Privacy Policy
- You can play without an account and without giving any personal data.
- With an account, we keep the minimum needed for it to work: name, nickname, email, protected password and your game progress.
- Payments happen on Stripe: we never see your card number.
- We don't sell your data. Advertising cookies are only used with your consent.
- You can export your data or delete your account at any time in My account.
1. Who is responsible for your data
The controller of the personal data processed on let2play.com is Let2Play, operated from Brazil. For any privacy matter, including contacting our data protection officer (DPO), email contato@let2play.com or use the contact page.
This policy follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), the European Union's General Data Protection Regulation (GDPR) and the UK GDPR, California's privacy laws (CCPA/CPRA) and the US Children's Online Privacy Protection Act (COPPA).
2. Data we collect
| Situation | Data | Where it comes from |
|---|---|---|
| Visitor without an account | Data: A random identifier stored in the pg_v cookie, linked to your favorites, game history (which games you played, how many times and when), star ratings and saved game progress. It contains no name, email or other personal data. | Where it comes from: Generated by the site in your browser |
| Email account | Data: Name, nickname, email, password (stored only in encrypted, hashed form), avatar chosen from the site's set, the date you accepted the terms, XP, scores, favorites, history, ratings and saved game progress. | Where it comes from: You and your use of the site |
| Sign in with Google | Data: Name, email and your Google account identifier, sent by Google through Firebase Authentication. We never receive your Google password. | Where it comes from: Google, when you choose this sign-in |
| Purchases | Data: Orders (product, game, amount, date, status), coin balance and items for each game, subscriptions (status and end of period) and Stripe reference codes. Your card number and payment details stay with Stripe only. | Where it comes from: You and Stripe |
| Creators | Data: Studio name, bio, website, logo and submitted games. To receive payments: name, CPF or CNPJ (Brazilian tax IDs), date of birth, phone, email and address. Bank details are entered directly on Stripe. | Where it comes from: The creator |
| Contact and game submissions | Data: Name, email, subject, message and the link you send. | Where it comes from: You, through the forms |
| Technical data | Data: IP address, date and time, page requested and browser details, in the access logs of our server and of Cloudflare. Your IP is also used for anti-abuse limits (for example, repeated login attempts). | Where it comes from: Your browser, automatically |
| Preferences | Data: Light or dark theme, language and your choice about optional cookies. | Where it comes from: You |
We also count, per game and per day, how many times it was seen, clicked and played, the playing time and the ads shown. These numbers are totals and don't identify you.
We don't ask for sensitive data (health, religion, racial origin, etc.) and we don't use your precise location.
3. How we use it and legal bases
| Purpose | Legal basis under the LGPD | Legal basis under the GDPR |
|---|---|---|
| Create and keep your account, save progress, favorites and leaderboards | Legal basis under the LGPD: Performance of a contract (art. 7, V) | Legal basis under the GDPR: Performance of a contract (art. 6(1)(b)) |
| Remember favorites and history for people who play without an account | Legal basis under the LGPD: Legitimate interest (art. 7, IX) | Legal basis under the GDPR: Legitimate interests (art. 6(1)(f)) |
| Process purchases, deliver content, manage subscriptions and refunds | Legal basis under the LGPD: Performance of a contract (art. 7, V) | Legal basis under the GDPR: Performance of a contract (art. 6(1)(b)) |
| Keep payment and payout records required by law | Legal basis under the LGPD: Legal obligation (art. 7, II) | Legal basis under the GDPR: Legal obligation (art. 6(1)(c)) |
| Pay creators and verify their identity (with Stripe) | Legal basis under the LGPD: Performance of a contract and legal obligation (art. 7, V and II) | Legal basis under the GDPR: Performance of a contract and legal obligation (art. 6(1)(b) and (c)) |
| Security, fraud and cheating prevention, anti-abuse limits | Legal basis under the LGPD: Legitimate interest (art. 7, IX) | Legal basis under the GDPR: Legitimate interests (art. 6(1)(f)) |
| Answer contact messages and review submitted games | Legal basis under the LGPD: Legitimate interest or pre-contractual steps (art. 7, IX and V) | Legal basis under the GDPR: Legitimate interests or pre-contractual steps (art. 6(1)(f) and (b)) |
| Show personalized ads and use advertising cookies | Legal basis under the LGPD: Consent (art. 7, I) | Legal basis under the GDPR: Consent (art. 6(1)(a)) |
| Aggregated game metrics for us and for creators | Legal basis under the LGPD: Legitimate interest (art. 7, IX) | Legal basis under the GDPR: Legitimate interests (art. 6(1)(f)) |
When we rely on legitimate interest, we first check that it doesn't override your rights. You can object to that use (section 8). You can withdraw consent at any time, without affecting anything done before.
We don't make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. What is public
- Your nickname, avatar, XP and scores appear on leaderboards and in the community. Your name and email never appear.
- A game's creator sees the nickname of anyone who bought something in their game, along with the product, amount and date. They don't see your name, email or payment details.
- For creators: the studio name, bio, website, logo and published games appear on the studio's public page.
5. Who we share it with
We don't sell your personal data. We only share what is needed with these providers:
| Who | What for | Data |
|---|---|---|
| Stripe | What for: Payments, subscriptions, refunds and creator payouts (Stripe Connect), including creator identity verification | Data: Email and purchase details; for creators, their payout details. Stripe also processes some data as a controller, under its own privacy policy |
| Google Analytics (Google Ireland Ltd.) | What for: Measuring how the site is used | Data: Random device identifier (cookie), approximate IP address, pages viewed, games opened, searches and purchases. Only with your consent; we ask Google not to use this data to personalize ads |
| Google AdSense | What for: Showing ads | Data: Cookie and device identifiers, IP address and pages viewed. Personalized ads and advertising cookies only with your consent |
| Google Firebase Authentication | What for: Sign in with Google | Data: Name, email and Google account identifier, only if you use this sign-in |
| Google Fonts | What for: Loading the site's fonts and icons | Data: IP address and technical browser data |
| YouTube (privacy-enhanced mode) | What for: Showing a game trailer | Data: Only when you click the trailer: IP address and technical browser data |
| Cloudflare | What for: Delivering the site, protection against attacks and bots | Data: IP address, pages requested and technical browser data |
| Hosting provider | What for: The server where the site and database live | Data: All data stored by the site, under our control |
Game creators. Creator games run isolated and can't access your cookies or your storage on the portal. Through the site's SDK, a game only receives: whether you are signed in, your nickname, your balance and items in that game, and that game's saved progress. The creator also sees the game's sales (section 4) and aggregated metrics.
Authorities. We may provide data when required by law or a court order, or to defend ourselves in legal proceedings.
6. International transfers
The site is operated from Brazil, and some providers (Stripe, Google, Cloudflare) process data in the United States and other countries. If you live in the European Union or the United Kingdom, your data is sent directly to Brazil when you use the site. For transfers to providers, we rely on the safeguards set out in the LGPD (art. 33) and the GDPR (Chapter V), such as standard contractual clauses and adequacy decisions, offered by these providers in their data processing agreements.
7. How long we keep it
- Account: for as long as it exists. When you delete your account in My account, we immediately delete your progress, favorites, history, ratings, scores, coin balance, items and the messages sent with your email, and we cancel active subscriptions. If you made purchases, the account record is anonymized (no name, nickname, email or login), only to keep the records required by law; with no purchases, it is deleted. Accounts with a creator studio are deleted through support, because the games and payouts must be closed first.
- Purchase records and creator payout records: kept even after the account is deleted, for the period required by tax and accounting laws, and never shown in any public area.
- Data of visitors without an account: linked to the identifier in the
pg_vcookie, which expires after 400 days. If you clear your cookies, the data is no longer linked to your device. To have it deleted from our server, contact us. - IP address in anti-abuse limits: deleted automatically after 24 hours.
- Contact messages and game submissions: kept so we can reply and keep a record of the support history. You can ask us to delete them at any time.
- Server and Cloudflare access logs: used only for security and troubleshooting.
- Site measurement (Google Analytics): event and user data are kept for 14 months in our Google Analytics property and are deleted automatically after that.
- Payment data at Stripe: for the period set by Stripe's own policy.
Anything that isn't deleted automatically can be deleted at your request, unless the law requires us to keep it.
8. Your rights and how to use them
Depending on where you live, you have the right to:
- confirm whether we process your data and get a copy of it;
- correct incomplete, wrong or outdated data;
- ask for deletion, anonymization or blocking of data that is unnecessary or processed unlawfully;
- receive your data in a structured format to take it to another service (portability);
- know who we share your data with;
- withdraw consent and object to processing based on legitimate interest;
- ask us to restrict processing (GDPR);
- complain to a data protection authority (section 14).
How to do it:
- In My account you can edit your data, use Export my data to download a copy, and Delete my account to erase it.
- For everything else (including data from visits without an account), write to us through the contact page or at contato@let2play.com. We may ask you to write from your account email to confirm it's you.
- We reply within the legal deadline: up to 15 days under the LGPD; up to 1 month under the GDPR and UK GDPR (extendable by 2 more months for complex requests, with notice); up to 45 days under the CCPA (extendable by 45 more days, with notice).
- Exercising your rights is free and does not change how you are treated on the site.
9. California residents (CCPA/CPRA)
In the last 12 months we collected these categories of personal information, for the purposes in section 3:
- Identifiers: name, nickname, email, IP address, cookie identifier and Google account identifier;
- Commercial information: purchases, subscriptions, coin balance and items;
- Internet activity: games played, history, favorites, ratings, scores and interactions with ads;
- Financial information and government IDs (creators only): CPF or CNPJ and payout details, used only to verify identity and make payments, never to infer characteristics about you.
Sources, the providers that receive this data and how long we keep it are described in sections 2, 5 and 7.
We do not sell personal information. If you accept advertising cookies, Google AdSense may receive identifiers and browsing data to show ads based on your activity on other sites. California law may treat this as "sharing" for cross-context behavioral advertising. You can refuse or turn this off at any time in ; without your consent, these cookies are not used. We also honor the Global Privacy Control (GPC) browser signal: when it is on, we treat your visit as an opt-out, with no click needed. We do not sell or share the personal information of consumers we know to be under 16 unless they have opted in.
You have the right to know, access, correct and delete your information, and not to be discriminated against for exercising these rights. An authorized agent can make a request for you, with proof of authorization. Requests follow section 8.
10. Children and teens
- Anyone can play without an account and without giving personal data. The site is not designed to collect data from children under 13.
- You must be 13 or older to create an account. Users under 18 must use their account with the permission and supervision of a parent or legal guardian.
- If we learn that we collected data from a child under 13 without verifiable parental consent, we delete it.
- Parents and guardians can ask to access or delete their child's data through the contact page or at contato@let2play.com, giving the account's nickname or email.
- Teenagers' data is always processed in their best interest, as required by the LGPD (art. 14).
11. Cookies
We use essential cookies (session, visitor identifier), preference cookies (theme, language, consent choice) and, only with your consent, measurement cookies (Google Analytics) and advertising cookies (Google AdSense). The full list, with how long each one lasts, is in the Cookie Policy. You can change your choice whenever you want in .
12. Security
The site uses an encrypted connection (HTTPS), passwords stored only as hashes, protection of forms against forged submissions, limits against repeated attempts, and creator games isolated from the rest of the portal. Payment data stays with Stripe. No system is 100% secure; if an incident creates a relevant risk for you, we will notify you and the authorities as the law requires.
13. Changes to this policy
We may update this policy. The date at the top shows the latest version. We will announce important changes on the site before they take effect.
14. Contact and complaints
Please talk to us first: contato@let2play.com or the contact page. If you are not satisfied, you can complain to a data protection authority: in Brazil, the ANPD (National Data Protection Authority); in the European Union, the authority in your country; in the United Kingdom, the ICO; in California, the California Privacy Protection Agency or the state Attorney General.