Privacy Notice

Project creators and owner, hosting, and contact

Plaryn.com is the brand and project created, built and owned by the creators acting as Plaryn Team. Plaryn Team is a creative team designation, not a separately registered legal person. Hosting the website on Bomega infrastructure does not give Bomega ownership of the project or brand.

Technical hosting and support for Plaryn.com are provided by BOMEGA spółka z ograniczoną odpowiedzialnością (BOMEGA Sp. z o.o.), Długa 2B, 56-416 Twardogóra, Poland, KRS 0000841054, NIP 9112034523, REGON 386056613. Bomega hosts the service on its servers and performs related technical data operations. Hosting alone does not make it the project owner, the contractual service provider to users or the personal data controller.

Contact for hosting and technical assistance: [email protected]. Plaryn Team creates and owns the project, while Bomega provides hosting and technical operations.

Plaryn Team is the creative team designated by the owner as the creator and owner of the project and brand. Economic rights to particular works, software and games follow actual authorship, contracts and licences; users who submit games retain their lawful rights. Bomega does not acquire any rights to Plaryn.com, its brand, code or games merely by hosting them.

Detailed rules for the functions and rights covered by this document. The provisions distinguish currently available features from options not yet enabled for paid orders.

Sources and anonymous browsing

When a person opens a public Plaryn page, the server processes information necessary to deliver the page and protect the connection, such as the IP address, request time, resource path and browser-related technical data. Opening a Game Card does not, by itself, provide a name, create an Account or transmit private project files. Additional information is involved when a User chooses registration, uploads a Game, files a report or uses another Account feature.

Information may be supplied through forms, derived from selected Account settings or generated by operational and security events. Catalogue interactions can involve data needed to provide search or the requested view. Processing purposes, lawful grounds and retention criteria differ across functions. Personal information should be limited to what is necessary for the legitimate purpose rather than collected merely because the platform could technically store it.

Registration, authentication and email verification

Accounts may contain the member identifier, email address, public display name, authentication status and permissions to use specific modules. Security systems can process session identifiers, login-attempt times and relevant information needed to prevent Account takeover. Passwords should be protected using appropriate technical controls and should not be requested in routine support correspondence.

Account details provide access to functions such as Studio, Library, content reports and team collaboration. Email verification may be required to activate or recover access. Members should protect their inboxes and devices. Private registration information does not automatically become public when a person selects a visible Creator name.

Public profiles and visibility

Creator profiles, Game Cards, project descriptions, images, team names and links can become publicly visible when the relevant publishing action is completed. Public material can be seen by visitors and may be indexed or quoted by independent third parties within the law. Members should consider the consequences of publishing information that identifies themselves or collaborators.

Public profiles must not automatically expose passwords, private support communications, unpublished ZIP files or internal moderation evidence. Individuals named in a public description may have legal rights concerning that publication. Removing a page does not guarantee immediate deletion of independently indexed or archived copies beyond the Service's technical control.

Creator Studio and unpublished projects

Studio can process project identifiers, Game titles, descriptions, versions, collaborator roles, changes, upload references and review statuses. The information supports development workflows, access decisions and the preparation of a specific Release. Draft information does not automatically become public simply because it exists in a Creator interface. Authorised reviewers or security personnel may need restricted access before publication.

An unsuccessful or withdrawn submission may leave a limited operational record needed for troubleshooting, rights assessment or explaining a decision. Access by team members must correspond to their roles. Creators should avoid placing unnecessary personal information in file names, metadata, logs and software packages, particularly information unrelated to the Game under review.

Uploaded files, scanning and metadata

Game packages can be stored temporarily in private systems pending acceptance. Relevant records may include the upload identifier, size, checksum, file type, integrity result, scanning status and publication state. They help distinguish Releases, detect harmful files and prevent unreviewed substitution of an approved package.

A package may itself contain personal data if its Creator has embedded identifiers, logs or information about other people. Uploading such material requires an appropriate legal basis and safeguards. Passwords, secret access keys, identity-document copies and databases of unrelated users should not be included as Game resources. Credibly unsafe material may be restricted and reviewed.

Game cards, screenshots and catalogue information

Approved material can be published as a Game Card, description, cover image, screenshot, Release information and Creator identification. Such data are publicly accessible to the extent displayed. Their purpose is to help visitors find Games, understand available Releases and assess relevant characteristics.

Screenshots and promotional images must respect image rights and the privacy of people shown. Rights reports or accuracy corrections may lead to changed metadata. Appropriate technical identifiers and publication history can remain in restricted records after a current card has been withdrawn where needed for integrity, safety or lawful claims.

Library, followed Games and preferences

A personal Library or following feature can store Game identifiers, the date an item was saved, display choices and an Account entitlement where relevant. The information supports returning to favourite or available content after signing in. Following a title is not proof of purchase and does not create an invoice under the present public-service model.

Such selections can reveal personal interests and should not automatically become public. Users can change supported choices through the interface. Clearing browser cookies may not remove records stored against the Account; broader erasure rights are handled under the GDPR and the relevant account controls.

Cloud Save and Game progress

Where Cloud Save is enabled for a Game, it may hold an Account reference, Game identifier, schema version, timestamp, checksum and the Game's save data. The purpose is to resume progress and synchronise supported sessions under the player's entitlement. Game formats vary, and some progress can remain solely on a device.

Save data may include information entered by the player or generated by gameplay. Creators should avoid unnecessarily collecting personal information within Game states. Authorisation to read a User's own save does not grant access to another player's data. Removing a followed title does not necessarily delete independently stored cloud saves.

Game Jams and event reviews

Participation in Game Jams can involve the Account, event identifier, submitted Game, submission time and information used for evaluation or results. Depending on the event rules, entries may be public while detailed review or organiser decisions remain restricted. Events are not necessarily open for submissions at all times.

If a Jam offers prizes or requires additional information, handling must follow the actual event rules and applicable legal duties. Members should not submit banking information or identity documents through ordinary public Game forms. Participating in an event does not automatically publish private Account details or files not authorised for release.

Teams, invitations and project roles

Teams may process group names, member references, invitations, assigned roles, project descriptions and access-related events. These data support collaboration and decide who can view or change relevant resources. Public team identity and the private identities used for sign-in are separate. Departures or role changes may require revocation of access.

Limited records of role changes may be needed for security, operational integrity or justified legal claims. Team membership must not automatically reveal private contact details, passwords or another member's support history. Collaborators remain responsible for the legal grounds of information they themselves publish about other people.

Trust Center reports, moderation and appeals

A report about unlawful material or a rule breach can include the reporter reference, affected Game or post, explanation, date, evidence and review outcome. Information supports investigation, proportionate decisions and any explanation or appeal required by applicable law. Ordinary software-support complaints and unlawful-content notices can have different purposes and procedures.

The reporter's identity and supporting evidence should be accessible only to authorised people as needed. Removing public material does not always require the immediate deletion of records lawfully preserved for legal obligations, safety or legitimate claims. Information supplied to a reporting procedure must not be misused to retaliate against a person exercising a lawful right.

Support, complaints and correspondence

Support may process a reply address, Account reference, affected feature, description, event time and relevant troubleshooting details. Screenshots or log extracts supplied by the User can contain personal information and should be limited to the problem being investigated. Such data are used to answer requests, restore functions and document complaints where appropriate.

Members should not send passwords, session tokens, payment-card details or complete private Game packages without a specific and lawful need. The [email protected] address serves technical handling and forwarding, not proof that the host is the controller of all data. Data-subject requests should reach the organisation actually responsible for the relevant processing.

Cookies, language choice and device storage

Browsers can retain information about authenticated sessions, request security, language choice and selected player-device settings. The Service uses technical mechanisms including `__Host-gp_csrf` for certain request protections and `plaryn_locale` for language preference when that feature is used. Some player preferences can reside in local browser storage. The separate Cookie Notice provides further details.

Consent to optional browser technologies is distinct from accepting the Terms and from the lawful grounds for necessary Account processing. LocalStorage data are not automatically sent with every HTTP request like cookies; clearing authentication cookies can end a session without deleting the Account. Strictly necessary technologies and optional analytics or marketing serve different purposes and may involve different legal requirements.

Security events and operational logs

The platform can process IP addresses, request times, session references, browser or device signals, error events, permission checks and appropriate anti-abuse information. Such data help secure Accounts, prevent unauthorised downloads, investigate incidents and maintain integrity. A technical identifier is not necessarily anonymous if it can be linked to an Account or other event.

Access to logs should be restricted to personnel with justified operational tasks. Relevant records may need to remain for investigating an attack, significant outage or lawful claim. Not all operational logs and backups have identical retention periods. Reusing them for unrelated purposes requires a separate legal assessment and appropriate lawful ground.

Purposes and legal bases under GDPR

Article 6(1)(b) GDPR can apply to information necessary to perform a contract for requested Account, publication or collaboration functions where the legal conditions are met. Compliance with a specific legal duty may involve Article 6(1)(c). Legitimate interests assessed under Article 6(1)(f) can relate to security, preventing abuse and preserving necessary evidence or legal claims.

Processing based on consent requires valid permission and the ability to withdraw it. The correct legal ground must be established for each purpose rather than assuming one ground applies to every event. Viewing a Game Card, managing an Account, having an uploaded ZIP scanned and making a complaint can involve different information. Optional advertising or analytics consent must not automatically become a condition of an unrelated essential feature.

Recipients, hosting and support providers

Information may be accessible as necessary to authorised personnel and suppliers providing hosting, email, security, backups or support for the Service. Bomega Sp. z o.o. supplies technical hosting and infrastructure maintenance. Hosting alone does not transfer project ownership or automatically establish Bomega as controller of all personal information.

Relevant contracts, authorisations and safeguards should determine access by technical suppliers. Data voluntarily published on a Game Card may be seen by visitors, but private records must not be disclosed to other Players without an appropriate lawful basis. Public authorities may receive information when the applicable law provides a valid obligation or authorisation.

International transfers outside the EEA

Infrastructure, email and other technical services can sometimes involve processing outside the European Economic Area. Any actual transfer requires identifying the recipient, purpose and data categories and applying a valid mechanism under Chapter V GDPR. A link to an external Game or service does not by itself establish that the entire Account database is transferred to its provider.

Where a transfer genuinely occurs, the applicable adequacy decision, standard contractual clauses or another lawful mechanism must be determined in the particular circumstances. Individuals may request information about relevant recipients and safeguards where required by law. A European server location alone is not sufficient to assert that no international transfers can occur.

Retention periods and deletion criteria

Account information may be needed while the Account operates; publication information may remain throughout a Release lifecycle and for appropriate historical records. Support requests, legal notices and security logs can have different retention criteria from a personal list of followed titles. Relevant factors include the purpose, legal duties, applicable claim periods and operational recovery needs. One invented fixed period must not be presented as applying to every category.

Deleting an entry from a User interface can occur before all protected backup copies expire. Data held only for a justified purpose must not be freely reused for unrelated operations. Erasure requests are assessed under GDPR with regard to applicable exceptions, third-party rights, legal duties and the system's actual ability to carry out the requested operation.

Data-subject rights and how to request them

In appropriate circumstances, individuals may request access, rectification, erasure, restriction, portability or object to processing; consent may be withdrawn where consent was the lawful basis. Requests can use supported Account controls or the stated forwarding channel, including [email protected] to route the request to the responsible privacy team. The scope of each right depends on the relevant ground and statutory exceptions.

Reasonable verification may be necessary to prevent improper disclosure to someone who does not control the Account. A response is generally due within one month, subject to extensions permitted by law. Individuals may complain to the competent data-protection supervisory authority, including the President of Poland's Personal Data Protection Office (UODO) where appropriate. Using an Account deletion button must not remove other statutory rights.

Automated recommendations, children and data security

Plaryn can automatically organise Game Cards based on search terms, filters and selected settings. Such catalogue matching does not in itself amount to solely automated decisions producing legal or similarly significant effects under Article 22 GDPR. Any future profiling or automated decisions with such effects would require an appropriate separate assessment and information.

Children require particular protection, including age-related requirements and parental authorisation where legally applicable. Security controls must be proportionate to processing risks. A data breach must be evaluated and the notifications required by GDPR performed by the responsible entity. Members should not send passwords or unprotected copies of personal-data databases to ordinary support channels.

Creator analytics and activity statistics

Where an enabled Studio feature provides Game statistics, the information can include views, publication events and other technical data relevant to a Release. The scope depends on the active module, and aggregated figures need not identify individual Players. A Creator does not automatically gain access to every visitor's email address or private Library merely because someone viewed a Game Card.

Analytics processing requires an appropriate legal basis and compliance with device-storage rules where relevant. Access to a dashboard does not mean unrestricted access to raw server logs. If new marketing tracking is introduced in the future, suitable information and consent must be provided where the law requires them.

Account messages and notifications

The Service can send messages needed for registration, verification, Account recovery, Release status changes or support requests. The email address, Account reference, message category and delivery-related technical information may be used for those purposes. Such operational and security notices are not automatically equivalent to advertising newsletters.

Following Creators or Games can involve notifications reflecting the User's preferences and features actually enabled. Legally required information about changes to the Service may be delivered through an appropriate channel independently of ordinary marketing preferences. Direct marketing must follow the separate lawful grounds and consents required by applicable legislation.

Removing projects and collaborators' rights

An erasure or Account closure request can concern Creator profiles, followed items and personal Account information, but it does not necessarily authorise immediate removal of an entire jointly created project. The rights of other contributors, previously lawful publication, evidence obligations and changes to the original need for particular data may be relevant.

Personal data of an individual should be distinguished from another collaborator's legal interest and rights in shared works. Proportionate verification of authority may be needed. GDPR does not automatically transfer copyright or require deletion of information that must lawfully remain for an applicable purpose.

Third-party information included by Creators

Uploaded packages, artwork, collaborator lists and descriptions may contain personal information about people other than the Account holder. The person submitting material should have an appropriate basis to use it, provide required notices and minimise unnecessary details. Hidden passwords, logs identifying unrelated people and private documents are generally not necessary for an ordinary Game Card.

Plaryn may restrict access or request corrections in response to a credible privacy report. This does not mean the hosting company automatically controls all information in each independent Creator project. Relevant responsibilities depend on the actual processing purposes, decisions and applicable agreements.

Notice updates, contact and transparency

The Privacy Notice should remain consistent with processing actually performed by the current Plaryn release and be updated after material changes to purposes, data categories, recipients or technologies. Opening a new informational page does not itself constitute consent to unrelated use of personal information. Information obligations and individual rights arise directly from applicable law.

Requests concerning access, correction, erasure or objection can be submitted through supported Account controls or [email protected] for forwarding. Appropriate verification may be needed before an Account-related action. The identity of the Controller follows the entity actually responsible for determining purposes and means of processing, not merely the creative team name or server host.