Privacy Policy

1. Data controller

The personal data controller is Katsiaryna Filosaf, an individual operating from Poland, at ul. Rolna 1, 30-318 Kraków, Poland. play2gether.fun is a games.enterprises subproject.

For data matters, contact privacy@games.enterprises. The fallback address is 100games.enterprises@gmail.com and the telephone number is +1 (343) 655-5448.

2. Account and email verification

When you register, we process the email address and its normalized form, the password, an internal identifier, creation and update dates, and language. The password is not stored in plain text: we retain a strong salted hash and its technical hashing parameters.

Email verification uses a one-time token link valid for up to 24 hours. The database stores a protected token hash and its creation, expiry, and consumption times, not the raw token. The email provider necessarily receives the original link in the message.

Account recovery uses a separate one-time link valid for up to 1 hour. We store its token hash and creation, expiry, and consumption times; Resend receives the raw link in the security email. Setting a new password confirms control of the email address, revokes every previous session, and invalidates other unused verification and recovery links.

3. Sessions and security

After sign-in, a random session token is created; the database stores its hash, user identifier, creation time, and expiry. The session cookie lasts up to 30 days and uses HttpOnly, SameSite=Strict, and Secure over HTTPS.

To limit registration and login attempts, we process an IP address, a pseudonymized email hash, request counters, and time windows. The server and proxy also process time, request method and path, response status, referrer, user agent, and security headers.

4. Rooms and game data

We process the room code and identifier, content language, selected game, round state, creation and expiry times, and the registered creator's account identifier. For players, we store a display name, color, host role, join and activity times, and a hash of a random player token.

Game state may include answers, choices, votes, scores, teams, results, and readiness timestamps. Other players in that room see these details as the game requires. Do not submit sensitive data or another person's information without a lawful basis.

5. Purchases and Stripe

Stripe hosts Checkout and directly receives card details. We do not receive the full card number or CVC. To perform a purchase, we may receive and store payer email, name or billing address, country, tax status, Stripe Customer, Checkout Session, PaymentIntent, Charge, and Price identifiers, product and game, amount, currency, tax, status, activation and expiry dates, card brand and last digits, and refund, dispute, and fraud-risk details.

We retain the accepted terms version and snapshot, language, consent times, adult confirmation, request for immediate digital supply, withdrawal acknowledgement, and delivery of the contract confirmation. This evidence is needed to perform the purchase, answer complaints, process refunds, keep tax records, and defend claims.

6. Email and correspondence

Resend processes the recipient, sender, subject, content, terms attachments, message identifier, and delivery metadata for verification, contractual, and security email. Resend is Plus Five Five, Inc.; its privacy policy and DPA are at resend.com/legal/privacy-policy and resend.com/legal/dpa.

When you contact us, we process contact details, message content and attachments, correspondence, and information needed to respond. Domain mail may pass through Namecheap and arrive in a Google mailbox.

7. Purposes and lawful bases

Account, session, room, gameplay, access entitlement, payment, and support processing is necessary to enter into or perform a contract or take requested pre-contract steps under Article 6(1)(b) GDPR.

Tax, accounting, consumer, and lawful-request records are processed to comply with legal obligations under Article 6(1)(c). Account protection, rate limiting, diagnostics, fraud prevention, and claim defense rely on our legitimate interests under Article 6(1)(f). If optional analytics or marketing is introduced, it will rely on consent under Article 6(1)(a) where required.

8. Recipients and international processing

Timeweb Cloud provides infrastructure in Amsterdam, the Netherlands, where the primary SQLite database and logical backups are located. Stripe provides payment, tax, and fraud services. Resend sends transactional email. Namecheap provides DNS and domain mail forwarding, and Google provides the destination mailbox.

Poland and the Netherlands are in the EEA. Stripe, Resend, Namecheap, and Google may process relevant data outside the EEA using safeguards described in their documents, including an adequacy decision or Standard Contractual Clauses where applicable. Ask privacy@games.enterprises for further information.

9. Retention

Account data and account-bound rights remain while the account exists and the information is needed for the Service. A session lasts up to 30 days. An email verification link lasts up to 24 hours and a password-recovery link up to 1 hour. A consumed token is no longer accepted; token records are removed by subsequent technical cleanup after consumption or expiry.

A room becomes inaccessible after 24 hours and is removed during subsequent technical cleanup. Expired data may remain for a limited time in isolated backups; the current logical backup cycle is up to 14 days. Rate-limit entries remain for a short security window and are removed during cleanup after expiry.

Payment, contract, accounting, tax, anti-fraud, and dispute records remain for the period needed to perform the purchase and required by applicable law. Support correspondence remains while needed for the request, security, or a legal claim.

10. Security

We use HTTPS, HttpOnly and SameSite cookies, salted password hashing, secret-token hashing, origin checks for state-changing requests, rate limits, an isolated database, and backups. Production-data access is restricted.

No method is absolutely secure. If an incident creates a risk, we assess it and notify affected people and authorities where and when the law requires.

11. Your rights

Depending on applicable law, you may request access, a copy, correction, erasure, restriction, or portability; object to processing; withdraw consent; and avoid a solely automated decision with significant effects. Withdrawing consent does not affect prior lawful processing.

Contact privacy@games.enterprises, preferably from the account email. We may request proportionate identity verification. Poland's lead authority is the President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl; you may also contact the authority where you live.

12. Children and policy changes

The Service is not intended for independent use by a child under 13. If you believe a child submitted data without appropriate adult involvement, contact privacy@games.enterprises. Purchases are available only to adults with legal capacity.

We update this Policy when data, purposes, recipients, or law change and display a new date. We give prominent notice of a material change and seek consent where required.