Privacy Policy

PlaywithBuddies (the "Service") is run by Bilal Saeed("we", "us" or "our"), based in Pakistan. We decide how and why your personal information is used, which makes us the "controller" of that information under data protection laws such as the EU and UK General Data Protection Regulation (GDPR).

If you have any questions about this policy or your information, email us at bilalsaeed10b@gmail.com.

To be completely clear: PlaywithBuddies does collect and store personal data about the people who use it. Section 3 lists all of it. We need it to sign you in, show you to your friends, run your games, save your progress, fix problems and keep the Service safe.

We only ever use that data lawfully. We never use it for any illegal purpose, we never sell it, rent it or trade it, and we never share it with advertisers or data brokers. We handle it in line with the laws of Pakistan, including the Prevention of Electronic Crimes Act, 2016, and, where they apply to you, the EU and UK GDPR and the privacy laws of US states such as California.

We do not show adverts, and we do not use analytics, tracking pixels, advertising cookies or fingerprinting.

Information from your Google account. When you sign in with Google, Google shares your name, email address, profile picture and a unique account ID with us. We never receive your Google password.

Profile information. Your display name, profile picture (including any picture you upload), the badge you choose to wear, and a friend code that we generate so other people can add you without knowing your email address.

Social information. Your friends list, friend requests you send and receive, room invitations (sender, recipient, room and time) and messages in your inbox, including notices we send you.

Rooms and chat. The rooms you create or join, the game chosen, who else is in the room, and chat messages you send, together with your name, account ID and the time sent.

Gameplay information. Games played and won, daily challenge progress, coins, gems, unlocked items, badges, per-game statistics, and the game state needed to run a match.

Presence. Whether you are currently online and in which room, so your friends can see you are around. This is updated while a tab is open and removed once the connection closes.

Bug reports. If you choose to send one, we collect what you write, any screenshot you attach, your name, email address and profile picture, the game and room, and technical details captured at that moment: the page address, browser and operating system, language, time zone, screen and window size, device memory and processor cores where your browser reports them, network type and speed, and the version of the Service.

Diagnostic logs. While you play a multiplayer game on the public site, the game records technical events, such as connection changes, timing and errors, along with your account ID, display name, the room, the game and a session ID. We use these only to find and fix problems.

Connection information. When your browser connects to the Service, the companies listed in section 7 receive technical information such as your IP address, browser type and the time of the request. Real-time games also exchange IP addresses so that players can connect to each other.

Anti-abuse timestamps. The time of your last chat message, invitation, friend request, bug report and room creation, kept as a single record on your account so the site can refuse actions sent faster than the limits allow.

Account deletion requests. If you ask us to delete your account, we record your account ID and the time of the request until the deletion has been carried out.

We do not collect your precise location, contacts, payment details, or any special category information such as health data. Please do not share information like this in chat or bug reports.

Data protection law requires us to have a legal basis for each way we use your information. Here is what we do and why.

• To provide the Service to you. Signing you in, creating your profile, running rooms, chat, friends, invitations, games, progress and Virtual Items. Legal basis: performance of our contract with you, which is our Terms and Conditions.
• To fix problems and improve the Service. Using bug reports and diagnostic logs to find and fix faults and to make the games run better. Legal basis: our legitimate interest in running a Service that works.
• To keep the Service safe and fair. Preventing cheating, abuse, fraud and attacks, limiting how fast actions can be repeated, enforcing our Terms, and dealing with reports about players. Legal basis: our legitimate interest in protecting the Service and its players.
• To talk to you. Replying when you contact us, and sending service notices to your inbox, such as changes to the Service or to these policies. Legal basis: performance of our contract with you, and our legitimate interest in keeping you informed.
• To meet legal obligations. Carrying out deletion and other privacy requests, responding to lawful requests from authorities, and keeping records the law requires. Legal basis: compliance with a legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights and expectations, and you can object at any time (see section 13). We do not use your information for automated decision making that has legal or similarly significant effects on you, and we do not build advertising profiles.

Other signed-in players can see your display name, profile picture, badge and friend code. Players in the same room can see your name, picture, chat messages and in-game activity. Your friends can see when you are online. Your email address is never shown to other players.

In real-time games, your device may connect directly to other players' devices, which means they could technically see your IP address. Where a direct connection is not possible, a relay server run by Cloudflare is used instead, and the other players see only the relay's address.

Pictures you upload, such as your profile picture and bug report screenshots, are kept in a private storage area. They are never published at public web links. A profile picture can only be viewed by signed-in players, and a screenshot only by you and our administrators, and our security rules check every request. An automated daily check removes any public access that may have been added by mistake.

We do not run our own servers. The Service is built on the services below, and your personal information passes through or is stored with them for the purposes described. Where a company acts as our processor, it may only use your information on our instructions and under a data processing agreement. Where it acts as an independent controller, such as for its own security logs, its own privacy policy applies to that use. We do not allow any of them to use your information for advertising.

We may also disclose information if the law requires it, or where it is necessary to protect the safety, rights or property of any person, or to establish, exercise or defend legal claims. If the Service is ever transferred to a new operator, your information may be transferred with it, and it will stay protected in line with this policy. We will tell you before that happens.

If we start using a new service that receives personal information, we will add it to this list before we do.

Our Cookie Policy lists every item stored in your browser, one by one.

We do not use advertising or analytics cookies. We use your browser's storage only for things the Service needs to work: keeping you signed in, remembering settings such as volume, the last room you visited, notices you have dismissed, and, for games played outside a signed-in room, coins and unlocks. Because this storage is strictly necessary to provide the Service you asked for, we do not ask for consent to use it. You can clear it at any time through your browser settings, although you will then be signed out and lose any locally saved settings.

Since we do not track you across websites, there is nothing for a "Do Not Track" or Global Privacy Control signal to switch off. We treat both as requests not to sell or share your information, which we never do anyway.

The services in section 7 store and process information in countries other than the one where you live, including Singapore and the United States. Those countries may have different data protection laws. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU-US Data Privacy Framework and its UK extension where the provider is certified. You can ask us for more information about these safeguards.

The deletions below are carried out by an automated job that runs every day, so they happen on time without anyone having to remember them.

• Account, profile, friends and progress. For as long as your account exists. When you ask us to delete your account, we delete it, together with your chat messages, invitations, bug reports, diagnostic logs, uploaded pictures and sign-in record, within 30 days. In practice this usually happens within a day.
• Rooms and chat. Deleted, together with their chat, once a room has not been used for 30 days.
• Invitations. Expire two minutes after they are sent, and are then deleted.
• Presence. Removed when your connection closes, and in any case when the room is deleted.
• Diagnostic logs. Deleted seven days after they are collected.
• Bug reports and screenshots. Kept until the problem is resolved and deleted 12 months after that, so we can spot the same problem returning. Accepted reports copied to Trello are removed from it at the same time. You can ask us to delete a report sooner.
• Deletion requests. Deleted as soon as the deletion has been carried out.
• Anti-abuse timestamps. Overwritten by each new action, and deleted with your account.
• Emails you send us. Kept for as long as needed to deal with your message, and deleted no later than 24 months afterwards.

We may keep information for longer where the law requires it, or where we need it to deal with a dispute, a safety issue or a breach of our Terms. Information deleted from our systems may remain in our providers' backups for a short period before it is overwritten.

All connections to the Service are encrypted. Access to your data is limited by security rules, so other players can only reach what they are meant to see, and only a small number of authorised administrators can view account details, for running and moderating the Service. Uploaded files are kept private, as explained in section 6. No system is completely secure, however, and we cannot guarantee the security of information sent over the internet. If a breach happens that is likely to put your rights at risk, we will tell you and the relevant authorities as the law requires.

The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If you live somewhere that sets a higher age for consenting to the use of your data online, you need a parent or guardian's consent to use the Service until you reach that age. If you believe a child under 13 has given us personal information, please contact us and we will delete it.

Depending on where you live, you may have some or all of these rights over your personal information:

• Access. Ask for a copy of the information we hold about you.
• Correction. Ask us to fix information that is wrong or incomplete. You can change your display name and picture yourself on your profile page.
• Deletion. Delete your account yourself from your profile page, or ask us to do it.
• Restriction. Ask us to limit how we use your information while a concern is looked into.
• Objection. Object to our use of your information based on legitimate interests.
• Portability. Receive the information you gave us in a structured, commonly used, machine-readable format.
• Withdrawing consent. Where we rely on your consent, withdraw it at any time, without affecting what we did before.
• Non-discrimination. If you live in a US state with a privacy law, such as California, you have the right to know what we collect and to request deletion or correction, and we will not treat you differently for using any of your rights.

To use any of these rights, email bilalsaeed10b@gmail.com from the address linked to your account. We may need to check your identity before acting on a request. We will reply within one month, or within the time the law that applies to you allows, and we do not charge for this. If we cannot do what you ask, we will explain why.

If you are unhappy with how we have handled your information, please talk to us first. You also have the right to complain to your local data protection authority. In the UK this is the Information Commissioner's Office, and in the EU it is the supervisory authority in the country where you live or work.

If we change how we handle personal information, we will update this policy and the date at the top of the page. If a change is significant, we will let you know on the Service before it takes effect. We will not start using your information in a new way that needs your consent without asking for it first.

For any question, request or complaint about your privacy, email bilalsaeed10b@gmail.com. Our Terms and Conditions explain the rules for using the Service.