Play Bot runs games, scores and leaderboards in WhatsApp groups, with a dashboard for the people who run those groups. This notice explains what Play Bot stores about you, why, for how long, and how to have it erased. We keep it short and plain on purpose.
In short
- We store your WhatsApp name, an anonymous WhatsApp ID, and your game activity in each group. We never store your phone number.
- We only keep messages that are Play Bot commands (like !start) or answers during a round. Everything else said in the group is ignored and never stored.
- Type !forget in a group to erase your name and answers there and leave its leaderboards.
- We don't sell your data, show ads, or use it for anything except running Play Bot.
Who is responsible
Play Bot is run by Ayomide Samuel, in Nigeria, who is the data controller for the information described here. Contact: privacy@playbot.name.ng.
Each community (WhatsApp group) also has its own admins who use the dashboard. They decide to add Play Bot to their group and can see their community's players and scores.
What we collect from players
When you take part in a group where Play Bot is a member:
- WhatsApp ID. WhatsApp gives each person in a group an anonymous identifier (not your phone number). We use it to recognise you from one game to the next.
- Display name, as it appears on WhatsApp. The group's admins can set a different name to show in games.
- Commands and answers: messages that start with "!" and messages sent while a round is open, with the time they arrived (to decide who answered first).
- Game results: points, wins, streaks and when you last played.
- Reports: if you use !report on a custom quiz question, which question you reported. The community owner sees how many players reported it, not who.
- The group's name, to label the community.
Like any member's phone, Play Bot's WhatsApp number receives every message in the groups it's in. It only looks at each message to see whether it's a command or an answer; anything else is discarded immediately and never stored. We don't collect phone numbers, profile photos, contacts or location. In a private chat with Play Bot, we only act on !connect and !forget.
What we collect from community admins
If you sign in to the dashboard:
- Email address and name, and your profile picture address if you sign in with Google.
- Sign-in sessions: when you signed in, your IP address and browser type, so you can see where you're signed in and to protect your account.
- An audit log of changes you make (for example settings, bans and point corrections), visible to your community's owner and admins.
- Custom quizzes the community owner writes: questions, answers and pictures. Pictures are shrunk and saved as new files, which removes hidden details such as where a photo was taken.
Why we use it
- Running games and leaderboards
- Necessary to provide the service your group chose to use.
- Dashboard accounts and sign-in
- Necessary to provide the dashboard you signed up for.
- Security, abuse prevention, fixing faults
- Our legitimate interest in keeping Play Bot safe and working. Logs are stripped of phone numbers and secrets.
We don't use your data for advertising, profiling or automated decisions about you.
Who can see it
- Other members of the group see your name and scores in game messages and leaderboards, as they would see any message in the group.
- The group's admins on the dashboard see players' names, scores, wins and when they last played. They don't see other conversations in the group.
- The operator (Ayomide Samuel) can access data to provide support, keep the service running and handle requests under this notice.
- Service providers that host and run Play Bot for us, under their own security and data protection terms:
- Oracle Cloud: the server and database (London, United Kingdom)
- Cloudflare: secure connections to the server, and encrypted backups
- Vercel: hosting of the dashboard website
- Resend: sends sign-in emails (your email address)
- Google: only if you choose "Continue with Google"
- Telegram, healthchecks.io and UptimeRobot: alerts about faults, sent to the operator. Alerts are stripped of phone numbers and secrets and aren't meant to contain personal data.
- WhatsApp (Meta) carries the messages in your group, as for any WhatsApp conversation, under WhatsApp's own privacy policy.
Your data is stored in the United Kingdom, which has data protection law comparable to Nigeria's. We only use providers who protect data appropriately, and we never sell it.
How long we keep it
- Your answers (the text you typed)
- 90 days, then erased automatically. Who won each round is kept.
- Name, WhatsApp ID, scores and wins
- Until you use !forget, or the community is deleted.
- Dashboard account
- Until you ask us to delete it.
- Sign-in sessions
- Until they expire (30 days after last use) or you sign out.
- Audit log
- As long as the community exists.
- Custom quizzes and their pictures
- Until the owner deletes them, or the community is deleted.
- Reports on custom questions
- Until the owner dismisses them, the question is deleted, or you use !forget.
- Server logs
- About two weeks.
- Encrypted backups
- Up to 14 days, then deleted automatically.
Your rights
Under the Nigeria Data Protection Act 2023 you can:
- See your data: type !profile in the group, or email us for a full copy.
- Correct it: change your WhatsApp name, or ask the group's admins to set your name in games.
- Erase it: type !forget in the group and confirm. Your name and answers there are erased and you're removed from its leaderboards. Your past points stay in the totals as "Former player", so other people's results stay correct. Erased data can remain in encrypted backups for up to 14 days. Community staff need to step down from the staff first. If you're no longer in the group, email us.
- Object or ask us to stop: you can leave the group or ask its admins to remove Play Bot, and email us about anything else.
- Complain to the Nigeria Data Protection Commission (ndpc.gov.ng) if you're unhappy with how we handle your data. We'd appreciate the chance to fix it first.
Email privacy@playbot.name.ng. We reply within 30 days, and may ask you to confirm the request comes from you (for example by sending a code in the group).
Children
Play Bot follows WhatsApp's minimum age of 13. Players under 18 should have a parent's or guardian's permission, and a parent or guardian can ask us to erase a child's data at any time. The dashboard is for adults (18+).
Security
Data is encrypted in transit; the WhatsApp session and backups are encrypted at rest. Access to the server is limited to the operator. Phone numbers and secrets are removed from logs. If a breach affects your data, we'll inform the Nigeria Data Protection Commission within 72 hours and tell affected people without undue delay.
Changes
If we change this notice, we'll update the date at the top. For significant changes we'll also tell community admins on the dashboard.