Privacy Policy
At Playfull, we take your privacy seriously. Please read this Privacy Policy to learn how we treat your personal data. By using or accessing our website(s), products, services, and applications (collectively, "Playfull" or the "Services") in any manner, you acknowledge that you accept the practices and policies outlined below, and you hereby consent that we will collect, use and share your information as described in this Privacy Policy.
As we continually work to improve our Services, we may need to change this Privacy Policy from time to time. Upon such changes, we will alert you to any such changes by placing a notice on the Playfull website, by sending you an email and/or by some other means. Please note that if you've opted not to receive legal notice emails from us (or you haven't provided us with your email address), those legal notices will still govern your use of the Services, and you are still responsible for reading and understanding them. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes.
Table of Contents
- What This Privacy Policy Covers
- Personal Data We Collect
- How and Why We Use Your Data (Legal Basis)
- How We Disclose Your Personal Data
- Data Storage & Infrastructure
- Data Retention
- Your Rights & Choices
- Consent Management
- Data Security
- Personal Data of Children
- Other State Law Privacy Rights
- Contact Information
What This Privacy Policy Covers
This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.
Personal Data We Collect
| Category | Examples | Third Parties |
|---|---|---|
| Profile or Contact Data | - First and last name - Email address - Display name | - Service Providers |
| Online Identifiers | - Unique identifiers such as user ID | - Service Providers - Business Partners |
| Social Network & OAuth Data | - Email address and username from connected accounts (X/Twitter, Discord, Steam) - OAuth access tokens used to verify account ownership and retrieve in-game data | - Service Providers |
| Device / IP Data | - IP address - Device ID - Browser fingerprint - Type of device/operating system/browser used to access the Services | - Service Providers |
| Session Data | - IP address - Session identifiers - Device identifiers collected at the frontend layer and stored in access logs | - Service Providers - Engineering (internal) |
| Web Analytics | - Web page interactions (including with ads) - Referring webpage/source through which you accessed the Services - Non-identifiable request IDs - Statistics associated with the interaction between device or browser and the Services | - Analytics Partners |
| Geolocation Data | - IP-address-based location information | - Service Providers |
| In-Game Activity & Rewards Data | - Mission progress and completion data - In-game events - Playpoints - Arcs - XP - Crypto balances | - Service Providers - Advertisers/Publishers (mission completion data only, in aggregate or as required for reward verification) |
| Behavioral Analytics | - In-app behavioral events collected via Mixpanel (a third-party analytics provider) | - Mixpanel (Analytics Partner) - Marketing team (internal) |
How and Why We Use Your Data (Legal Basis)
We process your Personal Data under the following legal bases:
a) Contract (necessary to provide the Services you signed up for)
- Account registration and login
- Mission progress tracking and reward delivery
- In-game event ingestion and verification
- Managing your Playpoints, Arcs, XP, and crypto balances
b) Consent (you explicitly agreed, and can withdraw at any time)
- Linking third-party OAuth accounts (X/Twitter, Discord, Steam) — we ask for your consent and clearly state what data will be accessed
c) Legitimate Interests (we have a genuine business reason that does not unfairly override your rights)
- Behavioral analytics via Mixpanel to understand how users interact with the platform and improve our Services
- Fraud detection using browser fingerprint and device data
- Security monitoring via server and access logs
How We Disclose Your Personal Data
We disclose your Personal Data to the categories of service providers and other parties listed below. Depending on state laws applicable to you, some disclosures may constitute a "sale" of your Personal Data.
- Service Providers. Parties that help us provide or operate the Services, including hosting, technology, communication, security, and fraud prevention providers.
- Analytics Partners. Companies that track how users found or interact with the Services (including Mixpanel).
- Business Partners. Businesses that you have a relationship with.
- Advertisers / Publishers. Mission completion and progress data may be shared with advertising and publishing partners solely for reward verification and campaign measurement purposes. Advertisers and publishers are contractually prohibited from using this data for any purpose beyond their service operations with Playfull. In the event of a data breach involving your data, our advertiser/publisher partners are required to notify us promptly.
- Parties You Authorize, Access, or Authenticate. Third parties you connect through the Services or that you explicitly authorize to access your data.
- Legal Obligations. We may share Personal Data to comply with applicable laws, regulations, legal processes, or enforceable governmental requests.
- Business Transfers. All Personal Data we collect may be transferred to a third party in the event of a merger, acquisition, bankruptcy, or similar transaction. We will make reasonable efforts to notify you before your information becomes subject to different privacy practices.
- De-identified Data. We may create aggregated, de-identified, or anonymized data from Personal Data and share it with third parties for lawful business purposes. Such data will not identify you personally.
Data Storage & Infrastructure
Your data is stored and processed on cloud infrastructure. Our primary servers are located in Hong Kong. We use the following storage systems:
- PostgreSQL (primary relational database for user, account, and in-game data)
- Google BigQuery (analytics and mission data)
- Mixpanel (third-party behavioral analytics platform)
- GCP Access Logs (server and session logs)
We have accepted Google's Data Processing Addendum (DPA) covering our infrastructure on GCP.
Data Retention
We retain Personal Data for as long as necessary to provide our Services or fulfil our business purposes. Our specific retention periods are:
- Active user account data: Retained for the duration of your account, plus 30 days following account deletion.
- Mission & reward history: Retained for the duration of your account. After deletion, data is disassociated from your identity.
- OAuth tokens (X/Twitter, Discord, Steam): Retained until you disconnect the linked account, at which point tokens are deleted immediately.
- Behavioral analytics events (Mixpanel): Aggregate behavioral analytics data will be retained after 2 years.
- Server and access logs (GCP): 90 days.
- Deleted account data: 30-day grace period following deletion request, after which a full purge is performed.
In some cases we may retain Personal Data longer to comply with legal obligations, resolve disputes, or collect fees owed.
Your Rights & Choices
You have the following rights regarding your Personal Data:
- Access & Portability: You may download a copy of your activity and data directly from your profile page on the Playfull platform.
- Deletion: You may request deletion of your account and associated Personal Data from your profile page. Following a 30-day grace period, your data will be fully purged from our systems.
- Correction: You may update your profile information at any time from your account settings.
- Withdraw Consent for OAuth Connections: You may disconnect any linked third-party account (X/Twitter, Discord, Steam) at any time. Upon disconnection, your OAuth token will be deleted immediately.
To exercise any of the rights above or to submit a privacy request, please contact us at support@playfull.com.
Consent Management
Cookies
We use cookies and similar tracking technologies. A cookie consent banner is displayed on your first visit to the platform. You may accept or decline non-essential cookies at any time.
OAuth Account Linking
When you connect a third-party account (e.g., X/Twitter, Discord, Steam), we will clearly display what data will be accessed (such as your username) and ask for your explicit consent before completing the connection.
Data Security
We seek to protect your Personal Data from unauthorized access, use, and disclosure using appropriate physical, technical, organizational, and administrative security measures. These include:
- Encryption of OAuth tokens at rest.
- Masking of user-identifying information in server and access logs.
- Disabling unencrypted connections to our database.
- Enabling audit logs for engineering access to production databases.
- Regular penetration testing of our application (conducted annually).
- Use of different security tools to detect security vulnerabilities and exposed credentials in our codebase.
- Security awareness training for all employees.
You should also help protect your data by selecting a strong password, limiting access to your devices and browser, and signing out after use. No method of transmitting or storing data over the internet is completely secure, and we cannot guarantee absolute security.
Personal Data of Children
As noted in the Terms of Use, we do not knowingly collect or solicit Personal Data from children under 16 years of age. If you are under 16, please do not register for or use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 16, we will delete it as quickly as possible. If you believe a child under 16 may have provided Personal Data to us, please contact us at support@playfull.com.
Other State Law Privacy Rights
California Resident Rights
Under California Civil Code Sections 1798.83-1798.84, California residents may contact us to prevent disclosure of Personal Data to third parties for direct marketing purposes. Please contact us at support@playfull.com.
Nevada Resident Rights
Nevada residents have the right to opt out of the sale of certain Personal Data to third parties. To exercise this right, contact us at support@playfull.com with the subject line "Nevada Do Not Sell Request" and provide your name and account email address.
Contact Information
If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data, or your choices and rights, please contact us:
- Website: https://www.playfull.com/
- Email: support@playfull.com
- Mail: P.O. Box 66, La Canada, CA 91012, California 91012