Privacy Policy | Playout

This policy explains how we process personal data when you use the Playout Android app (“the app”) and the website playout.gg (“the website”). It applies to everyone who uses either of them.

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Gamelight GmbH, Mönkedamm 11, 20457 Hamburg, Germany
Email: support@playout.gg · Phone: +49 40 53544367

For anything about your data, including the rights in section 9, write to support@playout.gg or use the support chat in the app.

2. The website (playout.gg)

The website is a set of static pages. It uses no cookies, no analytics and no tracking, and it loads no content from third parties: fonts and images are served from our own domain.

When you open a page, your browser sends technical data that every website receives: IP address, date and time, the page requested, referrer, browser and operating system. The website is hosted by Amazon Web Services (AWS) (Amazon CloudFront and Amazon S3); AWS processes this data to deliver the pages and protect them against attacks, and may keep it in server logs for a short period. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Links to Google Play take you to Google’s website, where Google’s own privacy policy applies.

3. The app: what we process and why

Your account

Playout has no sign-up form. When you open the app for the first time, we create an account that is tied to your device. We process:

an app-generated account and device identifier, your device model, Android version, app version and language;
the username you choose, which is also your invite code;
your in-app progress: coins, balance, levels, streaks, challenges, events, friends and gifts;
your IP address and the country derived from it, so we can show the right currency, rewards and minimums.

Purpose: providing Playout to you. Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).

Games and level tracking

To credit your playtime, we need to know which games from the Playout shelf you installed and the levels you finish in them:

Installed apps: the app reads the list of apps installed on your device that can be opened from the home screen and sends it to our servers. We use it to confirm that you installed a game from the shelf, to credit that game’s levels to your account, to recommend games you haven’t played yet and to prevent abuse.
Level events: the games on the shelf report completed levels to us (for our own games directly, for partner games through the game’s publisher or its measurement partner), linked to your account.

Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).

Rewards and payouts

When you cash out, we process the email address you enter for your reward, the reward type, the amount and currency, and the status of the payout. Rewards are delivered by our payout partner Tremendous Inc. (USA), which receives your email address, the reward and the amount so it can send you the reward email. For PayPal rewards, PayPal’s own privacy policy applies once the money reaches PayPal.

Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legal obligations to keep accounting records (Art. 6(1)(c) GDPR).

Payout verification (face check)

Before your first payout, the app asks you for a short face liveness check using your front camera. It confirms that a real person is cashing out and that each person uses only one account, which keeps rewards fair for everyone.

The check is performed with Amazon Rekognition Face Liveness by AWS.
We store the check’s result and up to four reference images from the check, together with attributes AWS derives from them (for example an estimated age range and whether the face is clearly visible).
To prevent duplicate accounts, we compare your face images with images from other Playout verification checks.

Face images processed for identification are biometric data, a special category of personal data. We process them only with your explicit consent (Art. 9(2)(a) GDPR), which you give in the app before the check starts. The check is required for payouts; you can use every other part of Playout without it. You can withdraw your consent at any time by contacting us; this doesn’t affect processing that happened before you withdrew, and payouts are no longer possible afterwards. We keep verification data as long as your account exists and for up to 12 months after it is deleted to prevent repeated abuse, then delete it.

Friends, gifts and the activity feed

If you use the friends features, your username, avatar and the gifts you send are visible to the friends you add. Playout also shows a feed of recent cash-outs to other users (for example “Alex cashed out $15 PayPal!”), which may include your username, the reward type and the amount. Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legitimate interest in showing that rewards are paid out (Art. 6(1)(f) GDPR). If you don’t want to appear in the feed, tell us and we’ll remove you.

Support

When you write to us in the support chat or by email, we process your messages, your account details and, where relevant, your payout history to answer you. To answer quickly, suggested replies may be drafted with the help of an AI model (Google Gemini, Google Cloud); our team is responsible for the answers you receive. Legal basis: performance of our contract (Art. 6(1)(b) GDPR) and our legitimate interest in efficient support (Art. 6(1)(f) GDPR).

Notifications

If you allow notifications, we use Firebase Cloud Messaging (Google) to send you messages about your coins, payouts, streaks and events. We store a push token for your device for this purpose. You can switch notifications off at any time in your Android settings. Legal basis: your consent (Art. 6(1)(a) GDPR).

Advertising, measurement and analytics

The app contains advertising and measurement technology from the following partners, who may process your device’s Google Advertising ID, IP address, device information and in-app events:

AppLovin Corp. (USA, AppLovin MAX): showing ads in the app;
Singular Labs Inc. (USA): measuring which campaigns and games led to installs;
Google Firebase Analytics (Google Ireland Ltd. / Google LLC): understanding how the app is used so we can improve it;
Sentry (Functional Software Inc., USA): crash and error reports with technical device data, so we can fix bugs.

Legal basis: our legitimate interest in financing, measuring and improving the app (Art. 6(1)(f) GDPR) and, where required by law, your consent (Art. 6(1)(a) GDPR). You can reset your Advertising ID or opt out of personalized ads at any time in your Android settings under Google → Ads.

Fairness and security

We use the data described above, including device data, IP address, account links and the verification result, to detect and prevent fraud, multiple accounts and abuse of rewards. Legal basis: our legitimate interest in a fair service (Art. 6(1)(f) GDPR).

4. Where your data is stored

Our servers run on Amazon Web Services in Frankfurt, Germany (EU). Some of the partners named above are based in the USA. Where data is transferred outside the EU/EEA, the transfer is based on the EU–U.S. Data Privacy Framework where the recipient is certified, or on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR).

5. Who receives your data

We share data only with the service providers named in this policy, which process it on our behalf or as independent controllers for the purposes described, and with authorities where we are legally required to. We never sell your personal data.

6. How long we keep it

We keep your account data for as long as your account exists. If you don’t use Playout for 12 months, we may close your account and delete its data. Payout records are kept for as long as commercial and tax law requires (up to 10 years). Verification data is kept as described in section 3. Server logs are deleted after a short period.

7. Age

Playout is not intended for children under 16. Rewards can only be paid out to people who are allowed to hold the reward account (for example a PayPal account) in their country.

8. Permissions the app asks for

Notifications: to tell you about coins, payouts and events (optional).
Camera: only for the payout face check (optional, needed for payouts).
Advertising ID: for advertising and measurement as described above.
Installed apps: to credit the games you install from the shelf.

9. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Where we rely on your consent, you can withdraw it at any time with effect for the future.

To use any of these rights, including deleting your account and its data, write to support@playout.gg or use the support chat in the app.

You also have the right to lodge a complaint with a data protection authority, for example the authority responsible for us: Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany.

10. Changes

We update this policy when Playout changes. The date at the top shows the latest version; we’ll tell you in the app about important changes.