Privacy notice
Last updated: 26 October 2026
Who we are
Hello London (hellolondon.app) is run by Bolakale Adewale, a sole trader in the United Kingdom, trading as Hello London. We're the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). Contact us about anything in this notice at [email protected]. A postal address is available on request by email.
The short version
- To play, you give us your name, a username, a password, your email and your date of birth. Your name, email and date of birth are encrypted and never shown to other players.
- We use your email only for your account: logging in, password resets and important account messages. Never for marketing, and we never sell your data.
- We keep your game: your character, progress, in-game money and the people you've met.
- If you chat with other players, we keep what you send for a while so we can keep people safe.
- One essential cookie keeps you signed in. No advertising or tracking cookies.
- You can download all your data, or delete your account, at any time from Phone → Privacy in the game.
What we collect, why, and how long we keep it
| Data | Why we use it | Lawful basis | How long we keep it |
|---|---|---|---|
| Username, password (stored only as a one-way hash, never readable), and when you accepted these terms | To create and run your account | Contract | Until you delete your account |
| Your name, email and date of birth, encrypted (AES-256-GCM). Your email is also stored as a keyed hash so we can find your account when you log in with it | Logging in, password resets, important account emails, and checking you're 18 or over | Contract | Until you delete your account |
| Recovery codes (stored as hashes) and, if you turn it on, your two-step login secret (encrypted) | Keeping your account secure and letting you recover it | Contract; legitimate interests (security) | Until you replace them or delete your account |
| Your character, appearance, game progress, in-game money records, items, homes, cars, pets, businesses, and relationships and messages with the game's made-up characters | To run the game | Contract | Until you delete your account (see "When you delete your account") |
| Your character's name, your public @name, your place on leaderboards and your big moments (such as a promotion) on the in-game feed | Shared features other players can see. You can hide yourself from leaderboards and the All London feed in the game (your friends still see your posts) | Contract | Until you delete your account |
| Chat in shared places, private messages to friends, feed posts, friend lists, blocks and hustle-board jobs | Playing with other people, and keeping players safe | Contract; legitimate interests (safety) | Shared-place chat: 90 days. Private messages, posts and friends: until you or the other person delete your account |
| Reports you make, and reports about you, including a copy of the reported words | Moderation and safety | Legitimate interests (safety); legal obligation where it applies | While the report is open, then 2 years |
| Support tickets (what you write to us) | To help you | Contract; legitimate interests | While the ticket is open, then 2 years |
| Security logs: events like log-ins and account changes, with only the first part of your IP address | Preventing abuse, fraud and account takeovers | Legitimate interests (security) | 12 months |
| Purchases: what you bought, when, the price and the status. Your card details go straight to Stripe and never reach us | Delivering purchases, refunds and keeping accounts | Contract; legal obligation (tax records) | 6 years after the purchase, as UK tax law requires |
| Push notification sign-up, if you turn notifications on (a technical address from your browser, not your phone number) | Sending game reminders you asked for | Consent (you can turn them off at any time) | Until you turn them off or delete your account |
| Days you played (just the date, linked to your account) | Counting how many people play each day | Legitimate interests (running and improving the game) | Until you delete your account |
| Visitor counts: daily totals of page views, how many different visitors came, whether they used a phone, tablet or computer, and which website sent them. To count each visitor once a day we use a one-way hash of the IP address and browser mixed with a random value that changes every day and is never saved, so no one can be recognised. We don't keep IP addresses and we don't use cookies for this | Knowing how many people visit | Legitimate interests | Daily totals only (no personal data) |
| Error reports sent automatically by the game when something goes wrong: the screen you were on, the error and your screen size. No name, email or account details | Finding and fixing problems | Legitimate interests | The most recent 2,000 reports |
| Usage stats, only if you said yes: game events linked to a random ID, not your username | Improving the game | Consent (switch off any time in Settings) | 13 months |
When you delete your account
When you delete your account (Phone → Privacy → Delete my account), we delete your personal details, your character and game, and your social data straight away. A few records are kept with your name and account removed: records of real-money payments (we must keep these for tax), the in-game money ledger, support tickets and reports, until the periods above end. Nightly backups of the database, kept to protect against data loss, are deleted automatically after 14 days, so your data disappears from them within two weeks.
Age
Hello London is only for adults aged 18 and over. We ask for your date of birth when you sign up and don't create accounts for anyone younger. If you think a child has an account, please tell us at [email protected] and we'll close it.
Who we share data with
We only share personal data with the services we need to run the game, under contracts that require them to protect it:
- Namecheap, Inc.: hosts our servers, located in the United States.
- Cloudflare, Inc.: delivers the website and protects it from attacks. Every visit passes through Cloudflare, so it handles your IP address, browser details and the pages you request, and keeps copies of game files (never your account data) close to you so the game loads faster.
- Amazon Web Services (Amazon SES), London region: sends our emails, such as password resets and account messages.
- Amazon Web Services (Amazon S3), London region: stores encrypted copies of our nightly database backups, kept for up to 90 days, so the game can be restored if something goes wrong.
- Stripe: processes card payments. Stripe is responsible for your card details under its own privacy policy.
- Your browser's push service (for example Apple, Google or Mozilla): delivers notifications, only if you turn them on.
- Police or other authorities: when the law requires it, or someone is at risk of serious harm.
We don't sell personal data, and we don't share it with advertisers. Adverts in the game are chosen by where they appear (for example a billboard in Camden), not by tracking you.
Data sent outside the UK
Our servers are in the United States, and some of the services above are run by US companies. When your data leaves the UK, it is protected by the UK's approved safeguards: the UK–US "data bridge" for companies certified under it, or the UK International Data Transfer Agreement or Addendum. You can ask us for more details.
Cookies and storage on your device
We use one essential, HttpOnly cookie to keep you signed in (businesses that advertise with us have their own). The game also saves your settings, such as text size, sound and graphics, in your browser's storage. These are strictly necessary for the game to work, so they don't need consent. We don't use advertising, analytics or third-party tracking cookies.
If we ever add third-party adverts (such as Google ads), we'll ask for your consent first and update this notice before they appear.
Your rights
Under UK data protection law you have the right to:
- access your data and get a copy of it (Phone → Privacy → Download my data);
- have your data corrected if it's wrong;
- have your data deleted (Phone → Privacy → Delete my account);
- restrict or object to some uses of your data;
- take your data to another service (data portability);
- withdraw your consent at any time, for example to usage stats or notifications.
For anything you can't do in the game, email [email protected]. We'll reply within one month. If you're unhappy with how we've handled your data, please tell us first; you also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
How we protect your data
Passwords are hashed with scrypt, sessions are stored as hashes, your name, email, date of birth and two-step login secret are encrypted, connections use HTTPS, and every change to in-game money is recorded in an append-only ledger. The database is backed up every night and each backup is checked; copies are kept on our server, on an encrypted computer we control and in Amazon S3 (London), for up to 90 days. No system is perfect: if you find a security problem, please tell us at [email protected].
Changes to this notice
We'll update this notice when the game or the law changes. If a change is important, we'll tell you in the game.