Privacy

What Retro Play keeps, why it keeps it, and what you can take away.

What an account holds

Your gamertag, which is public: it is what a board says, and what other players see.
Your email address, kept encrypted in the database. It is used to verify the account, to send a password reset when you ask for one, and to tell you a thing you asked to be told — nothing else. It is never shown on a page and never sold or passed on.
Your password, only ever as an Argon2 hash. Nobody at Doomsday One can read it, including the people who run the service.
A PIN for your machine, as a hash. The PIN is what a game on your Commander X16 signs in with, so that a program on a card never carries your password.
The day you joined, and, if you turn it on, two-factor sign-in and its recovery codes (hashed).

Scores and runs you post from a game: the score, the lines, the level, the seconds, the initials you typed, and which machine it came from. These are the point of the service and they are public.
Awards you have earned, and the points they are worth.
Presence: while a game is signed in, the service knows you are on and what you are playing, so other players' pages can say so. It is not written down — when you sign out, or the link drops, it is gone. You can set yourself to INVISIBLE or OFFLINE in the client or on the site, and then nobody is told.
What you own, when you buy a game or one is granted to you, and what you have downloaded to a card.

Paddle takes the payment and is the merchant of record for the sale. Your card details go straight to Paddle and never reach this service — we never see or store a card number. Paddle handles the payment under their own privacy notice, and they tell us only what we need to give you the game: that the sale went through, which game and price it was, and the account it was for.
Your email address is passed to Paddle with the checkout, so the receipt reaches you. That is the one place it goes outside this service.
What we keep of a sale: the game, the price, the day, the Paddle transaction it came from, and which account owns it. That is the record of what you own, and it is what lets you download it again.
Every download is stamped with the account that took it, so a copy that turns up where it should not can be traced back. The stamp identifies the account, nothing more.

A session cookie while you are signed in, and, during two-factor sign-in, a short-lived one for the second step.
A theme cookie, remembering whether you chose the machine's palette or daylight. Signed in, that choice is also kept on your account so your X16 wears it too.
The service writes ordinary server logs. They are for keeping the thing running and are not used to build a picture of anybody.

Change your address or password from your account page at any time.
Keep your handles to yourself: every social handle on your profile has its own show tick.
Delete your account, from Account → Privacy. It takes the account, its email, its PINs, its sessions and its profile with it. Scores already on a public board stay, with the gamertag on them — a board is a record of what happened — and if you would rather they went too, write to us and we will take them off.

Write to privacy@doomsdayone.com about anything on this page, including a copy of what is held about you.