1. Introduction
Welcome to PLOYCRAFT ("we," "our," or "us"). We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website and services. By using our services, you agree to the collection and use of information in accordance with this policy.
The data controller is MABARIS DI M.A.B., a sole proprietorship (ditta individuale), VAT no. IT04083540791, REA no. CZ-233871. For anything concerning your personal data, write to privacy@ploycraft.com.
2. Information We Collect
We may collect information about you in a variety of ways. The information we may collect on the Site includes:
- Personal Data: Personally identifiable information, such as your name, email address, and payment information (processed by our payment provider, Stripe), that you voluntarily give to us when you register for an account or make a purchase. If you sign in with Google, Google gives us your email address and the name and picture of your Google account.
- Technical Data: Your IP address, which our servers see whenever you use the Site. For an account, we also record each browser it is used from: a random browser identifier (the
ploycraft_device cookie described in our Cookie Policy), the browser's user agent and language, when it was first and last seen, and how many times. For a guest session, we record the IP addresses it is used from, up to 30.
- Financial Data: Financial information, such as data related to your payment method (e.g., valid credit card number, card brand, expiration date) that we may collect when you purchase, order, return, or exchange. We store only very limited, if any, financial information that we collect. Otherwise, all financial information is stored by our payment processor, Stripe, and you are encouraged to review their privacy policy and contact them directly for responses to your questions.
- User-Generated Content: We collect the challenges, run states, and other content you create on our platform. This includes the text of your challenges, your run history, and any feedback you provide. You can remove any run from your run history at any time from your profile page. It is then unlinked from your account for other users: it no longer appears on your profile, its share links stop working, and wherever it is still shown it appears as Anonymous. Its score stays on leaderboards and its replay stays viewable as before, unless you take it off the current season's leaderboard while removing it. We keep the run itself in our records; to have your data erased, see section 8.
3. Use of Your Information
Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Site to:
- Create and manage your account.
- Process your payments and subscriptions.
- Provide and deliver the services you request, process transactions, and send you related information, including confirmations and invoices.
- Monitor and analyze trends, usage, and activities in connection with our services, including the use of credits to prevent abuse of the system (e.g., creation of multiple guest accounts to circumvent credit limits).
- Prevent fraudulent transactions, monitor against theft, and protect against criminal activity.
- Respond to your comments, questions, and requests and provide customer service.
- Comply with legal and regulatory requirements.
4. Legal Bases
We use your data only where the GDPR allows it:
- To perform our contract with you (Art. 6(1)(b) GDPR): creating and running your account, playing and saving runs, leaderboards and public profiles, credits, purchases and subscriptions, emails about your account and purchases, and answering your requests.
- To meet our legal obligations (Art. 6(1)(c)): keeping the records of purchases, refunds, consents and withdrawal notices that Italian tax and consumer law require, and confirming each purchase by email.
- For our legitimate interests (Art. 6(1)(f)): keeping PLOYCRAFT secure and its leaderboards fair, which means preventing fraud, the abuse of free credits and multiple accounts, and enforcing suspensions and bans with IP addresses, browser identifiers and bot checks; counting visits without cookies, and reading the feedback you send and the runs played, to improve the game; and establishing or defending legal claims. You can object to this use (section 8); we will then stop, unless our reasons, such as preventing abuse, outweigh your interests.
You need an email address to create an account, and a payment method to buy credits; without them we cannot provide those parts of the service. As a guest you can play without giving us either.
5. Disclosure of Your Information
We do not share, sell, rent, or trade your personal information with third parties for their commercial purposes. We may share information we have collected about you in certain situations:
- By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process, to investigate or remedy potential violations of our policies, or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law, rule, or regulation.
- Third-Party Service Providers: We may share your information with third parties that perform services for us or on our behalf, including payment processing (Stripe), database and sign-in (Supabase), sign-in with Google if you choose it (Google), hosting services (Netlify), bot checks (Cloudflare Turnstile), visit statistics and anonymous gameplay events, such as a run started or feedback sent, without cookies (Umami), email (Zoho Mail for our support inbox, Zoho ZeptoMail for sign-up, password and purchase emails), and AI simulation (OpenRouter, which passes requests to Google's Gemini models). To play a turn, and when you use the challenge editor's AI tools, we send the action you type, the challenge text and the run so far to these AI providers. These providers may process data outside the European Economic Area; when they do, the transfer relies on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework, or on the Standard Contractual Clauses in their data processing terms. Purchase confirmation emails contain your purchase reference, amount, accepted terms and consent confirmation; payment-card details are not included.
- Publicly Visible Information: Your username and public runs may be visible to other users on leaderboards and on your public profile. While you subscribe, a Plus mark shows next to your username; if you paid for a subscription during season one, a numbered Season One Founder mark shows next to it, on leaderboards, your profile and your replays, also after the subscription ends, until you erase your account or ask us to hide it (see the Terms of Service). You choose whether each run is public or private, and in Settings whether new runs start private. Liked replays are visible only to you. If you change your username, we keep a record of your previous usernames for moderation; for 90 days nobody else can take one, and links to your profile under it lead to your current name. Erasing your account deletes that record. Making a run private, or hiding your username on a challenge you created, hides your name from other users only; we still store which account the run or challenge belongs to.
6. How Long We Keep Your Data
- Your account: your email address, username and settings, runs, challenges, likes, favorites, feedback and reports, previous usernames, and the browsers and last IP address the account was used from are kept as long as the account exists. When the account is erased, we delete or anonymize them as section 8 describes; the record of the credits the account used stays, without your email address or username.
- Purchases: records of purchases, refunds, consents, withdrawal notices and purchase confirmation emails are kept for 10 years from the purchase, the period Italian law sets for accounting records (Art. 2220 of the Civil Code), so that we can also answer any claim about them.
- Warnings, suspensions and bans: recorded with the account, together with the browser identifiers and IP addresses they cover. A suspension or ban still in force is kept even after the account is erased, so that erasure cannot be used to lift it; a ban on an IP address alone is kept until we lift it.
- Guest sessions: a guest session starts with your first move as a guest; looking around the Site does not create one. A guest session, with its credits, its runs in progress and the IP addresses it was used from, is kept so that guest limits cannot be bypassed and abuse can be investigated. We do not delete guest sessions automatically; your browser forgets the guest cookie after a year. A run you finish as a guest is kept for 30 days, so that you can keep it by signing up or logging in, and is then deleted. If you sign up from a browser you played in as a guest, we note that guest session on your new account until you first log in, and for no more than 30 days, so that its runs reach your account whichever browser you log in from. Runs that reach your account are kept like its other runs.
- Turn requests: each turn you play, and each AI request you make in the challenge editor, is recorded while it is processed, so that it is charged only once and its result reaches you even if the page reloads. The record keeps the reply, which for a turn includes the run up to that point, your actions among them. We delete each record once it is 30 days old; your runs themselves are kept as described above.
- Emails you send us: kept as long as we need them to deal with your request, and after that only when they concern a purchase, a dispute or a legal claim.
- Server logs: our hosting and database providers keep technical logs for a short period set by their own terms.
7. One Account per Person: Automated Decisions
Our Terms of Service allow one account per person, and we apply this rule automatically. Each time an account is used, we record the browser it is used from (section 2). Accounts used from the same browser are linked, and so are the accounts linked to those. When two or three accounts are linked, each is warned once. When four or more are linked, all of them are suspended for seven days, and if the group grows after that, its accounts are closed for good. An account we have marked as being on a shared computer is exempt.
You can ask a person to review any of these decisions, explain your side and contest it, by writing to support@ploycraft.com. If several people use your computer, tell us and we will make a note so that it does not affect you.
8. Your Data Protection Rights Under GDPR
If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.
- The right to access, update or to delete the information we have on you.
- The right of rectification.
- The right to object.
- The right of restriction.
- The right to data portability.
- The right to withdraw consent.
- The right to lodge a complaint with a supervisory authority: in Italy the Garante per la protezione dei dati personali (garanteprivacy.it), or the authority of the EU country where you live or work.
To learn what Personal Data we hold about you, or to have your account and data erased, email us at privacy@ploycraft.com from the address registered to your account. We answer within one month.
Erasing an account clears your email address, your IP address and the browsers recorded for the account, deletes the text of your runs, your saved game data and your feedback, disables the account, and replaces your username with an anonymous one. If the account is suspended or banned, the suspension or ban stays in force, with the browser identifiers and IP addresses it covers. Your scores stay on leaderboards and challenges you published stay available, without your name. We keep the records the law requires us to keep, such as purchases, refunds, consents and withdrawal notices (section 6).
9. Cookie Policy
We only use the cookies and browser storage the Service needs to work, such as keeping you logged in and counting guest turns, and we count visits without cookies. For details, see our Cookie Policy.
10. Data Security
We use administrative, technical, and physical security measures to help protect your personal information. While we have taken reasonable steps to secure the personal information you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable, and no method of data transmission can be guaranteed against any interception or other type of misuse.
11. Contact Us
If you have questions or comments about this Privacy Policy, please contact us at: privacy@ploycraft.com.