Privacy Notice
Version 0.1 — draft for operator review · Reviewed 29 October 2026. No effective date has been set.
Who is responsible
Playtested's confirmed contact email is available below. The legal operator/data-controller identity, public contact address and country are awaiting confirmation. This document is a draft, not a completed privacy notice.
Information used by the service
Account data includes your email address, authentication records, selected roles and profile information. Service records can include developer relationships, game submissions, AI disclosures, campaigns, claims, feedback drafts and submitted reports, ratings, review reasons, moderation history, XP and ranks. Catalogue information may also come from public Steam listings. Authentication and hosting services may process technical connection and security records. Support emails contain the information you choose to send.
Why information is used
Information supports sign-in, game listings, eligibility, campaign capacity, feedback delivery, quality review, rank calculations, moderation, security and answering requests. Proposed lawful bases for operator review are contract for requested account/service functions, legitimate interests for proportionate security, moderation and current-journey reporting, and legal obligations where applicable. These bases and any required balancing assessments must be confirmed before this notice is final. Account details needed for sign-in and service operation are required to provide those functions; other contributions depend on the features you choose to use.
Authentication and local storage
Supabase supports authentication and database storage. The sign-in implementation uses essential session storage/cookies; this is separate from analytics. Tester feedback drafts and developer follow-up statuses can be saved in this browser's local storage. Local-only content does not automatically sync across devices. Clearing browser data may remove drafts and statuses; sign-out should not be assumed to erase every local draft. Avoid shared devices for sensitive reports.
Shared-link reporting
Where reporting is enabled, tagged links record approximate visits, game-access clicks, successful claims and submitted feedback. A short-lived token is carried in the current URL journey for up to 30 minutes; attribution does not use persistent analytics cookies or local/session storage. Later feedback may be attributed through its successful claim. Returning separately is untracked. Rate-limiting uses a daily keyed hash derived from a connection address; attribution tokens are hashed server-side. This is not a claim that the whole site collects no technical data. Access clicks do not prove gameplay, and event counts are not unique people.
Who can see information
Public game pages and catalogue summaries expose public listing information, assessments and community reception according to each feature's visibility. Authorised developers can see their game's reporting and feedback made available to them. Testers can access their own participation and outcomes; admins have review and moderation access. Public summaries do not mean every underlying independent report or account detail is public. Game developers and external build providers also handle information under their own arrangements.
Providers and transfers
The implementation uses Supabase for authentication and data. Contact messages sent to the listed Gmail address are handled by Google's email service. External game links and images may contact their hosts and disclose normal connection information. Hosting, provider regions, processing agreements and any international-transfer safeguards have not been confirmed for public launch. Those details require operator review; this draft makes no claim that information stays in the UK or that particular contracts are in place.
Retention and deletion
The reporting implementation keeps recent events for a 90-day reporting window, with cleanup triggered when reporting is used; this is not a guaranteed immediate deletion deadline. Claim-attribution bindings may remain while their claims exist. Browser drafts and follow-up statuses remain until removed or browser data is cleared. Retention periods and justified criteria for accounts, reports, moderation/audit records, support correspondence, technical logs and backup copies still need an operational policy. No immediate or universal deletion promise is made.
Your requests and complaints
Contact support to request access, correction, deletion, restriction or portability of personal data, or to object to processing, including processing proposed on legitimate interests grounds. Which rights apply depends on the applicable law and lawful basis. If consent is used for a particular purpose, ask to withdraw it. We may need proportionate identity checks; never send passwords or keys. You may also complain to the relevant data-protection authority. For UK data-protection concerns, the Information Commissioner's Office provides a complaint route.
Age, automated rules and changes
The minimum user age requires operator confirmation. Server rules determine matters such as campaign eligibility and capacity; admins assess feedback quality, with a support route for reconsideration. This draft does not establish whether any processing meets a legal definition of significant automated decision-making; that assessment remains part of operator review. Future notice revisions must explain material changes and carry their own review/effective date. Existing users have not been recorded as accepting this newly drafted document.
Contact Playtested
Use our Contact/Support page for questions, requests or appeals.
Review reference: ICO guidance on privacy information (checked 29 October 2026). UK complaints: contact the ICO.