Privacy Notice

Data Fiduciary

The Data Fiduciary for PlayTill is Puneet Naliath, an individual. Puneet Naliath is also the grievance contact for this service.

Use the Data Rights form on this page to reach Puneet Naliathfor access, correction, erasure, withdrawal of consent, nomination, or a grievance. PlayTill will reply using the contact details you provide in that form. This project does not publish a separate contact email, postal address, or phone number.

Personal data we process

PlayTill does not create user accounts and does not ask for a legal name, phone number, or payment details. The service may process:

• A short display name you type to join a room
• A random, room-scoped player identity stored on your device so a refresh can reclaim the same seat
• The last room code on your device, used only to resume that seat
• Game session data: scores, team, host status, and last-seen time
• Game inputs (taps, steering, dice) tied to your player identity for that room
• Data rights requests you submit, including the contact email you give so we can reply
• Technical request data created by hosting the site, such as IP address and user-agent, in platform logs
• On the /play controller, WebRTC signaling data through PeerJS, which may expose network addresses to the signaling service and to other devices in the same room

Purpose and lawful basis

We process this data to run a shared-screen game: admit you to a room, show your name on the venue screen, keep your seat if the phone refreshes, score the round, and handle host controls. Join and rights-request processing is based on your consent, which is not pre-ticked. You can withdraw consent at any time through the form below. Essential device storage is needed for gameplay. Optional diagnostics load only if you opt in under Privacy settings.

Named Data Processors

• Vercel Inc.. Website hosting, serverless functions, and platform request logs.
• Upstash Inc.. Redis-compatible room and session storage used through Vercel KV.
• PeerJS (0.peerjs.com). WebRTC signaling for the /play phone controller. Devices in the same room may see each other's network addresses.

Children’s data

PlayTill is a venue game, not a service directed at children. We do not knowingly collect a child’s legal name, contact details, or location, and we do not track or advertise to children. Anyone joining must confirm they are 18 years of age or older, or that a parent or guardian is giving consent. Hosts should not enter a child’s official identity documents or contact information. If you believe we hold a child’s personal data without valid consent, use the erasure request below.

Retention

• Room and player session data in Redis or Vercel KV expire two hours after the last write.
• In local development without Redis, room data lasts only for the running process.
• Device identity and saved display name stay in your browser until you leave the room or clear site data.
• Data rights requests are kept up to 90 days so they can be handled, then deleted.
• Hosting logs follow the Vercel platform retention period.

Your rights

Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, you may:

• Access a summary of the personal data we hold about you
• Correct inaccurate or incomplete personal data
• Request erasure of personal data that is no longer needed for the stated purpose
• Withdraw consent, which will stop further processing that relied on that consent
• Nominate another person to exercise these rights in the event of your death or incapacity
• Lodge a grievance with the Data Fiduciary using the form below
• Complain to the Data Protection Board of India if you are not satisfied with the outcome of a grievance

Breach notice

If a personal data breach is likely to affect you, PlayTill will notify affected Data Principals and the Data Protection Board of India as required by the DPDP Act, 2023 and the DPDP Rules, 2025.

Data rights request

Submit a request to Puneet Naliath. Do not include extra personal data that we do not need to find your session.