Privacy Policy

Last updated: 14 May 2026

This policy explains how PlayDodo (playdodo.io) handles information when you use the website and games.

Summary

You do not create a user account. A technical identifier is stored in your browser so the games can work.
Player names are optional and only used for the live game session; they are not kept as a long-term profile on the server once the room ends.
Privacy-oriented analytics (self-hosted Umami) help me understand how the site is used. Umami runs without cookies for visitor identification and focuses on anonymous, aggregated data (such as approximate country, device type, and browser).
YouTube content only loads after you choose to play a video; until then, only a thumbnail may be loaded from Google’s servers.

What data is processed and why

Visiting the website and playing games

To run the games in your browser, the service uses:

A session token (and related technical id) stored in your browser’s local storage so the server can recognise your connection across page loads. This is needed to create or join rooms and keep you assigned to the correct game.
An optional player name you enter (or a generated nickname). It is shown to other players in the same room and exists only while the game room exists on the server. It is not stored as a permanent account record.

Purpose: Providing the website and games you request.
Legal basis (GDPR): Art. 6(1)(b) GDPR (performance of a contract / steps prior to entering it) and, where strictly necessary for secure operation, Art. 6(1)(f) GDPR (legitimate interests in a functioning service).

Analytics (Umami)

The site loads Umami analytics, which I self-host on the same server as the website and API. Umami is set up in a privacy-oriented way: it does not use cookies for visitor identification and collects anonymous, aggregated usage information (for example approximate country, device type, browser, pages viewed, and simple events such as creating or joining a game).

Purpose: Understanding how PlayDodo is used so I can improve stability and features.
Legal basis (GDPR): Art. 6(1)(f) GDPR (legitimate interests). You may object to this processing on grounds relating to your particular situation; see “Your rights” below. You can also use common browser tools to limit scripts (which may affect site functionality).

Emails you send me

If you contact me at [email protected], I process your email address, the content of your message, and any attachments you choose to send.

Purpose: Answering your request.
Legal basis (GDPR): Art. 6(1)(b) or (f) GDPR, depending on whether your message relates to an existing relationship or a general enquiry (legitimate interest in communication).

Embedded YouTube videos

Some pages offer YouTube videos. The player uses youtube-nocookie.com and only loads the full embed after you actively start the video. Before that, a preview image may still be requested from Google’s image servers when the preview is shown.

Purpose: Showing optional help or promotional video content.
Legal basis (GDPR): Art. 6(1)(a) GDPR (consent) when you start playback; for loading the preview thumbnail, Art. 6(1)(f) GDPR (legitimate interest in presenting linked content). Further processing may be governed by the YouTube privacy settings overview.

Retention

Game rooms and in-room player data exist only for the duration of the active session on the server and are not kept as a long-term user database for profiles.
Browser storage for the session token remains until you clear site data in your browser or it is overwritten by the application logic.
Anonymous analytics data follows the default retention period of my Umami installation (Umami’s default configuration for aggregated statistics).

Your rights (EEA / UK)

If the GDPR or similar law applies to you, you may have the right to:

Access your personal data
Rectification of inaccurate data
Erasure (“right to be forgotten”) in certain cases
Restriction of processing
Data portability where processing is based on contract and automated
Object to processing based on legitimate interests (including analytics)
Withdraw consent where processing is based on consent (without affecting earlier lawful processing)

You can exercise these rights using the contact details at the end of this page. You also have the right to lodge a complaint with a data protection supervisory authority in your country.