Privacy policy

What we never receive

The app runs on your computer and keeps its data there. We do not receive your game login or password, your in-game account names, screenshots or screen captures, your run history, or anything about what happens inside the game. There is no telemetry upload. We could not hand this over or lose it in a breach, because we never have it.

What we do collect

Your account

Your email address, a hash of your password (never the password), and — if you use Google sign-in — the stable identifier Google gives us plus the address it asserts. Also when you signed up, the IP address you signed up from, and the timestamp of your ban-risk acknowledgement.

Your licence and devices

Your licence key, and for each computer you activate: a machine identifier derived from your hardware, when it activated, when it last checked in, and the app version and operating system it reports. The machine identifier is personal data — it is derived from your network hardware — and we keep it because it is how a per-device licence works at all.

Billing

Our payment processor handles your card; we never see the number. We keep your customer and subscription identifiers, what you paid and when, and invoice records we are required to retain for tax purposes.

Support and audit

Tickets you open and what you write in them. A log of sensitive actions on your own account — revealing your key, releasing a device, downloading a build — with the time and IP address, so that "I did not do that" is a question with an answer.

Why we are allowed to

To perform the contract you entered into (your account, licence and devices), to comply with law (tax records), and for our legitimate interest in preventing abuse of a free trial and in keeping the service working. We do not sell personal data, do not run advertising trackers, and do not share data with anyone beyond the processors below.

Who processes it

• Amazon Web Services — hosting and storage, United States.
• Cloudflare — DNS and site delivery.
• PayPal — payments and affiliate payouts.
• Resend and Amazon SES — transactional email.

How long we keep it

Account and licence data for as long as you have an account, then deleted within 90 days of closure. Invoices for as long as tax law requires. Audit records for two years.

Who holds it

The data controller is PlayingAFK, Yigal Alon St 94, Tel Aviv-Yafo, Israel. That is who decides what is collected and why, and who you are exercising the rights below against. Written questions go to [email protected].

Your rights

You can ask for a copy of your data, correction, or deletion, by writing to [email protected]. Deletion removes your account, licences, devices and machine identifiers; invoices are retained where the law requires it. If you are in the UK or EU you may also complain to your data protection authority.

Cookies

The marketing site sets none. The account portal sets one cookie to keep you signed in, one short-lived cookie during a Google sign-in, and — if you arrived through an affiliate link — one recording that referral for thirty days. There is no analytics or advertising cookie on either.