Privacy Policy

1. Information we receive

Account and sign-in information: account identifiers, name, email address, avatar, sign-in provider identifiers and session records. If you sign in with Apple or Google, we receive the information that provider makes available with your authorization; Playable does not receive your Apple or Google password.

Creation content: messages, prompts, attached images, documents, audio and video, reference artwork, project history, selected style references, generated text and assets, source code, previews, and collaboration settings. Relevant previous work and references within a project may be used to continue that project across chats. Game preview screenshots may be captured for previews, playtesting and diagnostics; this concerns the displayed game or preview content, rather than a continuous recording of the entire phone.

Play and social activity: works you open, choices, saves, scores, progress, room membership, team membership, answers, invitations and other interactions required by the experience. Some reading progress and preferences are stored only on your device; other game, room and account records are stored on our servers. Not all progress is synchronized across devices.

Tour data: location coordinates and accuracy when location features are enabled, checkpoint events, answers and any photos or recordings you submit for a challenge. When live room location sharing is enabled, organizers with access to that room may see your location. The app's current live-sharing feature operates while it is active in the foreground; it is separate from submitting a checkpoint or photo answer.

Payment and technical information: order identifiers, purchase amount and currency, status, plan and credit or usage records; IP address, request and error logs, device or operating-system information, language, and service events needed for delivery, troubleshooting and security. Payment details entered in an external checkout are handled by that payment provider. If notifications are enabled, we process the device push token, platform, app identifier and language to deliver them.

2. Why we process information

We use the information needed to authenticate you, maintain accounts and projects, respond to AI requests, generate and deliver assets, operate games and rooms, save supported progress, publish the content you choose, provide requested notifications, process purchases, answer support requests, investigate errors and protect the service from abuse.

The legal basis depends on the processing and the law that applies to you: providing a requested service or performing a contract, your consent where required, compliance with legal obligations, or permitted legitimate interests such as service security and reliability. Where consent is required, it must be obtained separately; this policy is a notice, not blanket consent to every possible use of your data.

3. AI generation and processing services

When you request an AI response or generation, your prompt, the relevant conversation or project context, and selected files may be transmitted to the model or processing services needed for that task. This can include text models, image and character generation, speech recognition, speech synthesis, music generation, and remote rendering or preview services. AppotaHub coordinates these requests and the associated project records.

The model host and processing provider can vary by the creator model, generation tool and service configuration. Provider retention and any use of inputs for model training depend on the provider's terms and the service configuration. Contact us for the provider and processing details relevant to a particular feature or request before supplying sensitive material. Do not submit secrets or third-party personal data you are not authorized to disclose.

4. Who may receive information

Our service providers receive the information needed for their role, including hosting, storage, content delivery, AI processing, rendering, support, security, sign-in, payments and notifications. The service uses Railway and Cloudflare for infrastructure and delivery; Apple and Google may process sign-in, notification or platform data; AppotaPay processes purchases made through its checkout. Native map services may process map and location requests under their own policies.

Collaborators can access the project material shared with them. Room members and organizers may see the profile, participation, answers, scores and other activity exposed by that experience; authorized Tour organizers can see locations shared with the room. Publicly published works and shared file or export links can be accessible to other people, including anyone who receives a link. Do not assume an asset URL is a private storage boundary.

Authorized personnel may access information to operate the service, provide support or investigate abuse. We may disclose information when required by law, to protect lawful rights and safety, or as part of a business transfer subject to applicable safeguards and notice requirements. This policy does not authorize unrelated advertising uses of your uploads or contacts.

5. Permissions, notifications and local storage

Camera, photo or file access is used for the media you choose to attach or capture. Microphone or speech permissions support recording or speech features you invoke. Tour location features require location permission. You can refuse or revoke device permissions in system settings; the affected feature may then be unavailable. Enabling a permission does not itself publish your media.

You can disable push notifications in device settings and turn off Tour room location sharing through the room controls. Stopping location sharing does not erase checkpoint events or submissions already recorded. Selected media that you have submitted can remain part of a project or answer until removed under the applicable deletion process.

The app and sign-in services use local storage or cookies for sessions, preferences, cached content and supported on-device progress. These legal pages do not load advertising or analytics scripts, remote fonts or AI tools. Visiting them still creates normal network requests and infrastructure logs. Browser or device settings can clear local data, but clearing it does not delete server-held records.

6. Retention and security

Account, project and play records are retained for the period needed to provide the relevant service and handle legitimate operational or legal needs. When deletion is requested, associated personal data is deleted or de-identified unless a lawful retention reason applies, such as tax or transaction records, fraud prevention, security, or an unresolved legal claim. Any retained records should be limited to that purpose. Copies in backups or provider systems are subject to their applicable retention and deletion processes; there is no promise of immediate removal from every backup.

We use access controls and encrypted network connections to protect service data, but no storage or transmission system is risk-free. This is not a promise of end-to-end encryption for AI conversations or uploaded files. Avoid putting confidential material into a public work, shared asset or room, and protect access to your account and device.

7. Your rights and deletion requests

Depending on applicable law, you may request access, correction, deletion, a copy or portability of your personal data, restriction of processing, or object to certain processing. You can withdraw consent for consent-based processing, without affecting processing lawfully carried out before withdrawal, and raise a concern with the competent data-protection authority.

To request deletion of your Playable account and associated personal data, email [email protected] with the subject "Playable account deletion". Identify the email address or account used for Playable. For another privacy request, use the subject "Playable privacy request" and describe the request. Do not send your password, a sign-in token or payment credentials. We may need to verify control of the account before acting and will explain any lawful retention exception.

Signing out, clearing device storage or uninstalling the app does not itself request deletion of your server-held account or content, and account deletion does not automatically cancel a subscription billed through a separate provider. Public copies already obtained by other people may remain outside our control. Requests are handled under the timelines and requirements of applicable law.

8. International processing

APPOTA CORP is based in Vietnam. Service infrastructure and processing providers may operate in other countries, so information can be processed outside your country of residence. Applicable legal requirements for international transfers still apply. Contact us for information about the destinations and safeguards relevant to your request or feature.

9. Children and young people

Use of Playable must comply with local minimum-age, parental-consent and content-rating requirements. A child who cannot lawfully consent must not submit personal data without the legally required authorization of a parent or guardian. If you believe a child's data was submitted without the required authorization, contact us so we can investigate and handle removal as required by law. A content rating is not a substitute for legally required parental consent.

10. Policy updates

We will update the date when this policy changes and provide any notice or obtain any additional consent required for a material change. New processing that requires consent is not authorized merely by changing this page.