Skip to content
Playkora

Privacy Policy

This policy describes exactly what Playkora stores, why it stores it, and what it does not store. It is written against what the software actually does rather than as a generic template, so it is specific enough to be checked.

Last updated: 20 July 2026

1. Who is responsible for your data

Playkora is operated by Kurdbits, a sole proprietorship (eenmanszaak) registered in the Netherlands, which is the data controller for everything described below.

  • Binnendelta 11 m, 1261 WZ Blaricum, the Netherlands
  • Chamber of Commerce (KVK) number: 96243554
  • Establishment number (vestigingsnummer): 000061582808
  • Email: info@playkora.com

For any privacy question or request, write to info@playkora.com, or use the contact form.

Kurdbits has not appointed a data protection officer. Under Article 37 GDPR one is required only where an organisation is a public authority, or where its core activity is large-scale systematic monitoring or large-scale processing of special categories of data. None of those apply here, so the contact address above is the route for every privacy request.

2. Your account

You do not need an account to play games or read anything on Playkora. You need one to publish a game, or to rate and review one.

When you create an account we store:

  • your email address;
  • a hash of your password, produced with argon2id — the password itself is never written to disk and cannot be recovered from the hash, by us or by anyone who obtained the database;
  • your display name, which is public and shown on your games and reviews;
  • your interface language, your account role and whether the account is active;
  • the date your email address was confirmed, and the dates the record was created and last changed.

If you set up a public developer profile, the biography, website link and avatar image you enter there are also stored, and they are public by design — that page exists to be found.

Email confirmation and password reset links work through single-use tokens. Only a SHA-256 hash of each token is stored, together with its purpose, its expiry (24 hours for confirmation, 1 hour for a password reset) and the time it was used.

3. Sessions and cookies

Playkora uses three cookies in total. There is no advertising cookie.

The consent cookie (pk_consent) records whether you accepted or refused analytics. It stores that one word and nothing else, lasts a year, and is set as soon as you answer the bar. It is strictly necessary — it is the record of your choice, and without it we would have to ask you again on every page.

Analytics cookies are set by Google Analytics, but only if you press Accept. Until you do, the Google tag runs in the consent-denied mode described in section 4: it stores nothing on your device and cannot recognise you between visits. If you refuse, or simply ignore the bar, no analytics cookie is ever written. You can change your mind at any time through the "Cookie settings" link in the footer.

The session cookie is set only after you log in. It is:

  • HttpOnly — unreadable by JavaScript, including our own;
  • Secure in production, so it is only ever sent over HTTPS;
  • SameSite=Lax, so it is not sent along with cross-site requests made by other websites;
  • valid for 30 days, extended automatically while you keep using the site, and deleted when you log out.

The cookie holds a random token and nothing else — no identifier and no personal data are encoded in it. Server-side, the matching session record stores only a SHA-256 hash of that token, your user ID, the expiry time, and the browser user-agent string and IP address that the session was created from. Those last two exist so that you and we can tell a legitimate login from a stolen one; they are deleted with the session.

4. Google Analytics

We use Google Analytics 4 to understand which games people play and how they find the site. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, acting as our processor.

The Google tag loads on every page, but it starts in Google's Consent Mode with every storage permission denied. In that state it sends Google a single request per page containing no cookie and no identifier, which Google uses only to produce aggregate, modelled visit counts. Nothing is written to your device and nothing links one page view to another or to you.

If you press Accept, and only then, analytics storage is switched on. From that point Google Analytics sets its own cookies to recognise a returning browser and measures your visits in full — pages viewed, approximate location derived from your IP address, device and browser type, and how you arrived. IP anonymisation is enabled, and the tag permanently withholds consent for ad storage, ad user data and ad personalisation — it denies them even after you accept — so your visit is not used to build an advertising profile or to retarget you.

Refusing costs you nothing: every part of the site behaves identically either way. You can withdraw consent whenever you like using "Cookie settings" in the footer, which stops storage immediately for all future page views.

5. Play statistics

When you press play on a game, the site records that a play happened. This is what powers the "popular" listings and the statistics developers see for their own games.

A play record contains, in full:

  • which game was played;
  • the date and time;
  • how many seconds the session lasted, updated by a heartbeat while the game is open and capped at four hours so a forgotten tab does not distort the numbers;
  • the site language you were using;
  • the domain name of the site that referred you, if you arrived from another site — the domain only, never the full URL;
  • a random identifier generated for that single play, used to attach the heartbeat to the right row.

It contains no IP address, no cookie, no device fingerprint and no user ID. Play records are not linked to your account even when you are logged in, they are not linked to each other across games or visits, and none of it is shared with an advertising network or used to follow you anywhere else on the web. Developers see aggregate counts for their own games; they never see anything identifying an individual player.

Play rows are aggregated into daily totals per game. The raw rows are deleted 90 days after they are recorded, by a job that runs every night and only removes rows that have already been aggregated. The daily totals that remain are counts per game and contain nothing about any individual.

6. What you publish

Text you write for a game page — titles, taglines, descriptions, how-to-play instructions, FAQ entries and translations — is stored so it can be shown publicly. HTML in those fields is sanitised against an allow-list before it is saved.

Images you upload (cover art, screenshots, avatars) are stored on our server, converted into several web formats and sizes, and served publicly alongside the alt text you wrote for them. Uploaded game builds are extracted and served as static files. Please note that images can carry embedded metadata such as camera or location information; if that matters to you, strip it before uploading.

Reviews and ratings are public and are shown with your display name. Anything you publish is intended for search engines to index — that is the purpose of the platform.

7. Newsletter

The newsletter is double opt-in: entering your address stores it together with your language and a hashed confirmation token, and sends you one email asking you to confirm. Until you click that link nothing else is ever sent to you. Once confirmed, the date of confirmation is stored as the record of your consent. Every newsletter includes an unsubscribe link, and unsubscribing deletes your address.

8. The contact form

The name, email address and message you submit through the contact form are sent to us by email so that we can reply. They are not stored in the site database. We keep the resulting email for as long as it takes to deal with your question and for up to 12 months afterwards, so that we can follow up on a continuing matter, and then delete it. If your message becomes part of a legal or accounting record we may have to keep it for the statutory period instead.

9. Security, abuse prevention and server logs

Sensitive endpoints — logging in, signing up, resetting a password, submitting a review, subscribing to the newsletter, uploading, and this site's contact form — are rate-limited per IP address. To do that, the server keeps a short-lived counter keyed by your IP address and the action, with the time the window expires. Expired counters are deleted by a nightly job. They are used for nothing else.

Our web server also writes standard access logs, which include IP addresses, requested URLs, user-agent strings and timestamps. These are used for operating and securing the service and for nothing else — they are never combined with your account or with play statistics. They are rotated daily and deleted after 30 days.

Where the GDPR applies, we rely on: performance of a contract for your account, session and published content; consent for the newsletter, which you can withdraw at any time; and legitimate interests for aggregate play statistics, rate limiting, server logs and answering your messages — in each case limited to what is described above, which is why the play beacon does not collect an IP address in the first place.

Analytics is the one thing we rely on your consent for, which is why it stores nothing until you give it and stops the moment you withdraw it.

Kurdbits is established in the Netherlands, so Dutch law applies alongside the GDPR — in particular the Uitvoeringswet AVG and Article 11.7a of the Telecommunicatiewet, which is the rule requiring consent before anything is stored on your device. If you think we have handled your data wrongly, please tell us first at info@playkora.com. You also have the right to complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens (Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl), or to the authority where you live.

11. Who else handles your data

We do not sell data and we do not share it for advertising. Data is processed on our behalf by:

  • Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany), which provides the server that runs the site and its database. The server is located in France, inside the EEA;
  • no third party at all for email. Confirmation, password reset, notification and newsletter messages are sent by the mail server running on that same machine in France, so the contents of those messages are never handed to an external mail provider;
  • Google Ireland Limited, for the analytics described in section 4, and only for visitors who accepted. There is no CDN, no advertising network and no third-party backup service.

The site, its database, its uploaded files and its mail all stay on a server inside the EEA. The single exception is Google Analytics: if you accept it, Google may process your data on servers in the United States. Google Ireland Limited is the contracting party, that transfer is covered by the European Commission's Standard Contractual Clauses together with Google's certification under the EU–US Data Privacy Framework, and it does not happen at all if you refuse.

12. Your rights

You can ask for a copy of the data we hold about you, have it corrected, have it deleted, restrict or object to its processing, or receive it in a portable format. You can also withdraw newsletter consent at any time without affecting anything that happened before.

Deleting your account removes your account record, your sessions, your reviews and your games, including their translations and media. Aggregated play counts that are no longer attached to any identifiable person may remain. To make any of these requests, email info@playkora.com. We answer within one month, as the GDPR requires, and we may ask you to confirm you control the account's email address before we act — otherwise the request itself would become a way to extract someone else's data.

13. Children

Games on Playkora carry an age rating and many are suitable for everyone. Accounts, however, are not intended for children: you must be at least 16 to create one, which is the age the Netherlands has set under Article 8 GDPR. If you believe a child has created an account, tell us and we will remove it.

14. Changes to this policy

If this policy changes in a way that affects what we collect or why, we will update the date at the top of this page, and for material changes we will notify account holders by email. The terms that govern using the platform are in the terms of service.