Privacy Policy for Passengers (UK GDPR)

Who controls passenger data

The controller for personal data processed through velvetrailclub.com is the operator of velvetrailclub.com. Contact: [email protected].

What your passenger account carries

What is held	Why the railway holds it	How long it stays on file
Nickname	Naming you in the game	Until you delete the account
Email address	Matching you to your seat when you sign in again	Until you delete the account
Password hash	Checking your login without the password itself ever being stored	Until you delete the account
Sign-up date	Support and abuse handling	Until you delete the account

Nothing beyond that is collected. Your real name, address, date of birth, phone number and payment details are never requested, since the site has nothing to pay for. Your password is held only as a one-way hash. Lawful basis: performance of a contract (supplying the account you asked for). Deleting your account removes every part of it at once, using the button on your account page.

What stays on your own platform (your browser)

What is held	What it is used for	How long it stays on file
Coin balance, level and missions, plus each carriage’s settings	Continuing your game	Until you clear browser data
Age confirmation	So the question is not repeated on every page	Until you clear browser data
Cookie choice	Remembering your consent	Until you clear browser data

Nothing listed here leaves your device, and none of it is sent to the railway.

Google tags, which ride only with your consent

Pick “Accept all” and Google Analytics and Google Ads tags measure visits and whether our adverts lead to play, for instance whether a first spin took place. Google is sent your IP address, device information and those events. Pick “Essential only” and the same tags run in consent mode, with no cookies and no advertising identifiers. Lawful basis: consent.

Logs in the signal box (our host)

Our host keeps routine request logs in its signal box for security, and only for a short while. Lawful basis: legitimate interests.

Lines we never cross

No payment data is ever taken, as there is no ticket office selling anything.
No marketing email reaches you unless you have asked the railway for it.
Your data is never sold or rented, to anyone, at any station.
Nothing is passed to gambling operators, and the line carries no gambling affiliate links.

Your rights as a passenger under UK GDPR

Whenever you wish, you can access, correct, erase or restrict your data, object to its processing and withdraw consent. Deleting your account on the account page erases its data straight away, and clearing this site’s data in your browser deals with the rest. To complain, contact the ICO at ico.org.uk.

Passenger privacy notice