This notice explains what happens to your personal data when you visit playdeadfrequency.com, create an account, or sign up for playtests or the newsletter. We collect as little as we can. There is no analytics, advertising or tracking on this site.
Who is responsible
The controller of your personal data is To be completed[CONTROLLER NAME], To be completed[ADDRESS], To be completed[NIP/REGON].
For anything about your data, write to To be completed[CONTACT EMAIL: [email protected]?]. We reply within one month.
What we collect
Only what the site needs to work:
- Account: your email address, the display name you choose, whether your email is verified, and when the account was created or changed.
- Password: stored only as a salted scrypt hash. We never see or store the password itself.
- Sessions: when you sign in we store a session record with a random token, its expiry, and the IP address and browser user agent of the device used.
- Choices: whether you opted in to playtest invites and to the newsletter, and the version of the consent text you agreed to.
- Consent history: each time you give or withdraw a consent we log what changed, when, where (registration or account page), the consent text version, and a keyed hash of your IP address (HMAC-SHA256). The hash lets us tell repeat events apart without keeping the IP itself.
- Security: short-lived rate-limit counters keyed by IP address or account, to stop password guessing and abuse.
- One-time links: tokens for email verification and password reset.
We do not collect payment data, location, contacts, or anything from your device beyond the above. The site has no purchases.
Why, and on what legal basis
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Create and run your account, sign-in, email verification and password reset | Account, password hash, sessions, one-time links | Art. 6(1)(b): necessary for the service you asked for |
| Playtest invites | Email, display name, playtest choice | Art. 6(1)(a): your consent, withdraw anytime |
| Newsletter | Email, display name, newsletter choice | Art. 6(1)(a): your consent, withdraw anytime |
| Proving what you consented to | Consent history with IP hash | Art. 6(1)(c) and art. 7(1): showing consent was given; art. 6(1)(f) for our records |
| Security and abuse prevention | Session IP and user agent, rate-limit counters, technical logs | Art. 6(1)(f): our legitimate interest in keeping accounts and the site safe |
Playtests and the newsletter are separate, optional, and never ticked for you. A consent only becomes active after you verify your email address. Saying no has no effect on your account.
Who processes it for us
We do not sell or share your data. These providers process it only on our instructions:
- Database and application server: Confirma server we operate ourselves in Poland (EU).
- Resend (Resend, Inc.): sends verification, password reset and, if you opt in, playtest and newsletter emails. Sending region: ConfirmEU region (eu-west-1, Ireland).
- Cloudflare (Cloudflare, Inc.): DNS, the encrypted tunnel to our server, network protection and, on non-public test environments, access control (Cloudflare Access). Cloudflare sees connection data such as your IP address while delivering the site.
International transfers
Our own server is in the EU. Resend and Cloudflare are US companies; even when data is handled in the EU, they may access it from outside the EU. Such transfers rely on Confirmthe EU-US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses.
How long we keep it
- Account: Confirmuntil you delete it; accounts unused for 3 years are deleted after an email warning.
- Unverified accounts: Confirm30 days if the email address is never verified.
- Sessions: 7 days from the last sign-in refresh, or until you sign out; Confirmexpired session records are removed within 30 days.
- One-time links: verification links expire after 24 hours, password reset links after 1 hour.
- Rate limits: short-lived counters, overwritten after each time window (about one minute).
- Consent history: Confirmfor as long as your account exists, and deleted with it.
- Email delivery logs: ConfirmResend keeps delivery logs for a limited period set by Resend (about 30 days).
- Technical logs: Confirmtechnical logs are kept for up to 30 days.
- Backups: Confirmbackups are overwritten within 30 days.
Your rights
Under the GDPR you can:
- Access your data and get a copy (art. 15). Signed in, use Export my data on your account page for a JSON file.
- Correct it (art. 16). Change your display name on your account page, or write to us.
- Erase it (art. 17). Delete your account on your account page; this removes your profile, sessions, sign-in data and consent history.
- Restrict processing (art. 18).
- Take it with you (art. 20). The export is machine-readable JSON.
- Object to processing based on legitimate interest (art. 21).
- Withdraw consent anytime (art. 7(3)), using the playtest and newsletter switches on your account page. Withdrawal does not affect earlier processing.
Write to To be completed[CONTACT EMAIL: [email protected]?] for anything you cannot do in your account. You can also complain to the supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
Age
You must be at least Confirm16 to create an account. If you think a child has given us data, write to us and we will delete it.
Security
Traffic is encrypted (HTTPS). Passwords are hashed, session cookies are HttpOnly and Secure, sign-in and reset attempts are rate limited. No system is perfect; if a breach affects you, we will tell you as the law requires.
No profiling
We make no automated decisions about you and do no profiling. Small visual effects on the landing page are random and stored only in your browser (see the Cookies page).
Changes
If this notice changes we update the version and date at the top. If a change affects a consent you gave, we ask again.