Privacy
Play by Praya is operated by Andrei Bezrodnov, an individual based in Georgia. This notice explains how Play handles personal data. Contact bezrodnov@icloud.com for privacy questions or requests.
We do not sell personal data or use it for advertising. Public channels and content are visible to their audience; a private channel limits access but is not end-to-end encrypted.
What we use and why
- Account and service data: email, display name, password verification data, sessions, channels, uploads, playlists and permissions. We use these to provide the service you request and administer accounts (contract).
- Essential operation and security: connection information, request outcomes and limited service logs help deliver media, synchronize clocks, prevent abuse and resolve faults (legitimate interests). Network connections necessarily expose an IP address to their destination.
- Optional analytics (consent): coarse pages, referral host, language, approximate location, device/browser category and events help us understand visits. Self-hosted Umami does not store a raw IP field; pseudonymous estimates are not exact people counts. Play also links channel visits and listening time to your profile. Channel administrators see aggregate statistics; you can see your own activity.
- Optional detailed diagnostics: playback, loading and clock measurements with session-level correlation help investigate reliability (consent). We avoid uploaded filenames, media contents, passwords and access tokens in these events.
- Support and reports: messages, evidence you provide and necessary handling records let us answer requests, address illegal content and meet applicable obligations (legitimate interests or legal obligation).
Your choices
Analytics and detailed diagnostics have separate optional choices. Refusing either does not prevent playback. You can withdraw consent in Privacy choices; we remember your selection for up to 180 days. We also respect browser Do Not Track and Global Privacy Control signals for these optional collections.
Essential storage keeps sign-in and requested preferences working. The session cookie can last up to 400 days; server-side sessions can expire earlier. Local storage also holds playback, language and clock settings. Clearing it can reset those settings.
Where data goes
Play runs on OVHcloud in France. Media is held in private object storage and a local server mirror; Umami is self-hosted. Our hosting providers process data to operate this infrastructure.
Cloudflare clock services and STUN can receive connection information through their global network. When channel peer synchronization is enabled, direct WebRTC connections can disclose your network address to other participants. Authorized integrations receive only the access you grant; account emails use our mail provider.
The operator accesses the service from Georgia, and support mail uses an Apple iCloud inbox. Processing is therefore not confined to the EU. Relevant service providers, authorized recipients and authorities may receive data where needed for the stated purposes or required by law. Contact us for information about applicable international-transfer arrangements.
How long we keep it
Registered account data remains until deletion or another justified retention need ends. Guest accounts are scheduled for removal after 14 inactive days. Umami events and daily channel-activity details have a 90-day retention target. Profile-linked channel lifetime totals and first/last activity times remain until the account or channel is deleted; already aggregated channel totals can remain.
Diagnostic storage uses limits of 7 days for connection context, 14 days for detailed events and 90 days for summaries. Cleanup, replicated logs and backups can take additional time. Deletion of an account is not a promise of immediate physical erasure from every backup or object-storage copy; we explain remaining copies and any legal retention when handling a request.
Requests and children’s data
Your profile offers a download of your account data, excluding media files. Email us for access, another copy, correction (including email), deletion, restriction or an objection. We may ask for proportionate evidence of account ownership; never send passwords. For GDPR requests we normally respond within one month and explain any lawful extension. You can complain to your competent data protection authority.
If a child’s personal data needs attention, a parent or guardian can contact us. We review the circumstances and take appropriate action, including deletion where required. We do not treat a general age statement as verified parental consent.
The date above identifies this notice. Material changes will be announced on Play; where a new consent is needed, collection will wait for it.