# Privacy

PlayerPal is built so that a loyalty network does not need players' personal
details. This page sets out the commitments PlayerPal makes about player
data. They are product commitments, not legal advice or a statement of legal
compliance.

This page covers players. Staff and partner staff who sign in to business
tools are a separate population and may use a business email address.

## Our commitments

[Available]

1. **No email, name or phone number.** PlayerPal never asks for, receives or
   stores a player's email address, name or telephone number. This applies
   to its databases, tokens, logs and analytics.
2. **Pseudonymous data is still personal data.** Player identifiers and
   gameplay records are pseudonymous, and PlayerPal treats them as personal
   data: protected, access-controlled and retained deliberately.
3. **A different identifier for every partner.** Each partner receives its
   own random Alias for a player, so partners cannot match players with each
   other.
4. **Partners only see their own players.** Every partner query is limited
   to the players linked to that partner.
5. **Comparisons stay anonymous.** Figures that compare a partner with the
   network are suppressed when a group is too small or too dominated by one
   party.
6. **The player is in control.** Players Unlink a partner or delete their
   Account themselves, from their PlayerPal Account.

## What PlayerPal holds

| Held | Not held |
|---|---|
| A random PlayerPal ID the player can see | Email address |
| Sign-in credentials: passkeys, an opaque reference to a social sign-in, an optional password | Name |
| Aliases issued to each connected partner | Telephone number |
| Settled game Activity reported by partners: amounts, times, game round references | Postal address or date of birth |
| Points earned | Casino login credentials or session cookies |
| A device label for each active session, so the player can recognise it | IP address or device fingerprint as an identifier |

Social sign-in requests only an opaque account identifier. Any email, name or
phone the sign-in provider returns is discarded before PlayerPal stores
anything. Accounts are never linked or recovered by email or SMS.

## Identifiers and who sees them

[Available]

| Identifier | Seen by |
|---|---|
| PlayerPal ID (`pp_plr_…`) | The player and PlayerPal only |
| Operator Alias (`pp_plr_opr_…`) | That Operator only |
| Provider Alias (`pp_plr_prv_…`) | That game provider, for one casino only |
| Analytics key | PlayerPal only; never shown to players or partners |

Aliases are random values. They contain nothing about the player, the
partner or the time they were created, and one cannot be worked out from
another. A game provider receives a different Alias for each casino, so it
cannot follow a player between casinos. An Alias that was issued to someone
else is treated as if it does not exist.

Aliases are created only when the player completes a link and consents to
that exact partner. No data about a player flows to PlayerPal before that.

## Analytics

[Available]

Partner analytics are numbers about groups, keyed only by the partner's own
Aliases. Partners never receive another partner's identifiers, the player's
PlayerPal ID or PlayerPal's internal keys.

Anything a partner sees about the wider network is protected by anonymity
thresholds: minimum numbers of Accounts and of peer parties, suppression when
one or two parties dominate, published statistics limited to quartiles and
bands, and fixed time periods so two results cannot be subtracted to isolate a
competitor. See [Privacy thresholds](../analytics/privacy-thresholds.mdx).

## Unlink and Delete Account

[Available]

Both are on the player's PlayerPal Account screen and require the player to
confirm their identity again.

| | Unlink one partner | Delete Account |
|---|---|---|
| Play at the casino | Continues | Continues; the casino account is separate |
| Later Activity | Stops earning Points | No longer connected to anyone |
| Points | Stay on the Account | No longer usable; the Account is closed |
| Aliases | Retired, never reused; relinking issues a new one | All retired |
| Sign-in methods and sessions | Unchanged | Deleted |
| Partner analytics | No new data for that partner; past figures stay | Per-player analytics for the player's Aliases removed |
| Partner | May be notified that the link ended | PlayerPal does not instruct partners to erase their own records |

Activity that happened before an Unlink but arrives late can still earn
Points. After Delete Account, PlayerPal keeps settled game records for
analytics and accounting without any link back to the player: sign-in
methods are deleted, Aliases are detached from those records and the mapping
to the analytics key is destroyed.

## Retention

[In development]

What is decided:

- Unlink and Delete Account behave as described above.
- Raw data received from partners is personal data and falls under the
  retention policy.
- Network signals used for abuse protection are kept only briefly and never
  become a way to identify or link players.
- Partners get numbers, never another Audience's identifiers.

Retention periods for Activity, analytics, ledger and audit records, and for
backups, are being finalised. PlayerPal will publish them here when they are
decided.

## Related

  - [Security](./security.mdx): 
    How PlayerPal protects access to data.
  
  - [Privacy thresholds](../analytics/privacy-thresholds.mdx): 
    The rules that keep comparisons anonymous.
  
  - [Player experience](../product/player-experience.mdx): 
    Linking, Unlink and Delete Account from the player's side.