Privacy policy — PlayZeek

1. Who is responsible for your data

The controller of personal data processed on the PlayZeek service (playzeek.pl) is Patryk Pawlak, a natural person not conducting business activity, correspondence address: ul. Fredry 20/23, 87-800 Włocławek, Poland (hereinafter: Operator).

For matters concerning personal data, write to [email protected] or use the "Personal data (GDPR)" category on the Contact page, also without logging in.

Capitalised terms have the meaning given to them in the Terms.

2. Who this policy applies to

This policy applies to:

Players, i.e. persons with an Account,
persons visiting the Service without an Account,
creators of Custom Brackets and persons whose names have been entered in a bracket,
persons who send Tickets, including without an Account,
participants in Official Tournaments and Team challenges, including prize winners.

3. What data we process, why and for how long

Account

Data: email address, password hash, nickname and nickname history, declaration of being at least 16 years old, Account settings, and, if you provide them: first and last name (hidden by default), date of birth (never public), nationality, region, time zone, language, main game and role, "looking for team" flag, avatar and banner, presence status.
Purpose: creating and maintaining the Account, logging in, two-factor authentication, password reset, Player profile.
Legal basis: performance of the contract for maintaining the Account (Article 6(1)(b) GDPR).
How long: until the Account is deleted; backups are overwritten after 14 days.

We do not collect phone numbers or gender.

Public profile

Data: nickname, flag, avatar, banner, game and role, Teams, date joined, tournament history, statistics (matches, win/loss record, win rate), trophies, unlocked achievements, ranking points and position in the game ranking of your country, your nickname and best scores in Games zone rankings and bans (without reasons; warnings are not shown publicly). Active temporary and permanent bans are also shown on the public ban list (flag, nickname, ban type and scope, end date – without the reason). Only you can see your progress towards achievements you have not unlocked yet.
Purpose: presenting the Player and the course of competitions to the community.
Legal basis: performance of the contract (Article 6(1)(b) GDPR); as regards bans – our legitimate interest in ensuring the integrity of competition (Article 6(1)(f) GDPR).
How long: until the Account is deleted; expired bans disappear from the profile 24 months after their expiry. Achievements and points are deleted together with the Account. After the Account is deleted the Player disappears from rankings, Games zone rankings and the ban list; for the ELO rating see "Rankings and achievements".

Rankings and achievements

Data: ELO rating of Teams and Players in each game, calculated automatically from confirmed results of Official Tournaments and ranked Team challenges (Community Tournaments do not count); Player points – from the ratings of the Teams in whose match roster the Player played in the last 12 months; position in the game and country ranking; a log of rating changes (match, value before and after); unlocked achievements and progress towards them (e.g. matches without a dispute, days without a Penalty).
Purpose: rankings, seeding participants in tournaments, assigning league divisions, matching opponents in challenges, achievements on the profile.
Legal basis: performance of the contract (Article 6(1)(b) GDPR); for public rankings – our legitimate interest in transparent competition (Article 6(1)(f) GDPR).
Profiling: the ELO rating is an automated assessment of your results in the game (profiling). It has no legal or similarly significant effects on you: it affects bracket seeding, the suggested division and opponent suggestions in challenges, and the rules are public on the How the ranking works page. Corrections after a revoked result or disqualification are made by a person. You may object (section 8) – we will consider it, but results of matches you played remain part of other participants' rankings.
Who can see it: the ranking (position, nickname, flag, number of matches, record, points) and unlocked achievements – everyone; a permanent ban removes the Player from the ranking while it is in force.
How long: the rating and its change log – like tournament results (indefinitely, as competition history); after the Account is deleted they stay with the anonymised Account and are not shown anywhere; points and achievements – until the Account is deleted.

Player Passport

Data: Steam identifier (SteamID64), Discord account identifier and name, identifiers in other games and platforms (e.g. Riot ID, Epic Games, BattleTag, EA ID, Wargaming, Xbox, PSN), their verification status.
Data retrieved from Steam: information on VAC and Game Ban bans and the age of the Steam account – upon linking and then once a week if the Account has taken part in a tournament within the last 90 days; number of hours played – once, only when adding a Listing and only if the Steam profile is public.
Discord: if you link a Discord account and join the PlayZeek Discord server, we also use your Discord identifier to: (a) assign roles on that server based on your activity on the Service (verified Account, tournament participation, captaincy, tournament win, Staff function), (b) send direct messages with Service notifications (check-in open, match ready, match server ready, result to confirm, league match times, registration opening and tournament start, Team invitation) – only if you enable them in notification settings; they are off by default. A message contains the type of event, public match or tournament data and a link. Whether you are a member of the server is checked with Discord on the fly and not stored permanently (cache of up to 15 minutes). Legal basis: Article 6(1)(b) GDPR (performance of the service). Unlinking Discord in the Passport stops role assignment (the bot removes the roles at the next synchronisation) and messages.
Purpose: verifying game accounts, admitting players to tournaments, preventing cheating and multi-accounting, presenting experience in a Listing.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) as regards linking accounts; our legitimate interest in ensuring the integrity of competition (Article 6(1)(f) GDPR) as regards checking bans and account age.
How long: until the game account is unlinked or the Account is deleted. After the Account is deleted, game identifiers are erased and, if a Penalty was in force at the time of deletion, only their cryptographic hash remains on the ban list (§ 5(9) of the Terms).

Account security and multi-account detection

Data: a random device identifier stored in the pz_device cookie and a coarse IP address prefix (/24 network for IPv4, /48 for IPv6), recorded at most once per day for the device of a logged-in Player; a computed "account uniqueness" signal (low, medium, high).
Purpose: detecting multi-accounts and Penalty evasion.
Legal basis: our legitimate interest in ensuring the integrity of competition and the security of the Service (Article 6(1)(f) GDPR).
Important: we do not use browser fingerprinting based on graphics, fonts or WebGL. These signals are visible only to the security team and no one is blocked automatically on their basis; the decision is always made by a human. We know that siblings or residents of a student dormitory may look like a multi-account, which is why the signal is never decisive on its own.
How long: 12 months from recording; entries of an Account that is a party to an open security case – until the case is concluded.

Sessions and logs

Data: IP address, browser identifier (User-Agent) and time of last activity of a logged-in session; in the administration event log – decisions of Staff (referees, moderators, administrators) together with the IP address of the person performing them; in server logs – IP address, browser identifier, requested page address, time and response code.
Purpose: keeping you logged in, Account security, accountability for Staff decisions, and for server logs – Service security, detecting abuse and diagnosing errors.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) as regards sessions; our legitimate interest in security and in being able to demonstrate the grounds for decisions (Article 6(1)(f) GDPR).
How long: a session expires after 120 minutes of inactivity, and we delete its record no later than 30 days after expiry; event log – 3 years from the event, except for entries concerning Penalties still in force and open cases, which we keep until they are concluded. Server logs – 14 days.

Teams

Data: roster, roles, public roster history (who, when, what change, who made it).
Purpose and legal basis: running Teams and transparency of rosters in tournaments; performance of the contract (Article 6(1)(b) GDPR).
How long: for as long as the Team exists; after the Account is deleted, the entries remain and we replace the nickname with the text "Deleted player".

Official Tournaments

Data: registrations (including league seasons and division assignment), check-in, match rosters, map vetoes, proposed match times, results, scoreboard screenshots, match room content (on the Service: the match lobby chat), protests and evidence (screenshots, demo files, links), referee decisions, the match broadcast crew (streamer and commentators chosen by the referee or organiser – nickname shown on the match page) and the crew's conversations with the referee.
Purpose: running the tournament, resolving disputes and appeals.
Legal basis: performance of the contract for participation in the tournament (Article 6(1)(b) GDPR); as regards evidence – our legitimate interest in resolving disputes (Article 6(1)(f) GDPR).
How long: match room attachments (screenshots, demo files) – 90 days from the confirmation of the result; the content of the room – for a further 365 days (455 days in total); a room in which there was a dispute, protest, walkover or Penalty – 730 days. Evidence in open cases is not deleted until those cases are concluded. Results, trophies and statistics are public and stored indefinitely as competition history.

Challenges

Data: the challenge (challenging and challenged Team, type – friendly or ranked, proposed and accepted time, format, mode, map pool, who sent and who accepted it), the challenge message (up to 300 characters) and, once accepted, the same as in "Official Tournaments" (match roster, match lobby, result).
Purpose and legal basis: enabling matches outside tournaments and running the challenge ranking; performance of the contract (Article 6(1)(b) GDPR).
Who can see it: a direct challenge – the captains and managers of both Teams; an open challenge – everyone, on the public challenge list, and its message – the captains and managers of Teams of the same game; a played challenge match – everyone, in the Team's match history marked "Challenge", and ranked matches also in the challenge ranking (Team, number of matches, record). A word filter applies to challenge messages and a message can be reported to moderation.
How long: a challenge not accepted, declined or cancelled – 30 days after it expired, was declined or cancelled; a played match – like tournament results; the message of an accepted challenge – 30 days after the match or its cancellation; the match lobby – as in "Official Tournaments". A challenge concerned by an open report or appeal is not deleted until the case is concluded.

CS2 match servers

Data: Steam identifiers of admitted players (passed to the server provider), player connections and disconnections (Steam identifier, in-game nickname), map and round results, player statistics (including K/D/A, ADR, HS%) and the match recording (demo) made by the match server: Steam identifiers and nicknames of players on the server, their movements and in-game chat.
Purpose: running the match, controlling access to the server, automatic result reporting, statistics; the recording – resolving disputes and protests about the match.
Legal basis: performance of the contract (Article 6(1)(b) GDPR); the recording – our legitimate interest in resolving disputes (Article 6(1)(f) GDPR).
How long: as for tournament results; after the Account is deleted, statistics remain and we replace the Steam identifier with a hash. The match recording is kept only by the server provider, for 14 days after the match; the Service does not download it or share it with other Users. We access it only to resolve a dispute or protest about that match. You may object (section 8). Demo files attached by participants as evidence are stored like the match room.

Prizes

Data: data needed to award a prize, collected via a Ticket in the "Prizes and payments" category: first and last name and bank account number (cash prize) or delivery address (material prize); for minor participants – data of the legal representative and their consent.
Purpose: awarding the prize.
Legal basis: performance of the contract for participation in the tournament (Article 6(1)(b) GDPR); as regards storage after the prize is awarded – our legitimate interest in defending against claims (Article 6(1)(f) GDPR).
How long: until the prize is awarded, and then for the limitation period for claims relating to the prize.

Community Tournaments

Data: the tournament, its participants and results, the reputation of the Community Organiser (number and percentage of completed tournaments, average rating), ratings given by participants.
Purpose and legal basis: providing tools for running tournaments and transparency of organisers; performance of the contract (Article 6(1)(b) GDPR).
Note: the Operator is not the organiser of these tournaments. If a Community Organiser collects data from participants outside the Service (e.g. to settle prizes), the Community Organiser is itself responsible for processing that data.

Custom Brackets

Data: name, game and list of participants entered by the creator (these may be nicknames or data of third parties); owner token in a cookie, stored in the database only as a hash; hash of the IP address of the creator and of the person reporting, calculated for daily abuse limits.
Purpose: making the bracket available and protection against abuse.
Legal basis: providing the bracket service at the creator's request (Article 6(1)(b) GDPR); as regards the data of persons entered by the creator and abuse limits – legitimate interest (Article 6(1)(f) GDPR).
Source of the data of persons entered in the bracket: the creator of the bracket. A person entered in a bracket may report it for moderation or request the deletion of their data.
How long: 90 days from the last change to the bracket, unless it is pinned to an Account.

Listings board

Data: content of the Listing, nickname, game and role; for a public Steam profile – a one-time snapshot of the number of hours played. Age is not shown.
Purpose and legal basis: enabling users to look for a team, player or coach; performance of the contract (Article 6(1)(b) GDPR).
How long: up to 90 days; we also delete Listings when the Account is deleted.

Messenger

Data: message content, attachments, friends list, blocks and mutes, read receipts, online status (activity in the last 5 minutes).
Purpose and legal basis: enabling communication; performance of the contract (Article 6(1)(b) GDPR).
Oversight: Staff have no access to private messages or team channels. When a participant in a conversation reports a message, a copy of that message is passed to a moderator together with context (by default, 5 preceding and 2 following messages). A word filter operates in match rooms and tournament channels.
How long: private messages, team channels and tournament channels – 30 days from sending; attachments in channels – 7 days; match rooms (the match lobby chat) and broadcast crew channels – as in the "Official Tournaments" part. Copies of reported messages – as for Tickets.

Tickets

Data: reply email address, category, subject, description, optionally the tournament and match identifier, attachments (up to 4 files); for a report of illegal content, also the name of the person reporting, the address of the reported content and a declaration of good faith (for reports concerning child sexual abuse, the reporter's details are optional).
Purpose: handling enquiries, complaints, reports of violations, appeals and requests concerning personal data.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) in matters concerning Players; our legitimate interest in handling correspondence (Article 6(1)(f) GDPR) in other matters; legal obligation (Article 6(1)(c) GDPR) for requests concerning personal data and reports of illegal content.
How long: attachments – 90 days from the closing of the case; the thread, including copies of reported messages and Listings – 365 days from closing. Open cases (dispute, appeal) are not deleted until they are concluded.

Penalties, moderation decisions and appeals

Data: type, scope, duration and justification of the Penalty, its source (a human decision or an automatic threshold), the events that led to it; moderation decisions concerning content (hiding a message, taking down a Listing, tournament or bracket) with their statement of reasons; appeals and decisions on them.
Purpose: enforcing the Terms and preventing Penalty evasion.
Legal basis: performance of the contract (Article 6(1)(b) GDPR) and our legitimate interest in ensuring the integrity of competition and the safety of Users (Article 6(1)(f) GDPR).
How long: permanent bans and their reasons – for as long as they are in force, including after the Account is deleted, because otherwise a Penalty could be evaded by creating a new Account; warnings, temporary bans and revoked bans – 3 years from their expiry or revocation; moderation decisions concerning content – 3 years from the decision or its reversal. Cases with an open appeal are not deleted until they are concluded. Expired bans disappear from the profile 24 months after their expiry.

Streams

Data: the name of the Twitch or Kick channel connected to the Service by a tournament organiser and, retrieved from the platform every minute: whether the channel is live, the number of viewers, the stream title and category. If you click "Notify me" next to a scheduled stream – the link between your Account and that stream.
Purpose: showing tournament streams and their schedule; reminding you about the start of a stream you asked about.
Legal basis: our legitimate interest in informing about competitions in the Service (Article 6(1)(f) GDPR) – for channel data that the broadcaster publishes on the platform; performance of the contract (Article 6(1)(b) GDPR) – for the reminder.
How long: channel data – until the stream is removed from the Service; reminder – until the notification is sent, at the latest 3 hours after the scheduled start of the stream (also when you delete your Account or the organiser removes the stream).

Notifications

Data: email address, notification settings (including sound, its volume and browser notifications), notification content.
Purpose and legal basis: informing you about matters requiring your action (invitations, check-in open, match ready, referee calls, walkovers, disputes, Team challenges, replies to Tickets) and – unless you turn them off – about tournaments, achievements and streams for which you click "Notify me"; performance of the contract (Article 6(1)(b) GDPR). We do not send marketing emails.
Sending emails: we send emails through the email provider Brevo (section 6). The provider keeps a delivery log (recipient address, subject, time and delivery status) for 1 month – without the content of the message. Links in an email may lead through the provider's server, and the message may contain an invisible element that records its opening. We have anonymisation switched on: opens and clicks are not linked to your address or IP address and we do not use them for any analysis.
Browser notifications: while a Service tab is open we may play a sound and – if you allow it in your browser – show a system notification. Your browser displays it based on what the tab received from the Service; we do not use push notification services and do not store any data in your browser. You withdraw permission in your browser settings, and turn off sound and notifications in your Account settings.
How long: notifications on the Service (the bell) – 12 months after they are created; settings – until the Account is deleted.

Integrations

Discord webhooks: a Team captain or manager and the organiser of a community tournament (for an Official Tournament – the administration) can provide the webhook address of a Discord channel. We send short messages about Team or tournament events to it (registration, check-in, match ready, result, walkover) – they contain only public data: Team and tournament names, nicknames from the match roster (in a 1v1 tournament – the registered Player's nickname) and the result. We store the address encrypted, because it contains a key to the channel. Purpose and legal basis: notifications requested by the Team or organiser; performance of the contract (Article 6(1)(b) GDPR). The person who provided the address decides which Discord server receives the messages. How long: the address – until it is removed or the Team or tournament is deleted; the delivery log (without response content) – 30 days.
Calendars: tournament and Team calendars contain public data (match times). The private Account calendar ("my matches", followed tournaments) opens via an address with a random key – anyone who knows the address can see your schedule, so do not share it; a new address invalidates the old one. We store only a hash of the key. Legal basis: performance of the contract (Article 6(1)(b) GDPR). How long: the key – until it is changed or the Account is deleted.
Overlay and embedding: pages for embedding on other websites (bracket, match result) show only public tournament data and do not store any cookies in your browser.

Games zone

Data: when you play while logged in – the round (game, mode, start and end time, score, round statistics, whether we accepted the score) and your best score in each game and mode: all-time and for the current week. In a match against another player – the opponent, moves, time per move, presence signal (to detect disconnection), result and reason the match ended, and in the "looking for an opponent" queue – the time of the last refresh; after the match only your record of wins, draws and losses remains. Without an Account the game runs entirely in your browser and nothing reaches us.
Purpose: running the game and rankings (Article 6(1)(b) GDPR – a service you use) and protecting rankings against impossible scores (Article 6(1)(f) GDPR – our legitimate interest in a fair ranking). A suspiciously high score is checked by a person before it enters the ranking.
Who can see it: in the game ranking (weekly and all-time, including the record of matches against other players) – your nickname and best score, visible to all visitors. In a match – your opponent sees your nickname; a match invitation is a link with a one-time code valid for 10 minutes, and its recipient sees the inviter's nickname. Matches have no chat.
How long: a round – 7 days; best score of the week – 8 weeks; best all-time score and match record – until the Account is deleted; a match against another player – 7 days after it ends; an unaccepted invitation – one day after it expires; a queue entry – one hour without a refresh.
The ranking is for fun only – no prizes and no legal effects.

4. Automatically imposed Penalties

Some Penalties are imposed by the system when the thresholds described in § 15(5) of the Terms are exceeded, for example a 7-day tournament ban after three late check-ins within 30 days or a tournament ban after two no-shows at a match, including in a challenge. Such a Penalty is a decision based on automated processing. We apply it because it is necessary for running tournaments in accordance with the contract, and we base it solely on events in the Service (check-in, attendance at a match, withdrawal, messages deemed offensive by Staff).

You can appeal against any automatic Penalty. The appeal is considered by a human: you can present your position and contest the decision, and a Penalty overturned on appeal disappears from the profile. Apart from automatic Penalties, we do not make decisions about you based solely on automated processing. Security signals (device fingerprint, "account uniqueness", VAC bans) are always assessed by a human. Rankings and seeding by ranking are also calculated automatically from results, but they are not a decision with legal effects on you; ranking corrections (e.g. after a disqualification) are made by a person.

5. Do you have to provide data

Browsing the Service does not require providing any data. An email address, a password and the age declaration are necessary to create an Account. Linking game accounts is voluntary, but without it you will not be able to take part in tournaments that require it. Date of birth is needed only for age-restricted tournaments. The data needed to award a prize is necessary in order to receive it.

6. Who we share data with

Our providers (processing data on our behalf)

netcup GmbH, Germany – the server (VPS) on which the Service and the database run.
Cloudflare, Inc., USA – handles every connection to the Service (reverse proxy, content delivery network, protection against attacks, domain name service). It passes data between your browser and our server, so it processes everything you send and receive, including your IP address, request headers (e.g. browser identifier, page address) and the Service's cookies. We also keep backups of the database and files in the Cloudflare R2 service – in storage in the European Union, encrypted before they leave our server (Cloudflare has no key to read them); each backup is deleted after 14 days.
Cloudflare Turnstile – on the registration, contact and password reset pages, the Cloudflare Turnstile service checks whether a form is being sent by a human rather than an automated tool. For this purpose it processes technical signals from the browser (including the IP address, browser identifier and the results of browser behaviour tests) – it does not read the content of the form and is not used for tracking, profiling or advertising. Purpose: protecting forms against bots; legal basis: our legitimate interest in the security of the Service (Article 6(1)(f) GDPR). Cloudflare may also use these signals as an independent controller to improve bot detection, under its own privacy policy.
Sendinblue SAS (Brevo), France – sending emails from the Service: the recipient's email address, the subject and content of the message (see "Notifications").
DatHost AB, Sweden – CS2 match servers; receives the match configuration with the Steam identifiers of admitted players and sends the course of the match to the Service; it also stores match recordings (demos) – see "CS2 match servers".

Independent controllers

Valve Corporation (Steam), USA – when you link your Steam account, we redirect you to log in to Steam, and then we send your Steam identifier to the Steam Web API to retrieve information on bans, the account age and – for a Listing – the number of hours played. Valve processes this data in accordance with its own privacy policy.
Discord Inc., USA – when you link your Discord account, we redirect you to log in to Discord; if you join the PlayZeek Discord server, the bot assigns roles there and – if you enable them – sends direct messages (see "Player Passport"); we send the messages described in "Integrations" to webhook addresses provided by Teams and organisers. Discord processes data in accordance with its own privacy policy.
Twitch Interactive, Inc., USA and Kick Streaming Pty Ltd, Australia – only if you click "Turn on the player" on the Streams page: your browser then connects directly to the platform, which receives your IP address and browser information, stores its own cookies and processes data in accordance with its own privacy policy. We do not pass any data about you to the platforms and we do not receive data from them about what you watch. Messages you write in the embedded chat go only to the platform.

Other recipients

Other Users and any visitor can see the public data listed in the "Public profile" part and the results of tournaments and played challenges.
The Games zone ranking (nickname and score), game rankings and the list of active bans are available to all visitors.
Participants in a conversation can see messages in the Messenger; referees and the administration can see the content of match rooms and tournament channels.
Public authorities – where required by law, including in the event of a suspected crime threatening life or safety.

7. Transfers of data outside the European Economic Area

Valve and Discord have their registered offices in the USA. The transfer of data to these companies is based on the decision of the European Commission finding an adequate level of protection under the EU–US Data Privacy Framework, to which both companies have acceded.

Cloudflare has its registered office in the USA and its proxy servers operate worldwide: a connection is usually handled by the server closest to you, but data may also reach the USA and other countries. The transfer is based on the same decision of the European Commission (Cloudflare has acceded to the EU–US Data Privacy Framework) and, as a fallback, on the standard contractual clauses in our data processing agreement with Cloudflare. We keep backups in Cloudflare R2 in the European Union. Brevo stores data on servers in France and Belgium (EEA); some of Brevo's sub-processors operate in the USA (including Cloudflare and Zendesk) and in India (a Brevo group company – customer support and maintenance). Transfers to them are based on the standard contractual clauses in our data processing agreement with Brevo and, for some of the sub-processors in the USA, also on the EU–US Data Privacy Framework. You can obtain a copy of the safeguards used for transfers outside the EEA by writing to [email protected].

8. Your rights

You have the right of access to your data, the right to rectification, erasure, restriction of processing and data portability, and the right to object to processing based on our legitimate interest.

Data export: in the privacy settings; the file is ready shortly, and the download link is valid for 7 days.
Account deletion: in the privacy settings, with password confirmation. You can undo the deletion within 14 days. After that: we change the nickname to "usuniete-{id}" and the email address to a non-existent address, and we delete personal data and images. In roster history, match records, entries in solo tournaments, Tickets, copies of reported content and the event log, we replace the nickname with the text "Deleted player". We erase Listings, unpin Custom Brackets (they expire after 90 days), erase game identifiers (if a Penalty was in force – after adding their hashes to the ban list), and statistics from match servers remain with the Steam identifier replaced with a hash. We also delete achievements, ranking points, Games zone scores and matches, stream reminders and places in broadcast crews, and replace the content of your messages to Team challenges with a marker; the ELO rating and its change log stay with the anonymised Account as part of other participants' competition history. We delete message content in accordance with the periods set out in section 3, because it is also part of other people's conversations and evidence in disputes. Staff notes and Penalty justifications are reviewed and redacted manually by an administrator.
Other rights: via the "Personal data (GDPR)" category on the Contact page, also without logging in. We respond within one month; in complex cases this period may be extended by two months, and we will inform you of this within the first month.

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa.

9. Age

An Account may be created by a person who is at least 16 years old. We do not ask for date of birth at registration; instead, we rely on a declaration. If we learn that an Account was created by a younger person, we will delete it. Minors take part in tournaments with prizes with the consent of their legal representative.

10. Cookies and browser storage

We use only cookies and browser storage that are necessary to provide the services you request and to ensure the security of those services. We do not use analytics or advertising cookies. Third-party cookies are stored only by the stream player, and only after you click (described below). We do not use analytics tools, tracking pixels or reCAPTCHA protection, and fonts are served from our own server.

Cookies

playzeek_session – maintains the session and keeps you logged in; up to 120 minutes from your last activity.
XSRF-TOKEN – protects forms against someone impersonating you; up to 120 minutes from your last activity.
remember_web_… – remembers your login, only if you tick "Keep me logged in"; 30 days.
pz_locale – remembers the selected language; 365 days.
pz_device – a random device identifier of a logged-in Player, used solely to detect multi-accounts and Penalty evasion, i.e. for the security of the tournaments you take part in; 12 months.
pz_bracket_{kod} – owner token of a Custom Bracket that allows it to be edited; 2 years.

Browser storage

localStorage – remembers whether the friends panel is expanded.
sessionStorage – remembers which chat windows are open; cleared when the tab is closed.

Cloudflare cookies

Cloudflare, which protects the Service against attacks, may in an exceptional situation – e.g. during an attack on the Service – check that a browser rather than an automated tool is connecting. After a successful check it stores the cf_clearance cookie (confirmation of the check; 30 minutes). It is used only for the security of the Service and not for tracking. We have no other Cloudflare cookies switched on (e.g. for bot detection, load balancing or serving pages in emergency mode).

The Cloudflare Turnstile check on the registration, contact and password reset pages (section 6) runs in a Cloudflare frame, which may use browser storage for the duration of the check; we do not use the option in which Turnstile stores a cookie on the Service's domain. The check is necessary for the security of these forms.

Stream players (Twitch, Kick)

On the Streams page you first see our preview and a "Turn on the player" button. Only a click loads the player and chat of the broadcaster's platform (Twitch or Kick). The platform then stores its own cookies and similar data in your browser – their list, purpose and retention period are given in that platform's privacy policy. Clicking the button next to this information is your consent to loading the player; we do not remember it, so on your next visit the player waits for a click again. You can withdraw your consent by closing the page and deleting the platform's cookies in your browser settings. Without clicking, you can open the stream directly on the platform's website.

Why we do not ask for consent

The law requires consent for storing information on your device, unless this is necessary to provide a service you request; the exception is the stream player described above, which we load only with your consent given by a click. All the other items listed meet this condition: they are used for logging in, protecting forms, remembering your choices, the security of tournaments and the Service or editing your bracket. You can delete or block cookies in your browser settings; without session cookies you will not be able to log in to your Account.

11. Changes to the policy

We will inform you of material changes by email and by a notice in the Service at least 14 days in advance. This policy is effective from the date shown with its text; previous versions are available in the version archive.