Privacy Policy for PlayerDeck.gg

Last updated: September 2026

We take the protection of your personal data very seriously. We treat your personal data confidentially and in accordance with the statutory data protection regulations (specifically the European General Data Protection Regulation, GDPR / DSGVO) and this Privacy Policy.

1. Controller

The person responsible for data processing on this website (Art. 4 No. 7 GDPR) is:

2. General Principles & Hosting

Hosting with Vercel

Our website is hosted on the infrastructure of Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA).

When you visit our website, Vercel automatically collects server log files (such as IP address, date and time of the request, browser type, operating system, and referrer URL). This processing is based on Art. 6(1)(f) GDPR (our legitimate interest in ensuring the technical stability, security, and optimal delivery of our website). Data transfers to the USA are safeguarded under standard contractual clauses (SCC) and the EU-US Data Privacy Framework where applicable.

Cookies

We only use cookies that are strictly necessary to keep you signed in to your account. They are set when you sign in, contain your login session, and are removed when you sign out. When you connect TikTok or Instagram, one more cookie, valid for ten minutes, protects that sign-in against forgery. Visitors of creator pages who are not signed in receive no cookies from us unless they click one of the two links below. We do not use cookies for tracking, advertising or analytics.

If you type a name into the sign-up field on our homepage, that name is kept in a cookie for one day so we can offer it to you after you sign in. If you follow a creator's invite link (playerdeck.gg/r/…, also behind the PlayerDeck.gg badge at the foot of every creator page), we keep that creator's public username in a cookie for 30 days, so that if you sign up they are credited with inviting you. Neither cookie contains anything about you, and both are deleted when you finish signing up.

Legal basis: § 25(2) No. 2 TDDDG (strictly necessary to provide the service you requested) and Art. 6(1)(b) GDPR.

3. Account Registration, Profiles & Data Storage

Database and Media Storage (Supabase)

We use the cloud database and storage services of Supabase Inc. (970 Toa Payoh North #07-04, Singapore), with our data stored on servers in Frankfurt, Germany (AWS eu-central-1), to manage user accounts, authentication, user settings, profile grids, and uploaded images.

The data processed includes:

• Email address, username, password hash (or authentication tokens)
• Profile contents (links, setup information, connected gaming handles, uploaded avatar and cover art)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract or steps prior to entering into a contract).

Signing in with Twitch

If you sign in with Twitch, Twitch shares your Twitch user ID, username, display name, email address and profile picture with us. We use them to create your account, to suggest your Twitch username as your PlayerDeck.gg username, and to copy your profile picture into our storage as your avatar. You can replace the avatar at any time.

Account emails

Emails about your account (such as confirming your email address or resetting your password) are sent through Supabase's authentication service. We also send, through Resend (Resend, Inc., USA), a weekly summary of your page's numbers if you switch it on under Account, and at most two tips in your first week while your page is still missing a photo or tiles. Every one of these has a link to stop it. Data transfers to the USA are safeguarded under standard contractual clauses (SCC). We do not send newsletters or advertising. Legal basis: Art. 6(1)(b) GDPR, and for the summary your choice to switch it on.

Importing from another link page

If you ask us to import your Linktree or another link page, we fetch that public page once and copy the links, social profiles, bio and photo you choose onto your page. Nothing else is kept, and we do not sign in anywhere on your behalf. Setup lists you paste (for example from PCPartPicker) are read in place and never fetched from anywhere.

Invitations

If you signed up through another creator's invite link, we store which creator invited you, and later whether your page has three tiles and a photo or social link, so they can be credited with a free month of Pro. They only ever see counts, never who you are. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in rewarding creators who recommend us).

Reporting a page

Anyone can report a creator page from the link at its foot. We store the page, the reason, what you write and, if you give it, your email address, so we can review the report and reply. To stop abuse we also store a hash that changes daily and cannot be traced back to you. Reports are kept until they are resolved and then for up to a year. Legal basis: Art. 6(1)(f) GDPR (keeping the platform safe and meeting our obligations as a host).

How long we keep your data

We keep your account data for as long as you have an account. You can delete your account at any time in your dashboard under Account. This immediately and permanently deletes your profile, all page content, statistics, analytics and every image you uploaded. Payment records are kept by Stripe for as long as tax and accounting law requires (see section 5).

4. Platform Features & Third-Party Integrations

Twitch API Integration

If you connect your Twitch account, we periodically retrieve and synchronize public channel data (your public handle, your follower count, whether you are live, and your current viewer count) via the official Twitch API (Twitch Interactive, Inc., USA). Viewer counts are kept for 90 days to calculate the averages shown in your media kit. We only fetch data necessary to display your current stats on your profile and media kit.

Legal basis: Art. 6(1)(b) GDPR and Art. 6(1)(a) GDPR (your consent).

YouTube API Services

If you add a YouTube channel to your profile, we use the YouTube API Services (Google Ireland Limited) to read the channel's public subscriber count, about once a day, and show it on your profile and media kit. We only read public channel statistics; you do not sign in with Google, and we get no access to your Google or YouTube account. Remove the channel from your profile to stop this. See the Google Privacy Policy.

Legal basis: Art. 6(1)(b) GDPR (showing the stats you asked us to show).

Connecting TikTok or Instagram

You can connect a TikTok account or an Instagram professional account so that its follower count is synced to your page and media kit. You sign in on TikTok or Instagram yourself and approve the connection there. We then receive your account ID, your username and your follower count, and an access token that lets us read them again, about every six hours. We do not read your posts, messages or anything else, and we cannot post on your behalf.

The access tokens are stored encrypted and are only used by our server. You can disconnect at any time in your dashboard (Media kit → Stats); this deletes the tokens immediately and, for TikTok, also revokes them at TikTok. Deleting your account deletes them too. The providers are TikTok (TikTok Technology Limited, Ireland, for users in the EEA) and Instagram (Meta Platforms Ireland Limited). See the privacy policies of TikTok and Instagram.

Legal basis: Art. 6(1)(b) GDPR (showing the stats you asked us to show).

IGDB (Internet Game Database)

When you search for and add games to your profile, search queries are routed to the IGDB API (operated by Twitch/Amazon) to display official game titles and cover artwork. The search runs on our server, so no personal user data is transferred to IGDB during this process.

The cover artwork of games shown on a creator page is loaded directly from IGDB's image servers (images.igdb.com). When you view a page with game covers, your browser therefore sends your IP address and browser information to IGDB, as with any image loaded from another website. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in showing official, up-to-date game artwork).

Videos and clips on creator pages (YouTube, TikTok, Twitch)

Creators can add YouTube videos, TikToks and Twitch clips or videos to their page. The player is not loaded when you open the page: until you click a video, you only see a preview image stored on our own servers, and no data is sent to YouTube, TikTok or Twitch.

When you click a video, the player is loaded from YouTube (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, using YouTube's privacy-enhanced mode on youtube-nocookie.com), from TikTok (TikTok Technology Limited, Ireland, for users in the EEA) or from Twitch (Twitch Interactive, Inc., USA). From then on, the provider receives your IP address, information about your browser and device, and the page the video is embedded on, and may store information on your device. Data may be transferred to the USA; transfers are safeguarded under the EU-US Data Privacy Framework and standard contractual clauses where applicable. For details, see the privacy policies of Google, TikTok and Twitch.

Legal basis: Art. 6(1)(a) GDPR and § 25(1) TDDDG (your consent, given by clicking the video to play it).

Link previews

When a creator adds a link or a video, our server fetches the title, preview image or site icon from that website once and stores a copy on our own servers. Visitors' browsers therefore never load these images from the third-party website, and no visitor data is sent there.

5. Payment Processing (Stripe)

For processing paid subscriptions (such as PlayerDeck Pro), we utilize the payment service provider Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland).

When making a purchase, your payment details (credit card information, IBAN/SEPA details, billing name, and address) are entered directly into an encrypted interface hosted by Stripe. We do not store or have access to your full credit card numbers or sensitive banking credentials on our servers. We only receive a transaction confirmation token, the status of your subscription, and essential billing metadata to fulfill our legal accounting obligations.

Legal basis: Art. 6(1)(b) GDPR (contract performance) and Art. 6(1)(c) GDPR (legal tax and accounting obligations). For details on Stripe's data handling, see the Stripe Privacy Center.

6. Analytics & Privacy (Cookieless Tracking)

We deliberately respect your privacy and do not use tracking cookies or third-party profiling networks (such as Google Analytics).

Our internal page analytics are designed strictly with privacy in mind:

• Page views and link clicks are recorded on our own servers only.
• To tell repeat visits from new visitors, we create a one-way hash from your IP address, your browser's user agent and the page visited, combined with a random value that changes every day. Your IP address itself is never stored.
• Each day's random value is deleted within two days. After that, a hash can no longer be linked to anyone, or to the same visitor on another day.
• Individual page events are deleted after 35 days. Only daily totals are kept after that.
• We do not build long-term cross-site profiles or track individuals across sessions.
• Geographic metrics are limited strictly to country-level data.

Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in measuring aggregate platform usage and defending against automated abuse without compromising visitor anonymity).

7. Automated Media Kit Generation (PDFs)

When a creator or authorized visitor generates an A4 PDF media kit, the profile data is processed programmatically on a headless rendering server to create a downloadable document. This process uses only the public data configured in your media kit settings and optional aggregated metrics you have explicitly toggled on.

8. Your Statutory Rights under GDPR

You have the following statutory rights regarding your personal data:

• Right of access (Art. 15 GDPR): You can request confirmation as to whether your personal data is being processed and obtain a copy.
• Right to rectification (Art. 16 GDPR): You can have inaccurate data corrected.
• Right to erasure / “Right to be forgotten” (Art. 17 GDPR): You can delete your account and personal data yourself at any time in your dashboard under Account, or request deletion by email, subject to statutory retention periods.
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR): You have the right to object to data processing based on legitimate interests (Art. 6(1)(f) GDPR) at any time.

To exercise any of these rights, contact us at info@playerdeck.gg.

You also have the right to lodge a complaint with a competent data protection supervisory authority (Art. 77 GDPR) if you consider that our processing of your personal data infringes applicable law.

9. Changes to this Policy

We reserve the right to amend this Privacy Policy to ensure compliance with updated legal requirements or reflect functional changes to our service. The current version will always be published on this page.