Privacy Policy

Version of 6 October 2026

In short: you can play without registering. We keep only what the game needs: your nickname, token, the moves of your games and the chat. We learn your e-mail only if you choose to sign in to an account — with Google or with a code sent by e-mail. Stars can be bought through the Polar payment service; we do not receive card details. The site has no ads and no third-party trackers, and we do not sell data. To delete your data, write to support@playpayda.com.

1. Who processes the data

The data operator is the Payda project, owner of the website playpayda.com ("we"). For any question about your data write to support@playpayda.com.

This document sets out the operator's policy on collecting, processing and protecting personal data and applies together with the Terms of Use.

2. What data we process

Data	When it appears	Why it is needed
Nickname, chosen token and dice	When you start playing	To show you to the other players at the table
Technical profile number and access key (the server keeps only its hash)	Created automatically the first time you enter a game	To recognise your browser and return you to your seat after a disconnect
Game data: rooms, moves, trades and their notes, chat messages, results	During a game	To run the game, show it to its players and restore it after a failure
E-mail address and Google account identifier, sign-in date, version and time of consent	Only if you sign in with Google	To keep your profile and stars across devices and to prove consent
E-mail address, sign-in date, version and time of consent; a one-time sign-in code (only its hash is kept, for no longer than a day)	Only if you sign in with a code sent by e-mail	To send the code, keep your profile and stars across devices and prove consent
Image for your token (256×256)	Only if you upload one yourself	To show it instead of a standard token to the players and spectators of your games
Star balance and history, unlocked cosmetics	For people signed in to an account	To run the in-game wallet
Star purchase records: order number, pack, amount and currency, payment and refund status	Only if you buy stars	To add stars, handle refunds and keep payment records
Results of your games: map, place, net worth, number of streets and turns, duration	At the end of each game	To show you your statistics and game history in your profile
Profile creation date and time of your last visit	Every time you use the site	To remove abandoned guest profiles
Game statistics: map, number of players, seats with their token and dice — without nicknames	At the start and end of a game	To understand how the site is played
Visit statistics: a random browser number (the server keeps only its hash), the number and time of the visit, the device type	When you open the site	To count visits; it is not linked to a profile
IP address	With every request	To limit request rates and protect against abuse. It is used in the server's memory and is not written to the database or the application log

From Google we receive only your e-mail address and account identifier. We do not request or receive your password, contacts, name or profile photo.

We do not collect identity documents, phone numbers, postal addresses, payment details or location data, and we do not use uploaded images to identify anyone. Payment for stars is taken by the Polar service: you enter your card details, the e-mail address for the receipt and the details needed to calculate tax on its page, and Polar processes them under its own privacy policy. We keep only the order and payment session numbers, the payment link, the pack, amount, currency and payment and refund status; card details and addresses from Polar's notifications are not stored.

Your nickname, chat messages and trade notes are seen by the other people in the game. Anything you say about yourself there is posted by your own decision and at your own responsibility; do not post information about other people.

3. What is stored in your browser

Local storage: the access key of your profile (guest or account), nickname, cosmetics, language, sound setting, and the random browser number used for visit statistics.
Tab storage: the access key, nickname, token and code of the current room, and technical marks of a Google sign-in.
One cookie, __Host-payda_oauth, only while you sign in with Google and for no longer than 10 minutes. It protects the sign-in from being hijacked.

There are no advertising or third-party cookies. If you clear the site data in your browser, access to the guest profile is lost.

4. Grounds for processing

Your consent: you give it when you start a game, and with a separate tick box when you sign in to an account (section 11).
Necessity for the service you use: a game is impossible without a nickname, a profile and game data.
Protection of the site and its players: countering abuse and de-identified visit statistics.

We do not sell data, show ads or make automated decisions about you.

Other players and spectators in your room see your nickname, token or uploaded image, your moves, trades and chat messages. Anyone who has the room code or link can become a spectator. Team chat is seen only by the team.
The nickname of a room's creator is visible to everyone who has the link to it, and in the list of open games to every visitor together with the token.
Oracle — hosting: the site and the database run on its servers.
Google — only if you sign in with Google: the sign-in takes place on Google's side under its own rules.
Polar — the payment service and seller of stars: only if you buy stars, it receives the technical number of your profile so that the stars reach the right account.
Resend — an e-mail delivery service: only if you sign in with a code by e-mail, it receives your e-mail address and the message with the code.
Cloudflare — serves the domain name and forwards mail sent to support@playpayda.com to the operator's mailbox.
Public authorities — only on a lawful request.

6. Cross-border transfer of data

Cross-border transfer of data takes place: the site and the database run on the servers of Oracle, an international hosting provider, sign-in codes are sent by Resend, an international e-mail delivery service, and payment for stars is taken by Polar, an international payment service. By using the site, and by giving consent when you sign in to an account, you agree to this transfer.

7. How long the data is kept

A guest profile that never sat down at a table is deleted after 30 days of inactivity.
Other profiles are kept while the site operates, until you ask us to delete them, or until we delete them under the Terms of Use.
The detailed move log and the chat are deleted 30 days after a game ends, and for a closed or abandoned room after 30 days without activity.
The results of your games for your profile are kept while the profile exists and are deleted with it.
Star purchase records are kept after a profile is deleted, without the nickname or e-mail, for as long as they are needed for payment records, refunds and disputes about them.
The final state of a game (players' nicknames, trades and their notes, the result) and game statistics without nicknames are kept while the site operates; when a profile is deleted, your name and notes are removed from them.
Visit statistics — about 90 days.
Database backups — no longer than 30 days.
The application log contains no nicknames, e-mail, chat text or IP addresses; it contains technical profile and room numbers. When a connection fails, the web server log records details of the request (page address, browser type) without the IP address or the access key. The logs are overwritten automatically.

8. Your rights

At any time you can:

find out what data about you is stored and get a copy;
correct your nickname and cosmetics — right in the game;
demand that your profile and data be deleted;
withdraw your consent to processing.

Write to support@playpayda.com. If you signed in with Google or with a code by e-mail, write from that same e-mail address. For a guest profile, give the nickname, the room code and the approximate time of the game so that we can find the right profile. So that no one else can obtain or delete your data, we may ask you to confirm that the profile is yours. Until that is confirmed we do not disclose, change or delete data, and within the time limit below we tell you what information is missing.

We reply within three working days. We delete or correct data within one working day after we are satisfied that the request comes from the owner of the profile. Data disappears from backups as they are replaced, within 30 days at most. Your name, chat and trade notes are also removed from games already played; the games themselves stay available to their players without your name. An uploaded image is deleted from the server; copies already saved on other people's devices are beyond our control.

If you believe your rights have been violated, you can contact the personal data protection authority of the Republic of Kazakhstan.

9. Children

The site is not intended for children under 13. If you are under 18, use the site with the permission of your parents or other legal guardians; signing in to an account and uploading an image is allowed only with their consent. If a child has given us data without such consent, write to us and we will delete it.

10. How we protect the data

We apply technical and organisational safeguards:

all data exchanged with the site is encrypted (HTTPS);
access keys are stored in the database only as hashes: a hash cannot be used to sign in;
the site has no passwords: sign-in takes place on Google's side or with a one-time code that works for 10 minutes, allows five attempts and is stored only as a hash;
the application and the web server are configured not to write IP addresses to the database or the logs;
only the operator has administrative access to the server and the database, and it is exercised with a cryptographic key;
request rates are limited, which protects against guessing and overload;
the site has no ads and no third-party trackers; it loads no code from other servers, and its content security policy forbids that;
backups are made daily and kept for a limited time.

Security also depends on you: do not let others use your browser, your e-mail or your Google account. If an incident affects your data, we will notify the authority and you in the cases and manner the law requires.

By starting a game as a guest you consent to the processing of the data in section 2 other than the account data. By ticking the consent box before signing in with Google or with a code by e-mail you confirm the following.

Operator: the Payda project, playpayda.com, support@playpayda.com.
Who gives consent: the owner of the Google account or e-mail address used to sign in.
List of data: e-mail address; Google account identifier, when signing in with Google; nickname; token and cosmetics; uploaded image, if any; data about games, their results, trades and chat messages; star balance and history; star purchase records, if any; the date, time and version of this consent.
Purposes: signing in, keeping the profile and stars across devices, adding purchased stars and handling refunds, running games, protection against abuse, replying to requests.
Term: until the profile is deleted or consent is withdrawn.
Transfer to third parties: to the hosting provider Oracle for storage; to the e-mail service Resend — the e-mail address to send the code, if you sign in with a code; to the payment service Polar — the technical profile number, if you buy stars; other players see the nickname, token or image, moves and messages.
Cross-border transfer: yes — to the hosting provider Oracle, the e-mail service Resend and the payment service Polar (section 6).
Public sources: the e-mail address is not published; the nickname and token are visible to other players and in the list of open games.
Withdrawal: by writing to support@playpayda.com; after withdrawal the profile and the data linked to it are deleted.

We keep the date, time and version of the consent so that we can prove it was given.

12. Changes to this policy

A new version takes effect when it is published on the site; its date is at the top of the document. If the consent wording changes, we will ask you to confirm it again the next time you sign in to an account.

The document is available in Russian, Kazakh and English. If the versions differ, the Russian version applies.