What this covers
This policy covers playset.pro and every game site in the Playset Network (palset.pro, synapset.pro, astraset.pro, chakraset.pro). One policy, maintained here; game sites link to this page rather than carrying copies.
What we collect
Browsing — reading any site in the network requires no account and sends us nothing beyond ordinary server logs: IP address, requested page, browser user-agent, and timestamp. Logs are used for security and capacity planning, retained briefly, and are not sold, shared, or used for advertising.
Analytics — game sites run Google Analytics 4, which sets cookies in your browser and reports page views, referrers and broad audience information to Google on our behalf. It starts on your first page view; we tell you it is running rather than asking permission first, and there is no on-site switch to refuse it. The Cookie Policy lists the cookies and the browser controls that do refuse it. This site, playset.pro, carries no analytics at all.
Accounts (Playset ID) — creating an account stores: your email address, a password hash (never the password), any further addresses you add, optional display name and avatar, and — if you sign in with Google or Discord — the identifier and email those providers share. Two-factor secrets and backup-code hashes are stored when you enable 2FA. Each active session is recorded with the IP address and browser user-agent it was created from, so you can see and end your own sessions.
Bot protection — the sign-in, sign-up, password-reset and email-resend
forms on account.playset.pro, and the report form on every game site, run
Cloudflare Turnstile, a challenge that tells a person from a script. Its
widget is loaded from challenges.cloudflare.com, so Cloudflare receives your
IP address, browser user-agent and signals about how the page was used, and may
set a short-lived cookie on its own domain to remember that you passed. We
receive only the pass/fail result — never the signals behind it. It is what
stands between these forms and someone guessing passwords at machine speed, so
it cannot be turned off; it is not used for analytics, profiling or advertising.
Your content — decks, collections, and preferences you save are stored against your account, per game.
Reports and corrections — the /report form on a game site is how you tell
us a card value is wrong, report a deck or a profile, or say a page is broken.
We keep what you wrote, what it was about, and — when you are signed in — which
account filed it, because a report’s history is what tells a real correction
from a campaign. A card correction can be filed signed out and is then stored
with no account attached. A broken-page report has an optional email field; if
you fill it in we keep the address so we can reply, and if you do not, we
cannot.
Messages — the addresses published on this site are the way to reach us, and there is no form in front of them. Mail you send to them arrives through our email provider and becomes a record on our side — your name, your address, and what you wrote — so we can answer and so there is a record of what was asked. Mail to the takedown address is filed separately as a legal record, and its attachments are copied into our own storage rather than left with the mail provider, because a claim needs its exhibits kept.
What we do not do
No advertising trackers. No advertising or personalisation features in Google Analytics. No sale or rental of personal data to anyone. No third-party scripts anywhere in the network beyond the two named above — the analytics tag on the game sites, and the Turnstile bot check on the forms that carry it. playset.pro itself carries neither, and loads nothing from a third-party origin at all.
Where data lives
On servers we operate in the United States, fronted by Cloudflare, which processes every request as our network provider, runs the bot check on the forms that use it, and also stores files for us: avatars, card and editorial media, our database backups, and evidence attached to takedown notices. Analytics data is processed by Google, which may process it outside your country. Our email provider both delivers our transactional mail — address verification, password reset, the alert sent when your password changes, and the receipt confirming an account was deleted — and receives the mail you send to our published addresses. All three may process data outside your country.
Your rights
You can export or delete your account and everything attached to it from the account settings, or by writing to [email protected]. The export is a single file containing your profile, your addresses, your sign-in methods, the games you have signed in to, your decks, your collection, your sessions and the corrections you have sent us.
Deletion is real: it removes your decks, collections, profile and reports, not just the login. Three things outlive it, and we would rather name them than let you find out:
- Your profile picture’s file. Deleting the account clears the picture from it, but the uploaded file itself stays in our storage. Nothing in the network sweeps it yet, and we are not going to describe that as done because it is not.
- Our backups. The database is dumped nightly and the last fourteen dumps are kept, so a deleted account persists in them until they age out.
- Analytics already reported to Google, which is not stored against your account and which we cannot look up by person. The browser controls in the Cookie Policy are what stop further collection.
A takedown notice you send us is a legal record and is kept as one; it is not attached to any account and is not removed by deleting one.
Contact
Privacy questions: [email protected].