1. Who controls your data
The data controller for Playmatch is Theory Media, MB, company code 306703001, registered at Linksmoji g. 73-308A, LT-11231 Vilnius, Lithuania. Email privacy requests to [email protected].
2. Data we process
Account and identity
We process your account identifier, email address when available, display name, avatar, role, authentication provider, and account timestamps. Authentication sessions use essential cookies.
Steam connection
If you connect Steam, we process your Steam identifier, public profile details, owned-game library, playtime, last-played information, and catalogue metadata needed to connect your library to Playmatch games. A private or unavailable Steam library is treated as unavailable rather than inferred.
Taste and discovery
We process onboarding choices, declared genres and experience preferences, game reactions, optional dismissal reasons and text, saved or dismissed games, recommendation impressions and opens, Steam outbound clicks, generated Taste Profiles, and recommendation explanations. We also store natural-language discovery requests and their structured interpretations as current or previous discovery contexts.
Developer tools and communications
If you use developer tools, we process organization membership, game ownership claims, submitted evidence links or notes, campaign records, and feedback. If you contact us, we process your message and the contact details needed to respond.
Product analytics
Separately from the measurement above, and only if you allow it, we use Mixpanel to understand how the product is used: which surfaces people reach, whether sign-up and onboarding are completed, and which kinds of game people open. A consented session sends a surface name, counters such as how many cards or shelves a page showed, and your account identifier when you are signed in. It does not send your search text, full referrer URLs, page URLs, or game slugs.
Public-site performance
When optional SEO measurement is enabled, Playmatch records the public route family and path without query strings, a coarse acquisition channel, and Web Vitals such as LCP, INP, CLS, and TTFB. It does not store full referrer URLs, raw public search terms, IP-derived profiles, or anonymous visitor fingerprints in these analytics events.
3. Browser storage and cookies
Essential authentication cookies keep you signed in and protect the Steam connection flow. Product analytics is off until you allow it: we record your choice in a single browser storage value, and while no choice has been made, and after you decline, no analytics code is loaded and no analytics identifier is set. You can change or withdraw the choice at any time below. The game-search page can store up to four recent searches in your browser's local storage. When public performance measurement is enabled, session storage prevents the same page view from being counted repeatedly in one browser tab. These local values remain in your browser until you clear them or the application replaces them.
Checking your analytics preference…
4. Why we process data
We process account, Steam, taste, search, and recommendation data to provide the service you request and perform our agreement with you. We process security, abuse prevention, service reliability, aggregate performance measurement, and product improvement data for our legitimate interests, after considering your rights. We process records where necessary to comply with legal obligations or establish, exercise, or defend legal claims. Where the law requires consent, we will request it separately and you may withdraw it.
5. Automated recommendations and AI-assisted parsing
Playmatch automatically compares your Taste Profile and current intent with Game DNA to rank and explain recommendations. These results help you discover games; they do not produce legal or similarly significant decisions about you. When configured, the text of a natural-language discovery request can be sent to Google's Gemini API to convert it into structured game traits and constraints. A deterministic parser is used when that service is unavailable. Do not include sensitive personal information in a game-search request.
6. Who receives data
We use service providers only where needed to operate Playmatch. These can include Supabase for authentication and database services, infrastructure and hosting providers, Steam for account linking and catalogue/library data, Google Gemini for natural-language intent parsing when enabled, and Mixpanel for product analytics when you allow it. Aggregate Search Console reporting is obtained from Google for search-performance measurement. We may also disclose data when legally required, to protect users and the service, or as part of a business reorganization subject to appropriate safeguards.
7. International processing
Some providers may process data outside Lithuania or the European Economic Area. Where required, we rely on an adequacy decision, standard contractual clauses, or another lawful transfer safeguard offered for the relevant service.
8. Retention
Account and Taste Profile data are kept while your account is active and as needed to provide the service. Current intent, interactions, experiments, developer claims, and operational records are kept only as long as needed for their stated purpose, service integrity, dispute resolution, or legal obligations. After a valid deletion request, we delete or anonymize data unless retention is required by law or necessary for legal claims. Residual copies may remain temporarily in protected backups until those backups rotate.
9. Your rights
Depending on the circumstances, you may request access, correction, deletion, restriction, or portability of your personal data, and object to processing based on legitimate interests. You may withdraw consent without affecting earlier lawful processing. Email [email protected] from the address connected to your account. We may ask for information needed to verify your identity.
You may also lodge a complaint with the Lithuanian State Data Protection Inspectorate or the supervisory authority where you live or work.
10. Security and children
We use access controls, encrypted transport, restricted credentials, and operational safeguards appropriate to the service. No internet service can guarantee absolute security. Playmatch is not directed to children who cannot lawfully consent to an online service in their country; a parent or guardian should contact us if they believe a child provided data without the required authorization.
11. Changes and contact
We will update the date above when this policy changes meaningfully. Material changes may also be communicated through the service. Questions, privacy requests, and complaints can be sent to [email protected].