Privacy Policy
Version 1.0 · Effective July 26, 2026 · Back to Legal
This policy explains what PadPlayer collects when you use PadPlayer, why we collect it, and what you can do about it.
The short version
- We collect your username, email, a hashed password, and your gameplay records.
- We use them to run your account and the leaderboards. Nothing else.
- We don't sell your data. We don't share it with advertisers. We don't run ads.
- We use one cookie, and it's the one that keeps you logged in.
- You can ask us to delete your account and everything in it.
What we collect
When you register
- Username — shown publicly on leaderboards and profiles.
- Email address — never shown publicly. Used for account recovery and important account notices.
- Password — stored only as a cryptographic hash (Argon2id or bcrypt, with an additional server-side secret). We cannot read your password, and neither can anyone who obtains a copy of our database.
- Your agreement to the Terms — the date, time, and version you accepted.
When you play
- Scores and game sessions — which games you played, when, and what you scored.
- Virtual currency transactions — a record of every change to your balance, for accounting integrity and fraud prevention.
- Badges and statistics — counters that drive achievements.
- Likes — which games you've liked.
Automatically, for security
- IP address — recorded on login and on game sessions, to detect abuse and enforce rate limits.
- A hash of your browser's user-agent string — used to detect session hijacking. We store a one-way hash, not the string itself.
- Security event log — logins, failed login attempts, administrative actions, and flagged game sessions.
What we deliberately do NOT collect
- Real names, addresses, or phone numbers.
- Payment information — the Site does not process payments.
- Date of birth, gender, or demographic information.
- Location beyond what an IP address implies.
- Anything from third-party trackers, analytics platforms, or ad networks — the Site currently runs none.
Cookies
We set one cookie: a session identifier that keeps you logged in. It is
marked HttpOnly (JavaScript can't read it),
Secure (only sent over HTTPS), and
SameSite=Lax (not sent on cross-site requests). It contains a
random token, not your identity.
We set no advertising, analytics, or tracking cookies. If that ever changes, we'll update this policy and ask for consent where the law requires it.
How we use your data
- To create and operate your account.
- To display leaderboards, profiles, and achievements.
- To maintain the integrity of the virtual currency economy.
- To detect, investigate, and prevent cheating, abuse, and unauthorized access.
- To respond when you contact us.
- To comply with a legal obligation if one arises.
We do not use your data for advertising, profiling, or automated decision-making that produces legal effects.
Who we share it with
We do not sell, rent, or trade your personal information.
We share it only in these situations:
- Our hosting provider — the Site runs on third-party infrastructure, which necessarily processes data in transit and at rest on our behalf.
- When legally required — in response to a valid legal request, or to protect our rights, safety, or property, or that of our users.
- If the Site is transferred — if operation of the Site passes to someone else, account data may transfer with it. We'd notify you first.
Publicly visible: your username, avatar, scores, badges, and leaderboard position. Your email address is never shown publicly.
How long we keep it
- Account data — while your account is open, and for a short period after closure to handle disputes or fraud.
- Currency transaction records — retained for accounting integrity, even after account closure, in a form disconnected from your identity where practical.
- Security logs — typically 12 months.
- Session records — deleted when they expire or when you log out.
Your choices and rights
Email admin@padplayer.com to:
- Access — get a copy of the data we hold about you.
- Correct — fix anything inaccurate.
- Delete — close your account and remove your data. Some transaction records may be retained in anonymized form for integrity.
- Object or restrict — tell us to stop a particular use.
We'll respond within 30 days. We may ask you to verify your identity first, so we don't hand your data to someone pretending to be you.
Depending on where you live, you may have additional rights under laws such as the GDPR or the California Consumer Privacy Act. We'll honor those rights where they apply.
Children
The Site is not directed at children under 13, and we don't knowingly collect data from them. If you believe a child under 13 has created an account, email admin@padplayer.com and we'll delete it.
Security
We take reasonable measures to protect your data: passwords are hashed with a modern algorithm and a server-side secret, sessions are stored server-side with only a random token in your cookie, all traffic is encrypted with HTTPS, database queries use parameter binding to prevent injection, and administrative actions are logged.
No system is perfectly secure. If we become aware of a breach affecting your data, we'll notify you and any required authorities as promptly as we can.
Changes to this policy
If we change this policy materially, we'll post the new version here with a new version number and effective date, and ask you to review it the next time you sign in.
Contact
PadPlayer
admin@padplayer.com