This policy explains what data about you the Just Play Already service (Just Play on your phone) processes, why, where it is kept and how to delete it. We collect only what the service cannot work without: no advertising, no analytics, no selling of data.
1. Who is responsible for your data
The controller is Sergei Vilgodskii (Вильгодский Сергей Александрович), a private individual living in Cyprus. For any question about your data: justplayalreadyapp@gmail.com.
2. What we process
- An account key: the identifier Google or Apple sends when you sign in. We use it to recognise you next time. We do not ask for your name or picture.
- Your email, as Google or Apple sends it. We show it to you on the Account page but do not store it in our database: it lives only inside the encrypted session cookie on your device.
- Your library: your games, the devices you have them on, their statuses (backlog, playing, completed, dropped) and your ratings.
- Your answers before a recommendation (how much time you have, your mood, who you play with) and your reactions to the games we suggest.
- Your recommendation history and learned preference weights: numbers we compute from your reactions to pick games better.
- Your device profile: what you play on, if you filled it in.
- Acceptance records: when you confirmed you are 18 or older, and when and which version of the Terms of Use you accepted.
- Technical data: your IP address, the time and the address requested may reach the server logs. If the server fails on a request because of an error, a report on it goes to Sentry (section 6).
3. Where it comes from
- From you: you add games, answer questions and rate games.
- From Google or Apple when you sign in (the account key and the email).
- From Steam, if you import your library: we send the SteamID or profile link you enter to Valve’s Steam Web API and receive the list of your games. We do not keep the SteamID.
- From PlayStation, if you import your library: the list you paste is read inside your browser, and only the games in it reach us. A paste that looks like PlayStation sign-in data is refused and never sent.
- Information about games (titles, genres, covers) comes from the public IGDB and Steam catalogs. It is not personal data.
4. Why, and on what legal basis
- To run the service: keeping your library and recommending games. The basis is our contract with you, the Terms of Use (GDPR Art. 6(1)(b); Russian Federal Law 152-FZ Art. 6(1)(5)). The service cannot work without this data, so providing it is a requirement of the contract.
- To protect the service and to prove acceptance of the Terms: rate limiting, protection against abuse, server logs, error reports, database backups, acceptance records. The basis is our legitimate interest in running the service safely and in being able to show that you accepted the Terms (GDPR Art. 6(1)(f)).
We do not use your data for advertising or analytics, and we never sell it.
5. How games are picked
Recommendations are computed from your answers, your library and your history by fixed rules. No neural network takes part at the moment a game is picked. The recommendations have no legal or similarly significant effects on you. Details are in the Recommendation Rules.
6. Who receives data
- Our hosting provider, UpCloud (UpCloud Oy, Finland): the server runs and the database and its backups are kept in its data centre in Frankfurt am Main, Germany, on our behalf.
- Backblaze (Backblaze, Inc., USA) keeps, on our behalf, encrypted backups of the database in a data centre in the Netherlands. Only the operator holds the key to decrypt them; Backblaze does not.
- Sentry (Functional Software, Inc., USA; the data is stored in the EU, in Frankfurt am Main) receives, on our behalf, reports of our server’s errors: what happened, where in the code, the version of the service and the address requested, without its parameters. Your IP address, email, cookies and the content of your requests are not in the reports.
- Google and Apple, when you sign in through them. They are responsible for their own sign-in under their own terms.
- Valve (Steam): your SteamID, only when you start a Steam import yourself.
Each recipient gets only what its part of the work needs.
Our server fetches game covers from IGDB and Steam itself and shows them to you from our own address, so your browser does not contact those services.
7. Where data is kept
Our database is in the European Union: Frankfurt am Main, Germany. The information received from Steam is kept there too. Database backups are kept in Frankfurt am Main and in the Netherlands, and error reports in Frankfurt am Main too. Backblaze and Sentry are American companies, but they keep this data in the EU. A Steam import contacts Valve’s servers in the USA.
8. How long we keep it
- Everything tied to your account: for as long as the account exists.
- When you delete your account we delete everything at once: library, history, weights and acceptance records. The database backups keep this data until they themselves are deleted, at most 30 days later.
- Server logs are kept for at most 30 days.
- Database backups are deleted within 30 days.
- Error reports are kept in Sentry for at most 30 days.
9. Your rights
You may ask what data we hold about you, correct it, delete it, restrict its processing, object to processing based on legitimate interest, and receive your data in a machine-readable form. Most of this you can do yourself in the service (your library, your device profile, deleting your account). For anything else write to justplayalreadyapp@gmail.com: we answer within one month.
10. Complaints
If you believe we are breaching your rights, you may complain to the Commissioner for Personal Data Protection of Cyprus: Kypranoros 15, 1061 Nicosia, Cyprus; commissioner@dataprotection.gov.cy; www.gov.cy/dataprotection. In the EU you may also complain to the authority of your own country.
11. Deleting your account
- In the app or on the website, open Account → Delete account and confirm. If you have not accepted the Terms yet, use the consent screen: on a new account with nothing in it, “Decline” deletes it at once; on any other, the screen has the same “Delete account” button.
- Or write to justplayalreadyapp@gmail.com and give your account ID, shown on the Account page. We do not store your email, so we cannot find an account by it. We delete the account by hand and tell you when it is done.
- Everything is deleted: the account key, your library, ratings, recommendation history, preference weights, device profile and acceptance records. A deleted account cannot be restored. This data leaves the database backups when the backups themselves are deleted, at most 30 days later.
- If you signed in with Apple, Apple also keeps a link between your Apple ID and the service. You can remove it in your device’s settings: Settings → [your name] → Sign in with Apple → Just Play Already → Delete (Apple’s guide: support.apple.com/102571).
12. Cookies and browser storage
We use only the cookies the service cannot work without: to keep you signed in and to keep sign-in secure. That is why there is no cookie banner. There are no third-party cookies.
__Secure-authjs.session-tokenWhere: cookie. Lifetime: Up to 30 days; renewed while you use the service
Your sign-in session: an encrypted token holding your account id and the email Google or Apple sent
__Host-authjs.csrf-tokenWhere: cookie. Lifetime: Until you close the browser
Protects the sign-in form against forged requests
__Secure-authjs.callback-urlWhere: cookie. Lifetime: Until you close the browser
Where to return after signing in
__Secure-authjs.pkce.code_verifier, __Secure-authjs.stateWhere: cookie. Lifetime: 15 minutes
Protect the Google or Apple sign-in
__Secure-authjs.nonceWhere: cookie. Lifetime: Until you close the browser
Protects the Apple sign-in
__Secure-gs.app-handoff.verifier, __Host-gs.app-handoff.challengeWhere: cookie. Lifetime: 10 minutes
App only: hand the sign-in over from the system browser to the app
NEXT_LOCALEWhere: cookie. Lifetime: Until you close the browser
The interface language you chose
gs.nativeSignInStartedAtWhere: localStorage (browser storage). Lifetime: Removed when the sign-in ends; ignored after 10 minutes
App only: a note that a sign-in has started
13. Age
The service is for people aged 18 or older only. We do not knowingly process data about children.
14. How we protect data
Connections are encrypted (HTTPS), the session token is encrypted, everyone sees only their own data, and the rate of requests is limited for each user. The database backups at Backblaze are encrypted so that only the operator can decrypt them.
15. Changes to this policy
The version is shown at the top of this page. We will tell you about a material change the next time you use the service and ask you to accept the Terms again.
16. For users in Russia
This section adds what Russian Federal Law 152-FZ “On Personal Data” requires. Its Russian text is section 16 of the Russian version of this page (switch the language at the top of the page).
- Controller: Sergei Vilgodskii, email justplayalreadyapp@gmail.com.
- Actions performed with personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), retrieval, use, transfer (provision, access) within section 6, deletion and destruction. Processing is automated.
- Legal ground: our contract with you, the Terms of Use you accept by ticking the box on the consent screen (152-FZ Art. 6(1)(5)). No separate consent to processing is needed.
- Place of storage: Frankfurt am Main, Germany; backups: there and in the Netherlands.
- Your rights under 152-FZ Arts. 14–17: to receive information about the processing, to demand clarification, blocking or destruction of the data, to withdraw a consent where processing rests on one, and to appeal to Roskomnadzor or a court. Send requests to justplayalreadyapp@gmail.com.
- How recommendation technologies are used is described in the Recommendation Rules.