Privacy Policy
Last updated: 17 October 2026. This policy explains what data Turf (turfxplore.com) collects, why, how it's stored and shared, and how you can see or delete it.
Who we are
Turf (turfxplore.com) is a location-based exploration game run by the Turf team ("we", "us"). We are the data controller for your personal data.
Contact us about privacy, your data or your account at [email protected].
Google user data
You sign in to Turf with your Google account, using Google Identity Services ("Sign in with Google"). This section explains exactly how Turf accesses, uses, stores, shares, protects and deletes data it receives from Google.
Access: what Google user data Turf receives
Turf only requests Google's basic sign-in scopes: openid, email and profile. When you sign in, Google sends Turf:
- your Google account ID (a number that identifies your Google account);
- your email address, and whether Google has verified it;
- your Google name and profile picture.
Turf never receives your Google password and cannot access your Gmail, contacts, Drive, calendar, location history or any other Google data.
Use: how Turf uses it
- Your Google account ID links you to your Turf account each time you sign in.
- Your email address is used to contact you about your account (for example about safety, moderation, account deletion or important changes to the service). We don't send marketing emails.
- Your Google name and profile picture are not stored or used. In the game you're known only by the player name you choose.
We use Google user data only to provide and improve Turf's user-facing features (signing you in and running your account). We do not use it for advertising (including targeted, personalised, retargeted or interest-based ads), we do not sell it, we do not transfer it to data brokers or information resellers, we do not use it to determine creditworthiness or for lending, and we do not use it to develop, improve or train artificial intelligence or machine-learning models.
Turf's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Sharing: who Turf shares it with
Your email and Google account ID are never shown to other players and are not shared with anyone for their own purposes. They are stored on infrastructure run for us by DigitalOcean (our hosting and database provider, London region), which processes them only on our instructions to host Turf. We may disclose data if required by law, or to protect someone's safety. If Turf were ever sold or merged, we would tell you before your data became subject to a different privacy policy.
Protection: how Turf keeps it safe
- All traffic between your device and Turf is encrypted with HTTPS (TLS).
- Our database is a managed DigitalOcean database, encrypted at rest, and it only accepts encrypted connections from Turf's own servers.
- Your sign-in session is a random token in a secure, HTTP-only cookie; we store only a one-way hash of it, and sessions expire after 30 days without use.
- Only the people who run Turf can access production systems, and our logs never contain your email or location.
Retention and deletion
- We keep your Google account ID and email for as long as you have a Turf account.
- You can delete your account at any time in the app (tap your name → "Delete account"). This immediately and permanently deletes your Google account ID, email and all your other Turf data.
- If you can't sign in, email [email protected] from your account's email address and we'll delete your account within 30 days.
- You can also remove Turf's access to your Google account at any time at myaccount.google.com/permissions.
Other data we collect and why
- Your profile: the player name you choose, your colour, your game settings, and when you accepted the rules and confirmed you're 13 or older. Used to run your account.
- Your location, only while the app is open: your phone sends its position about every 5 seconds. We keep only your latest position, overwriting it each time, to time how long you stay in a tile and to detect cheating. We don't keep a history of your movements. Turf can't see your location when the app is closed.
- Game history: the tiles you own, the tiles you've visited (your private Explored map), landmarks you've discovered, your XP, levels, quests and achievements, and your challenges (won, defended, abandoned). Used to run the game and leaderboards.
- Your home privacy zone, if you set one. Only you can see it; it stops you claiming tiles near home.
- Moderation: reports you make or receive, and automatic flags when a position change looks impossibly fast. Used to keep the game fair and safe.
- Technical data: your IP address (used briefly to limit abuse, e.g. too many sign-in attempts) and server logs of requests and errors. Logs never contain your location.
What other players can see
Your player name, your colour, the tiles you own and the day you claimed them (never the time), your points, level and rank, and the outcomes of your challenges. If you're challenging someone's tile, its owner sees your player name while the challenge runs. Other players never see your exact position, your email, your Google details, your Explored map or your privacy zone.
Owned tiles can reveal areas where you spend time. Use the home privacy zone and the "Ask me" / "Off" claim modes to control this (see the rules).
Legal basis (UK GDPR)
Contract: to provide the game you signed up for. Legitimate interests: to keep the game fair and safe (anti-cheat, moderation, rate limits), to secure our systems and to fix errors. We don't sell your data and we don't use it for advertising or profiling.
Who we share it with
Only service providers that run Turf for us, under contracts that require them to protect your data:
- DigitalOcean: hosts our servers and database in its London (UK) region, and delivers the app through its network.
- Google: provides sign-in and the fonts used on our pages.
- Map providers: OpenStreetMap (map images) and Esri (satellite images, if you choose them). Your browser loads images from them directly, so they receive your IP address and the map area you're viewing, but no account details.
Some providers may process data outside the UK; where they do, it's protected by appropriate safeguards such as the UK International Data Transfer Addendum. We may disclose data if the law requires it, or to protect someone's safety.
How we protect it
All connections to Turf use HTTPS. Our database only accepts connections from our own app servers. Sign-in sessions are random tokens held in a secure cookie that page scripts can't read, and we store only a one-way hash of them. Access to production systems is limited to the people who run Turf.
How long we keep it
- Your latest position: overwritten every few seconds while you play.
- Your account, Google account ID, email and game history: until you delete your account.
- Sign-in sessions: expire after 30 days without use, or when you log out.
- Server logs: up to 30 days.
- Moderation reports: as long as needed to deal with them, and no more than 12 months after they're resolved.
Your rights
You can download all your data and delete your account at any time in the app: tap your name, then "Download my data" or "Delete account". Deleting your account immediately and permanently removes your profile, Google account ID, email, tiles, history and sessions. If you can't sign in, email [email protected] from your account's email address and we'll delete it within 30 days.
You also have the right to access, correct, restrict or object to the use of your data. If you're unhappy with how we handle it, you can complain to the Information Commissioner's Office (ico.org.uk), but please contact us first so we can help.
Children
Turf is for people aged 13 and over, and everyone confirms their age when they sign up. If you think a child under 13 has an account, contact us and we'll delete it.
Cookies and storage
We use one essential cookie (turf_session) to keep you signed in. Your map settings are also cached in your browser's local storage. We don't use advertising, analytics or tracking cookies. Google sets its own cookies during sign-in, covered by Google's privacy policy.
Changes to this policy
If we change how we use your data, we'll update this page and the date at the top. For significant changes we'll tell you in the app or by email before they take effect.