Privacy Policy

Last updated: October 25, 2026

1. Who we are

Playlog is developed by Cansu Özdemir ("we", "us"). This policy covers both the Playlog mobile app and this website. For any privacy question or to exercise the rights described below, contact cansuozdemir.studio@gmail.com.

2. Information we collect

Account information: email address, password (stored hashed by our authentication provider — we never see it in plain text), username, and date of birth (collected once, used only to confirm you meet the minimum age requirement).

If you sign in with Google or Apple instead, we receive the name and email address those providers share with us.

Profile information: an optional avatar photo you upload, your selected favorite genres, your level/XP (calculated from your activity), and your notification and spoiler-visibility preferences.

Content you create: game logs (status, rating, written reviews), your wishlist, favorites, and who you follow/who follows you.

Connected gaming accounts (only if you choose to connect one): your Steam ID, PlayStation account ID, Xbox gamertag, or GOG account identifier, together with your owned-games list, playtime (where the platform provides it), and public wishlist (Steam only). The access tokens needed to keep this synced are stored encrypted and are never shared with other users.

Account security data: if you enable two-factor authentication, we store a hashed (not plain-text) verification code temporarily and a random identifier for devices you mark as trusted, so we don't ask for a code again on that device.

Device data: a push-notification token (if you allow notifications), so we can deliver alerts like "a friend logged a game."

Website contact form: if you send us a message through the form on this website, we store the name, email address and message you type, so we can read it and reply. Nothing else about your visit is recorded, and we don't use these messages for anything other than answering you. To stop the form being flooded we also keep a one-way, salted hash of your IP address for one hour, purely to count recent submissions. The address itself is never stored and the hash cannot be turned back into it; the hourly record is deleted automatically.

Technical/crash data: if crash reporting is active, our error-monitoring tool may automatically record a crash report (stack trace, app version) to help us fix bugs. It is configured not to include your email address or IP address by default.

3. What we use it for

Operating your account and the core features you use (logging games, showing your activity to people who follow you, syncing your connected gaming libraries); keeping your account secure (two-factor codes, security notices); sending notifications you've opted into; fixing bugs (crash reports); and enforcing these Terms.

We do not use your data for advertising, and we do not sell your personal information to anyone.

4. Who we share it with

We share data with the service providers that run Playlog's infrastructure, strictly to the extent needed to provide the app:

• Supabase — hosts our database, authentication, and file storage.
• Resend — delivers the emails the app has to send you: the address-confirmation link when you register, password-reset links, sign-in verification codes and security notices. It receives the recipient's email address and the text of that message, and nothing else. These are transactional messages only; we don't send marketing email.
• Sentry — crash/error reporting (when active), configured not to receive your email or IP by default.
• The gaming platforms you choose to connect (Steam, PlayStation Network, Xbox/Microsoft, GOG) — only to exchange the data described in Section 2, and only after you initiate the connection.
• IGDB (Twitch Interactive) — we query IGDB for game data (titles, covers, descriptions); we don't send it your personal information, only search terms for games you look up.
• Have I Been Pwned — when you choose a password in the app, we check whether it appears in known public data breaches. Your password is never sent: only the first five characters of its SHA-1 hash leave your device, and the match is performed locally. The service cannot tell which password was checked, and we store nothing from this check.

We may also disclose information if required by law, or to protect the rights, safety, or property of Playlog or its users.

5. Public information

Your username, avatar, level, selected genres, and any reviews or ratings you post (unless the specific piece of content is private in a feature that offers that option) are visible to other Playlog users — this is how the social features of the app work.

6. Data retention and deletion

You can delete your account at any time from Profile → Edit Profile → Delete Account. This is immediate and permanent: your profile, logs, reviews, follows, notifications, connected-account data, and uploaded avatar are deleted right away and cannot be recovered. We don't keep a "soft-deleted" copy after this point.

Messages sent through the website contact form are kept only as long as needed to deal with your enquiry, and are not linked to any Playlog account. Email us to have one deleted sooner.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, or export your data, and to object to or restrict certain processing. You can access and edit most of this directly in the app (Profile → Edit Profile), and delete everything from Profile → Edit Profile → Delete Account. There is no automated export yet, so for a copy of your data — or any other request — email us at cansuozdemir.studio@gmail.com and we'll handle it.

If you are in Türkiye, you have the rights listed under Article 11 of the Personal Data Protection Law No. 6698 (KVKK) — see the Turkish-language version of this policy for the full KVKK disclosure.

If you are in the European Economic Area or UK, you have rights under the GDPR, including the right to lodge a complaint with your local data protection authority.

8. Children's privacy

Playlog is not directed at children under 13, and we don't knowingly collect personal information from anyone under that age. If you believe a child has created an account, contact us and we will delete it.

9. Security

We use industry-standard practices to protect your data, including row-level database access controls (so users can only read or modify data they're authorized to) and encryption of the access tokens used to sync your connected gaming accounts. No method of transmission or storage is 100% secure, but we work to protect your information appropriately.

10. International data

Our infrastructure providers may process data outside your country of residence. Wherever your data is processed, we require our providers to protect it consistently with this Policy.

11. Changes to this Policy

We may update this Privacy Policy as the app changes. If we make a material change, we'll make a reasonable effort to let you know in-app before it takes effect.

12. Contact

Questions, requests, or concerns about your data: cansuozdemir.studio@gmail.com.