Privacy policy

• Your account: your email address and how you sign in (email, Google, X, Discord, a passkey or a wallet), your handle and name, and the picture, bio and links you add.
• Your wallet: its public address. Its keys are with you and Privy; Player Two never has them.
• What you do here: your library, wishlist and collections, purchases, gifts, stakes in raises, passes, payouts, votes and objections, reviews, topics and answers, friends and the players and studios you follow, trophies, play sessions and play time, and the saves and scores of games that keep them with us.
• If you make games: your studio, your games and their files, your payout address, and the result of your identity check.
• The Player Two app: a key for each of your computers, with its name and system.
• Push notifications, if you turn them on: for each browser or phone, the address its push service gives it and the keys that seal what we send, what it is (“Chrome on a Mac”), and when a notification last got through. Turned off, or your account deleted, they’re gone.
• Technical: your IP address and browser, kept for a short time for security and to stop abuse: for 30 days, with the address you asked for, only when a request was refused, failed, or looked like an attack. And a report when a page breaks (the page, the error and your browser).
• Page views: a game’s page counts each visitor once a day by a one-way code made from your IP address and browser (or your account), new every day, with where the visit came from. It tells a game’s developer how many came, not who.
• How you use Player Two: the pages you open and how long you stay on them, the buttons and links you press, what you search for, the games you open, how long you play and how smoothly they run (frames a second, slow frames, memory), demos, checkouts and payments you start, wishlists and shares, and how fast our pages load. With it: your browser and system, screen, language, time zone, the graphics card and connection your browser reports, where your visit came from (the site or link), and roughly where you are (country, region and city, from your IP address, which isn’t kept with it). Signed in, it’s kept with your account; signed out, with a random id your browser keeps (a fresh one each visit if your browser sends Global Privacy Control or Do Not Track). When you make an account, we keep how you first found us.
• If you connect GitHub: your public contribution counts, shown on your studio’s card.
• When you write to us: your message and your address.

Didit, our identity partner, checks a photo of an official ID and a selfie (which uses your face’s biometric data) and screens against public sanctions lists. You agree to the check before it starts. Didit tells us the result, your name, date of birth and country; the photos stay with Didit under its own policy, and we keep no copies. We use it to stop fraud, keep raises honest and meet our legal duties. Players never need one.

• To run Player Two for you: your account, library, payments, raises, payouts, downloads and the app (our agreement with you).
• To keep it safe: stopping fraud, abuse and cheating, rate limits, moderation and reports (our legitimate interest, and the law).
• To tell you things: receipts and notices about your money and account always; game news, sales and friends only as your email settings allow.
• To tell you what’s new: an email when a game you have or played lately gets an update, one when a featured game arrives, and a weekly one of the week’s new games and your games’ news. They come until you turn them off: each has its own one-press “turn these off” link, and its own switch in your profile’s email settings (our legitimate interest).
• To make it better: counting page views and errors, and measuring how Player Two and its games are used and how well they run, to fix what’s slow or confusing and see what players like (our legitimate interest). It isn’t sold, shared with advertisers, or used to follow you on other sites.
• Because the law asks: tax, accounting, anti-money-laundering and requests from the authorities.

• Your profile page shows your handle, name, picture, bio and links and, as your privacy settings allow, your activity and your friends. Leaderboards show your name unless you turn that off.
• Reviews, topics and answers are public, under your handle.
• If you redeem a developer’s key, its developer sees your handle beside that key.
• Wallet addresses and payment amounts are public on the Base blockchain.

They handle data for us under contracts, or under their own terms where you deal with them yourself (a top-up, say). We share data with the authorities only when the law requires it, and with a buyer if Player Two is ever sold, under this policy.

• Our services run mainly in the United States. Where your data leaves your country, we rely on the protections the law requires.
• Your account’s data stays until you delete your account. Then your name, email, sign-in, library, wishlist, collections, follows and notices are deleted, and your games come down.
• Records of money (payments, stakes, passes, payouts) stay as long as the law and the raises they belong to need them, without your name.
• What we measure of how Player Two is used is kept for 13 months, then deleted. Delete your account and it’s no longer tied to you.
• Security records last a short time, and backups are written over in turn.

• Download everything we keep about you as one file, and delete your account, from your profile.
• Choose what we email you, what others see, and what games you see, in your profile’s settings.
• Stop us measuring your visits in this browser:
• Depending on where you live, you can ask to see, correct or delete your data, object to some uses, or complain to your data protection authority. Write to hello@playertwo.lol.

Only what the site needs: your sign-in (kept by Privy), a cookie that remembers a friend’s invite link for 30 days, your browser’s own storage for things like sound, the games you looked at lately and the choices you make on the page, and a random id in that storage for our own measurement of how Player Two is used (see above; you can turn it off). No advertising or tracking cookies, and nothing from anyone else.

Player Two isn’t for children under 13, and we don’t knowingly collect their data. If you think a child has an account, tell us and we’ll remove it.

When this policy changes we update this page and its date, and email you about any change that matters.