Loading Playrim
Preparing games and page details…
Preparing games and page details…
Effective date: October 16, 2026 · Public Beta
This notice covers playrim.com and its Playrim account/game services. It explains how we handle personal information. Advertising and billing are disabled in the current public-beta configuration; optional account recovery uses Resend. Accounts, saves, scores and first-party operational events are enabled. The operator identified in the contact details below is the controller responsible for this processing.
Where EU GDPR applies, “contract” refers to Article 6(1)(b), “legitimate interests” to Article 6(1)(f), and “legal obligation” to Article 6(1)(c). The corresponding lawful grounds under applicable Serbian data-protection law also apply. A security or performance purpose does not remove your rights. Merely visiting Playrim does not give blanket consent to all processing.
Data: Connection IP, request time, URL, browser/request headers and security events; request/response content passes through the TLS-terminating proxy, including account data you submit. This is separate from Cloudflare Email Routing.
Purpose: Deliver the portal and isolated game origin, enforce access restrictions, and protect against abuse and denial-of-service attacks.
Legal basis: Performance of requested web services and legitimate interests in service availability and security, subject to applicable law and proportionality review.
Recipients/processors: Cloudflare and its subprocessors, as well as the operator/OVHcloud. Processing can occur globally, including the United States; Frankfurt origin hosting does not confine it to the EU.
Retention/deletion: Web caching is bypassed; that does not disable Cloudflare security logging. Cloudflare's DPA Annex 1 ties processor retention to the service agreement ending or processing no longer being necessary for its obligations. Retention varies by service and data category, including separate security/account purposes; dashboard availability is not the retention period for every provider-held record. Our VPS's 30-day log period does not apply to Cloudflare.
Data: Username, random account ID, role, developer verification flag, creation date; declared age band (16–17 or 18+ for self-service signup), Terms version and acknowledgment time, eligibility confirmation; optional public developer display name, description, social links and logos. Passwords are checked in memory and stored only as a PBKDF2-SHA256 hash with a random salt (600,000 iterations for new or replaced passwords; unversioned legacy hashes use 150,000 until the password is changed). Recovery codes are shown once and stored as SHA-256 hashes; replacing or using a code invalidates its predecessor. We do not collect a date of birth, real name, postal address or payment card for ordinary registration.
Purpose: Provide the account, authenticate you, recover access, and publish the profile you choose to submit.
Legal basis: Performance of the account/service agreement; legitimate interests in account security and abuse prevention.
Recipients/processors: Operator/authorized administrators and OVHcloud hosting. Username, developer profile and approved logo can be public; password/recovery hashes and account email are not public.
Retention/deletion: Until account deletion; profile edits replace current values. Password hashes change when the password is reset; a recovery-code hash remains until replacement, recovery, password reset or deletion. There is no automatic inactive-account deletion. Backups and historical game files are separate, as explained below.
Data: Random session ID, user ID, creation/expiry dates; a browser sid cookie. Developer preview capabilities reference a session, user and game in server memory.
Purpose: Keep you signed in and restrict private game previews to authorized users.
Legal basis: Performance of the requested service; legitimate interests in access security.
Recipients/processors: Operator and OVHcloud; sid is HTTP-only and not exposed to game code by the portal SDK.
Retention/deletion: Server sessions expire after 14 days in the current configuration, or earlier on logout/revocation, account deletion, successful email verification or credential recovery/reset. Preview grants expire after 15 minutes and are removed on access/new-grant checks or process restart. The sid cookie has no persistent Max-Age: browser session restoration may preserve it, but server expiry still applies. Expired database sessions are pruned on startup and at one-minute intervals while the API runs.
Data: Email address and verified-at date; token digest, user ID, proposed address, purpose, credential-state digest, creation and expiry time. A raw random token appears in the emailed URL fragment, not in our token database.
Purpose: Verify an address and provide recovery requested by you. Email is optional; we do not send newsletters or marketing campaigns.
Legal basis: Performance of the requested account/recovery service; legitimate interests in protecting accounts and limiting abuse.
Recipients/processors: Operator, OVHcloud, Resend and the recipient's email providers. Resend receives your address, subject and message content including the recovery/verification link; it does not receive your password or our password hash.
Retention/deletion: Verification links are valid for 24 hours; reset links for 30 minutes. Consumption removes the user's outstanding tokens, a failed send removes its token, and same-kind replacement invalidates the previous token. Expired rows are purged on startup and at one-minute intervals while the API runs. Verified email remains until replaced or account deletion. Our Resend Free plan has published 30-day email/log retention. Separate abuse/suppression, account and compliance records have their own necessary retention criteria; not every provider-held record disappears after 30 days. Its DPA provides for deletion of remaining customer data within 90 days after account termination, subject to distinct legal/compliance obligations.
Data: Account-linked save blobs and revisions, best scores and leaderboard IDs, score-run capabilities, favorites (up to 100), recently played games (up to 24), likes, numeric ratings and reports. Games may put game-specific state in save blobs. Leaderboard usernames are public. Public comment reading/posting is disabled for the initial launch. Legacy development comments, if present, remain private records subject to moderation, export and account deletion. No written player reviews, discussion forum or chat is provided. Moderation reports are available to authorized administrators.
Purpose: Restore play across devices, maintain your library and leaderboards, and moderate user contributions.
Legal basis: Performance of the features you request; legitimate interests in fair play, moderation and service safety.
Recipients/processors: Operator, OVHcloud, public viewers of published scores/profiles, and a game's developer through access permitted by the game/portal interface. Legacy comments are not publicly accessible while the feature is disabled.
Retention/deletion: Active account data remains until replaced, removed using the available controls, moderated or account deletion. Saves overwrite earlier live revisions; best scores replace inferior live scores. Score-run capabilities expire after 30 minutes and expire from the active database through scheduled cleanup. Removing/deleting a developer account delists its games and removes current ownership and author attribution, but uploaded packages, versions and historical releases are not automatically erased.
Data: Event name, random event ID, timestamp, game slug, timing/score or game-event properties, and account ID when signed in; guest events have no account ID. The application accepts bounded event properties, so game authors must not send credentials or unrelated personal information.
Purpose: Measure page/game loading and usage, diagnose performance and monitor game operation.
Legal basis: Legitimate interests in operating and improving a functioning game portal, subject to applicable law and an assessment of your interests; you may object by contacting us.
Recipients/processors: Operator/authorized administrators and OVHcloud. No Google Analytics, third-party analytics pixel or analytics vendor is enabled in the reviewed portal configuration.
Retention/deletion: Events expire after 30 days, pruned on startup and every minute while the API runs. The newest 20,000 events are an additional count cap. Account deletion removes linked events.
Data: Your IP address is processed to route requests and form in-memory rate-limit keys. Email rate limits use an address digest. SQLite audit entries contain action/path, actor/target account IDs where applicable, timestamp, request ID, HTTP status and duration. Application error output contains request IDs and error classifications. Nginx access logs contain IP, time, method, redacted pathname, protocol, status, bytes and duration, excluding query strings, preview capabilities and credential/cookie headers. System journals contain infrastructure events; hosting providers also process connection metadata.
Purpose: Protect accounts and infrastructure, investigate abuse, authorize actions and diagnose incidents.
Legal basis: Legitimate interests in securing the service and preventing abuse; legal obligation only where a specific law or lawful request requires retention/disclosure.
Recipients/processors: Operator/authorized administrators, OVHcloud and competent authorities when legally required. The application does not place raw IPs in its SQLite event/audit records or log passwords, request bodies or email-link fragments.
Retention/deletion: Rate-limit buckets expire according to the endpoint window (up to one hour in current routes) and are swept on later checks, or disappear on process restart. Audit expires after 90 days through startup/minute cleanup, with an additional 50,000-entry cap. Account deletion unlinks matching actor/target IDs rather than erasing incident history. Installed Nginx/journal retention targets 30 days, with size caps that may shorten journal retention; unmanaged historical logs require separate operator review.
Data: Local guest favorites/recent history, guest/account offline save checkpoints and game settings, the playrim:account-revision synchronization marker, and game-specific progress keys. Account exports downloaded to your device contain account/game data, not password hashes or recovery secrets.
Purpose: Provide requested offline play/settings, library continuity, tab synchronization and portable access to account data.
Legal basis: Performance of requested features and legitimate interests in necessary session/device continuity; applicable local-storage rules still apply. This storage is not used for advertising profiling.
Recipients/processors: Your browser/device; saves are sent to the operator/OVHcloud when synchronization or an explicit guest-save import is requested. Games access storage permitted by their execution context; embedded SDK deviceStorage is unavailable inside an iframe.
Retention/deletion: Local storage has no automatic expiry and is not cleared by logout or server account deletion. It remains until overwritten, cleared with browser/site controls or removed by the game; a downloaded export remains until you delete it. No portal sessionStorage use was found. Individual games can implement their own device-state behavior.
Data: Contact email, message/request content and identity evidence if necessary; developer profiles, game submissions for administrator review, uploaded game builds/media and logo images. Submission review is a publishing approval workflow, not a public written player review. Uploaded images are decoded/re-encoded and metadata stripped; this does not guarantee that visible text/images contain no personal data.
Purpose: Respond to support/rights requests, publish and moderate submitted games, and verify a requester's identity when needed.
Legal basis: Performance of requested support/publishing services; legitimate interests in moderation; legal obligation for applicable data-subject requests.
Recipients/processors: Operator, OVHcloud, Google (consumer Gmail) for forwarded support/privacy correspondence, Cloudflare Email Routing, moderators, and public users for approved content. External developer/store/social links send your connection metadata to the destination if you follow them; external embeds/assets, when offered, contact their displayed provider.
Retention/deletion: Active account/profile/logo records are removed by account deletion; replaced or removed live logos are deleted from current records. Ordinary support correspondence is deleted manually 90 days after closure; minimal rights-request evidence 12 months after closure, subject to documented legal holds. These are operator-managed schedules, not automated Gmail deletion. Uploaded packages/releases have no general personal-data purge: specific erasure requests require package review. Account deletion does not delete another person's mailbox or third-party records.
Requests routed through Cloudflare's web proxy are decrypted there for web delivery and security, then encrypted again to our origin. Cloudflare can process request content and connection metadata globally. Its DPA describes processor handling and relevant transfer clauses; its privacy policy also covers separate provider purposes. Web caching is bypassed in the current configuration; this does not prevent security-event processing.
The Playrim VPS is hosted by OVHcloud in Frankfurt, Germany, as specified by the operator. OVHcloud processes hosted account/game data and connection metadata for infrastructure operation. The operator remains responsible for access controls, backups and retention on the VPS. See OVHcloud data-protection information.
Resend (Plus Five Five, Inc.) processes transactional verification/recovery emails on our behalf. Resend states that stored data is held in the United States; an EU sending region does not change its storage location. Its Data Processing Addendum includes Standard Contractual Clauses for relevant transfers and its subprocessor list identifies further providers. Its privacy policy also distinguishes its own service/account processing. We therefore do not promise that all Playrim-related data stays exclusively in the EU.
The operator administers Playrim from Serbia. Authorized access from Serbia and the local backup copy in Serbia are outside the EU/EEA, even though the VPS is in Germany. Hosting in Frankfurt does not establish EU-only processing or an adequacy decision for Serbia.
OVHcloud and Resend provide data-processing terms as part of their service agreements. Support/privacy email is forwarded to Google (Gmail), via email forwarding; the forwarding provider is Cloudflare Email Routing. When messages are forwarded, Google receives message content, sender details and email metadata. Its transfer informationdescribes processing on servers around the world; Gmail must not be described as EU-only. Google does not offer a data-processing agreement for consumer Gmail. Cloudflare forwarding to consumer Gmail is the selected incoming-mail arrangement; Google acts as a separate recipient under its consumer terms rather than as a contracted processor for Playrim. You may request information or a copy of applicable transfer safeguards from [email protected].
We do not sell personal information. Authorities may receive information where a specific legal obligation requires it. Hosting, delivery and mailbox providers may have separate legal/security duties. External sites, app stores and independently supplied games have their own policies; no external analytics service was found enabled in the portal. Game networking permissions do not authorize developers to collect unrelated personal data.
Cloudflare security cookies depend on enabled protections. Bot Fight Mode, interactive challenges and Web Analytics are not part of the current configuration. If security features issue cookies, their purpose and lifetime must be checked against the actual configuration and Cloudflare's cookie information. Cache bypass alone does not disable cookies.
The sid session cookie is used for sign-in and access security, with HttpOnly and SameSite=Lax; production configuration requires Secure. It is not an advertising cookie. Necessary storage supports features requested by you. Local game checkpoints, settings, guest favorites/recent history and account synchronization remain on the device until cleared; logout and account deletion do not erase them. Browser “clear site data” controls remove them, but also remove local progress. Some old development-build keys may remain on your device without being read by current builds.
The advertising ad_guest cookie (24-hour maximum lifetime), Google advertising scripts and Paddle checkout are not active in the reviewed configuration. Publishing ads.txt or app-ads.txt does not enable ads. No advertising consent manager is currently installed by the portal; there is no advertising consent to withdraw in this configuration. Before advertising or optional tracking is introduced, this notice and the actual consent/withdrawal flow must be updated.
The application sends plain-text transactional emails and adds no tracking pixel or marketing analytics. Resend open/click tracking is controlled separately at the sending-domain level. The operator confirmed that open/click tracking is disabled for the production sending domain. Any future tracking must be assessed and disclosed before activation.
Backups and historical copies can contain all data present at the time of the snapshot. Their purpose is disaster recovery and integrity; the basis is our legitimate interest in restoring a secure service, subject to a proportionate schedule. The operator currently specifies backups on the same OVHcloud VPS in Frankfurt. An additional encrypted copy on the operator's local PC in Serbia is the selected off-server location. Daily encrypted VPS snapshots and automatic PC catch-up are configured; actual encrypted transfer and isolated restoration have been tested. PC copies occur only while the PC is available and signed in, so recent changes may not yet exist off-server. Recipients are the operator and OVHcloud. Managed database/archive backups expire after 30 days when the backup tools run. Legacy import copies and unmanaged manual snapshots require separate operator cleanup. Historical game packages/releases can also remain after account deletion. Release cleanup is separate from personal-data backup cleanup.
Deleting an account removes its active account, sessions, email tokens, game saves, library, scores, likes, ratings, comments, reports, events and logos, unlinks audit account IDs and delists owned games. This does not erase old backups, uploaded package versions, copies already downloaded by others, browser storage or provider records. One remaining administrator cannot self-delete until administrative responsibility is transferred; the operator must handle a valid erasure request through an alternative process rather than treating this safety control as a refusal of rights.
Events are automatically removed after 30 days and audits after 90 days, on startup and at one-minute intervals while the API runs. Installed VPS log rotation targets 30 days; journal size limits may shorten this. Ordinary support correspondence is scheduled for manual deletion 90 days after closure; minimal rights-request evidence is kept for 12 months after closure unless a justified, documented legal hold applies. These mailbox schedules require operator action. A separate erasure ledger stores only hashed account IDs and deletion dates until all older snapshots capable of restoring those accounts have expired or been destroyed. The restore command requires the latest ledger and reapplies its erasures before use.
We use salted password hashing, random single-use email tokens stored locally as digests, session revocation, rate limits, account-bound save checks, upload sanitization and access restrictions. Email links use fragments to avoid normal HTTP URL logs and expire as described above. The actual emailed link is visible to Resend and your mailbox provider. Playrim uses HTTPS and secure cookies. Application secrets are server-only. Managed backups are encrypted and authenticated before export; brief protected plaintext is used for capture and restoration checks. The live SQLite database does not use application-level encryption. Access controls remain necessary, and backup encryption does not protect a compromised running server or signed-in PC. No system is perfectly secure.
Depending on the law that applies, you can request access and a copy, correction, erasure, restriction, portability where applicable, and object to legitimate-interest processing. If a future optional feature relies on consent, you may withdraw it without affecting earlier lawful processing. We do not use these portal events for automated decisions producing legal or similarly significant effects; automated rate limits and score validation are operational safeguards, and you can contact us to contest a restriction.
Visit Your account to export available account/game records, review/revoke sessions, generate a recovery code or delete your account using your current password and the DELETE confirmation. The export is not a full copy of every infrastructure log or processor-held record. Developer profile corrections are available through developer settings; verified email can be replaced through account settings. There is no general self-service username editing or email-removal control currently.
For other access, correction, removal or objection requests, email [email protected], identify your account and explain the request. Do not send passwords, recovery codes or live email-link tokens. We may request proportionate identity verification; a deleted account does not prevent you contacting us. We respond within the applicable legal deadline, normally one month where GDPR applies, explaining any permitted extension or limitation. Support and privacy requests can use the same monitored mailbox. Use “Privacy request” in the subject to help routing. The operator records the request, checks identity proportionately and tracks the deadline; mailbox activation and manual follow-through remain necessary.
You can complain to the Commissioner for Information of Public Importance and Personal Data Protection in Serbia or another competent supervisory authority, including an EU authority where GDPR gives you that right. You do not have to contact us first to exercise a complaint right.
Playrim is intended for players aged 13 or older worldwide. A higher local age threshold or parental authorization may apply. Registration collects an age band, not a full birth date, and records the Terms/eligibility acknowledgment. Under-13 signup is blocked; self-service registration is restricted to ages 16 and over, and younger accounts are unavailable. Contacting support does not itself approve or create an account. No account or pending child credentials are stored from a refused signup. The declaration is not independently verified, and no automated parental authorization is provided. A parent/guardian or person concerned about a child's data should contact our privacy address; we will investigate and take appropriate steps. The intended scope is Worldwide, subject to applicable local law. Guest access has no independent age-verification gate. Guest play still involves connection/security data, first-party operational events and device/game storage; lack of an account does not mean no data processing. Guest privacy and any applicable child protections are assessed separately. No passport, identity document or full birth date is requested for signup. No country restriction is configured. Worldwide availability is not a claim that one minimum age or a self-declaration satisfies every jurisdiction.
This Privacy Policy takes effect on October 16, 2026. Changes will be dated here; material changes should be communicated prominently before they take effect where required. New ads, billing, processors, retention periods or tracking require an updated notice and any necessary consent or other lawful basis. Beta resets are discussed in the Terms of Use; they do not waive privacy rights.
Playrim is operated by Nikola Popović, an individual based in Leskovac, Serbia. For support, legal notices and privacy requests, contact [email protected].