Privacy Policy
1. Who we are
Play by Mail ("we", "us", "our") is operated by Alien Spaces, an Australian sole-trader business (ABN 13 996 366 428) established in Coburg North VIC 3058, Australia, with postal address PO Box 4003, Gilberton VIC 3072, Australia. Alien Spaces is the data controller for personal data processed through the Service. See the Imprint for full operator details and contact channels.
Privacy contact: privacy@playbymail.games.
2. What data we process and why
We process only what we need to operate a play-by-mail service. In plain terms:
- Account basics — email address, optional display name, locale preference, authentication tokens. When you sign in with Google, we receive only your email address from Google to identify your account; we do not request or store your Google profile name, photo, or any other Google data. Lawful basis: performance of the contract with you (GDPR Art. 6(1)(b)).
- Game artefacts — turn sheets you submit, characters you create, factions you command, images you upload, feedback you write. Lawful basis: contract (Art. 6(1)(b)).
- Subscription and billing metadata — when paid subscriptions are offered: subscription type, active games, renewal status. We do not store card data; payment processing will be handled by a third-party payment processor disclosed in the Sub-processors list at the time paid subscriptions go live. Lawful basis: contract.
- Transactional email — verification emails, turn-sheet delivery notifications, account-security messages, and email-preference confirmations. Lawful basis: performance of the contract (Art. 6(1)(b)) for messages your account requires, and our legitimate interest (Art. 6(1)(f)) in confirming the consent choices you make. Transactional email is not opt-in / opt-out; it is part of the Service.
- Marketing email — open-game announcements and product updates. We only send these when you have explicitly opted in (at first login, on Account → Notifications, or via the Privacy tab). Lawful basis: consent (Art. 6(1)(a)). Every opt-in is recorded against the privacy-policy version you saw at the time you consented. We send a confirmation email each time you opt in; that email and every later marketing message includes a one-click unsubscribe link (RFC 8058) so you can withdraw consent without logging in. You can also withdraw consent from Account → Notifications or Account → Privacy at any time.
- Server and application logs — in non-development environments these are redacted to remove full email addresses and authentication tokens (hashed email + truncated token are kept for correlation). Lawful basis: legitimate interest in operating and securing the Service (Art. 6(1)(f)).
- Consent and acceptance records — which version of which policy you accepted and when. Lawful basis: compliance with Art. 7(1).
We do not use your game content for advertising, and we do not sell personal data to anyone.
3. AI-assisted turn-sheet scanning
We use AI vision and text models to extract handwritten player orders from scanned turn sheets and convert them into structured game actions. This is central to how a play-by-mail service that accepts paper orders works.
- Images and the extracted text are sent to our AI sub-processor (currently OpenAI; see the Sub-processors list). We send only the image and minimal context needed for the scan.
- We do not use your content to train any third-party model. The API terms of our AI sub-processor prohibit training on content submitted through the API.
- A Data Protection Impact Assessment (DPIA) covering this activity is being prepared and will be summarised in this document once complete.
4. International transfers
Alien Spaces is established in Australia. Your personal data is therefore transferred from wherever you access the Service to Australia for storage and processing. Australia does not currently benefit from an EU adequacy decision. For data subjects resident in the EU, EEA, or United Kingdom, we rely on the explicit-consent transfer basis in GDPR Article 49(1)(a) / UK GDPR Article 49(1)(a): by creating an account with an Australian operator whose establishment is clearly disclosed in the Imprint and this Policy, you consent to the transfer of your personal data to Australia for the purposes described above. You may withdraw that consent at any time by deleting your account (see the Retention section for what happens next).
Onward transfers from Alien Spaces to sub-processors located outside Australia (for example to OpenAI or Heroku in the United States) are protected by the sub-processor's Standard Contractual Clauses and, where applicable, their EU-US Data Privacy Framework certification. Current mechanisms per sub-processor are listed in the Sub-processors document.
5. Retention
Retention windows apply to live systems. Database backups are rotated on a continuous-backup window (see the "Backups" row below); erasure requests complete on live data immediately, and backup rotation then naturally retires the remaining copies.
| Data category | Retention |
|---|---|
| Active account data | Retained while your account remains active. |
| Account deletion — grace period | 30 days from deletion request. You can cancel the deletion during this window; afterwards the account and its directly associated records are erased from live systems. |
| Unverified accounts | Automatically deleted 30 days after creation if the account has not completed email verification. |
| Game artefacts in completed games | Retained for 24 months after the game instance completes, so co-players can refer back to the completed game. After 24 months the artefacts are archived in a form that does not link to identifiable accounts. |
| Subscription and billing metadata | Retained for 7 years, as required by Australian taxation record-keeping rules. Only metadata (what was purchased, when, for how much) is retained — no card data is held by us at any point. |
| Application and server logs | Rotated on a rolling 14-day window. In non-development environments logs are redacted of full email addresses and authentication tokens at write time. |
| Consent and acceptance records | Retained for the life of the account plus 6 years after account closure, in line with the limitation period for civil claims in Victoria, Australia. |
| Database backups | Continuous backup window of up to 35 days (the Heroku Postgres window for our current tier). Backups are not hand-edited; already-erased data naturally rotates out of backups within this window. |
6. Your rights
Under the GDPR and UK GDPR you have the right to:
- access the personal data we hold about you (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased, subject to our legal obligations (Art. 17);
- receive a machine-readable export of your data (Art. 20);
- object to certain processing (Art. 21);
- lodge a complaint with your local supervisory authority (see Imprint).
You can exercise the access (Art. 15), portability (Art. 20), and erasure (Art. 17) rights yourself from Account → Privacy inside the application. From there you can:
- Download my data — receive a machine-readable JSON bundle of every personal-data category we hold about you, including the full content of every legal document you have accepted.
- Delete my account — permanently erase your account, vacate every game seat you currently hold, and remove your personal data from our active database.
If you cannot use the in-app controls — for example, because you have lost access to the email address on file — write to us at privacy@playbymail.games. We respond to all requests within one calendar month, extendable to three months for complex requests with written notice. After your account is deleted, your data may persist in encrypted database backups for up to 30 days before it is fully overwritten on the normal rotation; after that point your data is no longer present in any system we operate.
When you leave a game or delete your account, co-players' own turn sheets that may incidentally reference your in-game character name are not edited — they are the co-player's own submitted content, and we are not permitted to modify it. Once your account is erased, those references cannot be re-linked to you as a natural person. If you become aware of a specific reference you would like reviewed, contact privacy@playbymail.games.
7. Security
- Session tokens are HMAC-hashed in the database with sliding 15-minute expiry.
- Passwords are not used; authentication is passwordless via short-lived email verification codes, or optionally via Google Sign-In (OAuth 2.0). When you use Google Sign-In, authentication is delegated to Google; we verify the identity token server-side using Google's public keys and never store your Google credentials.
- Logs in non-development environments are redacted of full emails and authentication tokens.
- Access by managers and designers to player-identifiable data is limited to what is operationally necessary and is subject to audit logging.
8. Children
The Service is intended for adults. We do not knowingly collect data from children under 16. If you believe a child has created an account, contact privacy@playbymail.games and we will remove it.
9. Changes to this policy
Material changes to this policy trigger a re-consent flow on your next login. The version you accepted and the date you accepted it are recorded and returned in any data-access response. Historical versions remain available at their original document IDs through the document store.
10. Governance and transparency
This policy is authored as Markdown in the project's source repository. Every change is tracked as a source-control commit and is visible in the document's history through the document store. GitHub (source-code mirror) and GitLab (primary host) are consequently listed as sub-processors for the document authoring workflow, even though they do not handle end-user personal data.