Last updated October 12, 2026
Privacy is one of the reasons PlayAgainst exists. We collect only what we need to run the platform, we don't sell your data, we don't show ads and we don't use tracking or analytics tools. This page explains what we store, why, and what you can do about it.
The controller responsible for processing your data under the GDPR is:
Pascal LinxweilerLangentalstr. 6266482 ZweibrückenGermany
For anything about your data, write to privacy@playagainst.xyz. More contact details are in our imprint.
When you sign up we store:
If you log in with Google, Apple or Discord, that service tells us your account ID there, your email address and, if you shared it, your name and profile picture. We only use this to log you in and suggest a username. Logging in there happens under that company's own privacy policy, and they learn that you use PlayAgainst. You can disconnect these accounts in your settings at any time.
If you add a passkey, we store only its public key, a name for it (like "Chrome on macOS") and when it was added and last used. Your fingerprint or face never leaves your device, and we can't use the public key to log in as you.
We need this to create your account, log you in and contact you about it. Legal basis: Art. 6 (1) (b) GDPR (providing the service you signed up for).
Everything on your profile beyond your username is optional: display name, full name, birthday, location, team, pronouns, biography, social accounts, profile picture and banner. You decide what to add.
In the Privacy tab of your profile settings you choose, field by field, who sees what: everyone, only logged-in members, or only you. Your location and birthday are visible to members only by default, and your birthday is not shown at all until you choose to show it. Your full name is private and only appears if you pick a display name that contains it.
Legal basis: Art. 6 (1) (b) GDPR. You can change or remove this information at any time.
Pictures you upload (profile picture, banners, logos, gallery photos, event banners) are checked automatically for nudity and sexual content before they appear. The check runs on our own servers; the pictures aren't sent to anyone else. A picture is either published, declined (and not stored), or held until someone from our team has looked at it. For declined and held pictures we keep what the picture was for, the outcome, the check's scores and when it happened; a held picture itself only until it's decided. A declined picture can always be replaced with another one, and on request a person looks at it.
When you report something, we store the report, what it's about, when you sent it, and your account or the email address you chose to leave. We don't tell the person you reported who you are unless the law requires it. If we remove something, its owner gets our reasons.
Legal basis: Art. 6(1)(c) GDPR together with Art. 16 and 17 of the Digital Services Act (handling reports and giving reasons), and Art. 6(1)(f) GDPR (our interest in keeping illegal and unsuitable content off PlayAgainst). We keep reports and check results for [retention period, e.g. 1 year after the decision]; pictures still waiting for a check are deleted with your account.
When you log in, our authentication system records your IP address, your browser (user agent) and the time, so we can keep sessions working and detect misuse of accounts. You can see and end these sessions yourself in your account settings.
If you turn on two-factor login, we store the key for your authenticator app and your backup codes. Backup codes are stored only as secure hashes that we cannot read.
Legal basis: Art. 6 (1) (f) GDPR. Our legitimate interest is keeping accounts and the platform secure. These records are kept for [retention period, e.g. 30 days].
Finding stores near you. If you type a postcode or city into the store search, it is used for that search and appears in the page address, so you can share or bookmark it. If you press “Near me”, your browser asks whether to share your location. If you allow it, your position is sent to our server once, turned into the nearest postcode and discarded; only that postcode is used from then on. We never save your position. The postcode is part of the page address, so like any address it can appear in the technical logs described above. Postcode data: GeoNames (geonames.org), CC BY 4.0.
We only send emails you need: confirming your address, resetting your password, confirmation codes and notices about important changes to your account, such as a scheduled deletion. We don't send newsletters or marketing emails.
Profiles are hidden from search engines by default. They only appear in Google and other search engines if you turn this on in your privacy settings. Turning it off again asks search engines to remove your profile, which can take a while on their side.
We don't sell or share your data. We use these providers, bound by data processing agreements under Art. 28 GDPR:
[Confirm: all data is processed within the EU/EEA.]
We keep your data as long as your account exists. You can end that at any time in your account settings:
We only keep data longer where the law requires us to.
Under the GDPR you have the right to:
You can do most of this yourself: edit your profile, download all your data from the Privacy tab, or delete your account. For anything else, write to privacy@playagainst.xyz or use our support page.
You also have the right to complain to a data protection supervisory authority (Art. 77), for example the one in the German state where you live or the one responsible for us: [competent supervisory authority].
When we change how we handle your data, we update this page and the date at the top. For significant changes we will also let you know by email.