Privacy Policy

Who we are

Service: Ditto's Playground
Website: https://dittosplayground.com
Contact: contact@joinity.site

Ditto's Playground is a non-profit fan project with no ads, no purchases and no monetization. For fans, by fans. All rights to The Pokémon Company.

Information we process

1) Playing as a guest

You can play without an account. Your trainer name and settings stay in your browser. While you are in a room or a match, our game servers receive your trainer name and your in-game actions to run it. Nothing about a guest is saved once the room closes.

2) Accounts

If you create an account, we store:

• your trainer name and your password, only as a salted one-way hash (scrypt) that we cannot read back
• your Discord name, only if you give one (used to help you if you forget your password)
• when you joined and when you last played
• your wins and games per game, your gold, rank and avatar
• your collection: Pokédex, caught Pokémon, Poké Balls, tickets, Adventure partners with their levels, and gym badges
• a role and a ban flag, used for moderation

We do not ask for an email address, your real name or your age.

3) Log-in sessions

When you log in, your browser keeps a random log-in token. We store only a hash of it, so we can recognise your browser. A session ends when you log out and expires after 90 days without use.

4) Game results and betting rooms

After each match we store a short receipt (the gold paid and whether you won) so a reward is never paid twice. Receipts are deleted after 14 days. Gold staked in a betting room is recorded until the room pays out, and the record is deleted 30 days later.

5) Leaderboards

Your trainer name, avatar, wins and rank are shown on the public leaderboards and to other players in rooms.

6) Room chat

Messages you type in a room's chat are sent to the players in that room. They are held in the server's memory only while the room exists and are never saved.

7) Local browser storage

The games use your browser's local storage for your trainer name, settings (sound, controls, camera), your picked Pokémon, your log-in token, reconnecting to a running match, and which news you have already seen. It never leaves your browser except the log-in token, which is sent to log you in. We use no cookies, no analytics, no tracking and no ads.

8) Technical and security data

Like every website, our servers see your IP address. We use it in memory to limit log-in and sign-up attempts and to stop abuse; it is not stored with your account. Our hosting providers keep standard web server logs for operation and security.

How we use information

1. To run the games, rooms and matches.
2. To provide accounts, progression, collections and leaderboards.
3. To secure log-ins and prevent cheating, spam and abuse.
4. To moderate (for example renaming or banning accounts that break the Terms).
5. To keep the Service working and fix problems.
6. To comply with legal obligations.

Legal bases

Under the GDPR we rely on:

1. Performance of a contract (Art. 6(1)(b)): providing the games and your account.
2. Legitimate interests (Art. 6(1)(f)): security, abuse prevention, moderation and running the Service.
3. Legal obligation (Art. 6(1)(c)), where it applies.

Sharing and third parties

We do not sell or share personal information for advertising. To run the Service we use these providers, who process data on our behalf:

• STRATO GmbH, Germany: hosting of the website.
• IONOS SE, Germany: hosting of the game servers.
• Supabase: the account database, hosted in the EU (Frankfurt, Germany).

We may also disclose information when required by law or to protect players and the Service.

Data retention

• Account data: as long as your account exists.
• Log-in sessions: until you log out, at most 90 days without use.
• Match receipts: 14 days. Settled betting stakes: 30 days.
• Room chat and guest data: only while the room exists.

Deleting your account

You can delete your account at any time in your profile (with your password). Your account and everything linked to it (sessions, collection, partners, receipts, stakes) are deleted at once. If you cannot log in any more, write to contact@joinity.site from the Discord name on your account, or tell us how to recognise it.

Your rights

You have the right to access, correct, delete, restrict or object to the processing of your data, and to data portability. To use them, write to contact@joinity.site. You also have the right to lodge a complaint with a data protection supervisory authority.

Security

Passwords and log-in tokens are stored only as hashes, and all connections use HTTPS. No system can be guaranteed fully secure.

International transfers

Our servers and database are in the EU. If data is ever processed outside the EU, we apply the safeguards the GDPR requires.

Children

The Service is not intended for children under 13 (or the minimum digital age in your country). If you believe a child gave us data, contact us and we will delete it.

Changes to this policy

We may update this Privacy Policy. Updates are posted at https://dittosplayground.com/#privacy.

Contact

Privacy questions and requests: contact@joinity.site