Terms of Use and our Cookie Policy.