Create a game

Playloop

Privacy

How Playloop uses account, quiz, contribution and gameplay information, and how to manage your data.

Last updated 26 October 2026

Who is responsible

Playloop is run by OÜ ootakorra, a private limited company registered in Estonia (registry code 16545871, Suvila tn 21, Aruküla, Raasiku vald, 75201 Harju maakond, Estonia). OÜ ootakorra is the controller of the personal data described here. Contact us about privacy at [email protected].

Information we use

  • Account: an account identifier and, if you save an account, your email address and whether it is verified. Guests get an anonymous account identifier.
  • Games you make: titles, settings, rounds, questions, answer keys and uploaded images.
  • Playing together: player names, contributed questions, readiness, answers, scores and game history.
  • Connected apps: which AI assistants you have connected and the requests they send to Playloop.
  • Technical data: IP address, browser details and error records that our hosting providers create when your device talks to Playloop.
  • Anonymous usage counts, without cookies: until you accept analytics, or if you decline, we still count page views, clicks, steps such as signing in, creating, joining and finishing a game, and errors in the app, with your browser and device type. Nothing is stored on your device for this and the counts aren’t linked to your account. PostHog tells visits apart with an identifier it calculates from your IP address and browser details using a key that changes every day, so the same person can’t be followed from one day to the next. The IP address itself isn’t stored or used to estimate your location.
  • Usage analytics, only if you accept: the pages you visit on tryplayloop.com and in the app, the site you came from, the links and buttons you click, how far you scroll, steps such as signing in, creating, joining and finishing a game, errors in the app, and your browser, device type and approximate location. If you’re signed in, these are linked to your account identifier, never to your email address or name. Analytics never include question text or answers.

Why we use it

To provide Playloop. We need your account and game information to sign you in, run games, deliver invitations, show results and keep replays. The legal basis is performance of our contract with you (GDPR Article 6(1)(b)).

To keep Playloop secure. We use technical data and limited records to prevent abuse, enforce game limits and fix faults. The legal basis is our legitimate interest in a safe, working service (Article 6(1)(f)). You can object to this processing; contact us.

To improve Playloop. Usage analytics show us which pages and steps help people start and finish games, and where they get stuck. Analytics with cookies, linked across visits and to your account, are collected only after you accept in the cookie banner; the legal basis is your consent (Article 6(1)(a)), which you can withdraw at any time in Cookie settings. Declining doesn’t limit anything you can do in Playloop. Anonymous usage counts without cookies are based on our legitimate interest in knowing where people get stuck (Article 6(1)(f)); they store nothing on your device and can’t follow you across days. You can object to them; contact us.

To meet legal obligations. We keep or share information when the law requires it (Article 6(1)(c)).

Playloop has no advertising and doesn’t share data with advertisers. We don’t sell personal data and we don’t make automated decisions that have legal or similarly significant effects on you.

What your group can see

Invitations show the game title, host player name and joining conditions. In a lobby, the group can see player names, readiness and contribution counts. Private question drafts remain visible to their author; the host and connected AI assistant cannot read other players’ secret contributions. Questions and answers are revealed according to the game’s phase. Completed games stay available to the group for results and replays.

Connected AI assistants

When you connect Playloop to ChatGPT or another MCP client, Playloop receives the authorized tool requests and quiz content the assistant sends. The connection can read your own prepared rounds, create new game lobbies and edit their prepared content. It cannot read other players’ secret contributions or play on your behalf. Tool results return to the connected client. The assistant’s provider, such as OpenAI, handles your conversations under its own policies as a separate controller; connecting Playloop does not give us your chat history.

Service providers and transfers

We use these providers to run Playloop. They process data on our behalf and only to provide their services:

  • Supabase: sign-in, database, image storage, realtime updates and the API. Our database is hosted in Stockholm, Sweden.
  • Cloudflare: website hosting, network and security services, and sign-in email delivery.
  • PostHog: usage analytics and app error reports: anonymous counts without cookies, and with cookies only if you accept analytics. PostHog stores this data in its EU cloud in Frankfurt, Germany.

These providers are based in the United States and may process data outside the European Economic Area, including through Cloudflare’s global network. Where they do, the transfer is protected by the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep information

  • Accounts: until you delete your account.
  • Games: games and completed games stay available for the group’s history and replays. They are not deleted on a timer. A host can delete a game that hasn’t been played.
  • Unused images: uploads that aren’t attached to a question are deleted automatically after about 24 hours.
  • Codes: sign-in codes expire after 10 minutes. Invitation codes stop working after 24 hours or when the host replaces them.
  • Analytics: we can analyze events from the past year; older events drop out of reach under our current PostHog plan. Ask us to delete your analytics data at any time.
  • Logs: our providers keep operational logs for a short time, currently no longer than 14 days. Playloop doesn’t write question text, answers, email addresses, codes or tokens to its logs.
  • Backups: deleted information can remain in automatic database backups for up to 7 days, until those backups expire.

Deleting your account

Delete your account in Account settings. Your access ends immediately and connected apps lose access. We delete your email address and sign-in identity, your unplayed games, your drafts and your unfinished contributions.

Completed games belong to everyone who played them, so they stay available to the other players. In those games your name is replaced with “Former player” and your account is no longer linked. We keep a minimal record of the deletion, an internal identifier and a time, so that old sessions can’t be used again. Image cleanup finishes in the background. We can’t recall copies other people have already downloaded.

Cookies and browser storage

Playloop stores your sign-in session, your player name, display preferences and unfinished edits in your browser’s local and session storage. They are needed for the service to work, so we don’t ask for consent.

Analytics cookies are set only after you accept. Until then, and if you decline, analytics run without cookies or any other browser storage. The cookies apply to tryplayloop.com and its subdomains, such as app.tryplayloop.com, so one answer covers the website and the app:

  • ph_…_posthog: a random visitor identifier and the current visit, so pages and steps can be counted per visitor. Set only if you accept; kept for up to one year and removed if you later decline.
  • __ph_opt_in_out_…: remembers whether you accepted or declined, so we don’t ask again. Kept for up to one year.

You can change your answer at any time in Cookie settings at the bottom of every page.

Children

Playloop is not aimed at children. You must be at least 13 to create an account. Younger players should only join a game run by a parent, guardian, teacher or another responsible adult. If you think a child under 13 has given us personal data without that supervision, contact us and we will delete it.

Your rights

You can ask to access, correct or delete your personal data, to restrict or object to its use, and to receive data you gave us in a portable format. Email [email protected], from the address on your account where possible, and we will reply within one month. Never send a password or sign-in code.

You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or to the data protection authority where you live or work.

Changes

We update this notice when our practices change and show the date at the top. For significant changes we will tell you in Playloop before they apply.