BalancingAct.studio — Privacy Policy

Effective date: 19 October 2026
Last updated: 19 October 2026

1. Who we are

BalancingAct.studio (the Platform) is operated by Daniel Lawniczak, 3097 Liebefeld, Switzerland, contact daniel@BalancingAct.studio. The Operator is responsible for the processing described here, except where a different allocation of responsibilities is expressly disclosed.

Each game on the Platform, including its associated intellectual property, remains the property of its respective rights holders, which may include the game's designer(s), publisher, or other authorized parties, regardless of whether the game has been published. For the purposes of this Policy, the term “designer” refers to the game's designer(s) and/or publisher, as applicable. Designers are independent of the Operator and do not operate or control the Platform.

This policy describes how personal data is processed when you register, playtest games, submit feedback, or use the Platform. Swiss data protection law applies; the EU/EEA GDPR may also apply in relevant circumstances.

2. Personal data we process

Depending on the features you use, we process:

• Account data: email address, display name, password hash, account status, assigned roles and games, registration and login timestamps, and the time and version of the Terms of Service and this Policy you accepted.
• Gameplay data: game and engine version, session identifiers, participant identifiers, actions, decisions, game states, scores, outcomes, timestamps, durations, and replays.
• Feedback and support: feedback text, bug reports, messages, and related game or session identifiers.
• Technical and security data: IP addresses, kept only to limit repeated sign-in and registration attempts for the rate-limit window (at most one hour) and removed the next time that limit is checked; browser and device information and request details in server logs held by the hosting provider; authentication events; session cookies; and diagnostics.

We do not collect a separate preferences or analytics profile. Avoid including sensitive personal information in free-text feedback.

3. Why we process data

We use data to create and secure accounts; authenticate users; assign roles and games; provide game sessions; preserve states and replays; calculate results; enable playtest analysis and feedback follow-up; investigate errors; protect the Platform; communicate service-related information; and meet legal obligations.

Where the GDPR applies, legal bases may include contractual necessity for requested account and game functionality (Article 6(1)(b)), legitimate interests for proportionate security, troubleshooting, and game improvement (Article 6(1)(f)), legal obligations (Article 6(1)(c)), and consent where specifically requested (Article 6(1)(a)). The appropriate basis must be assessed for each activity. Under Swiss law, processing is subject to applicable transparency, proportionality, purpose limitation, and other requirements.

We do not sell personal data or share it with advertisers for their independent advertising purposes.

4. Who can access your data

4.1 Other players

Participants in a game may see information necessary for the game, such as player display names, moves, scores, and game state. A game's leaderboard, which players of that game can open, lists display names and results from completed games of that game. Player email addresses are never shown to other players.

4.2 Designers/Publishers of games you are assigned to

Authorized designers can access your email address when you are a member of a cohort of a game assigned to those designers. An administrator may assign you, the designer of that game may add your account, or you may join by entering a game code. From that membership, the designer may also access relevant display names, gameplay sessions, decisions, results, statistics, replays, and feedback for that game. You do not have to have played a session for the membership itself to make your email address visible to that designer.

A designer cannot access the email addresses or gameplay information of users who are not in a cohort of any game assigned to that designer merely because they have a designer account. If you are in cohorts of games assigned to several designers, each relevant authorized designer may see your email address and the data associated with their assigned games.

When a designer enters an email address to add an account to a cohort, the Platform indicates whether that address is registered.

Designers can download analytics exports for their games. An export can include display names and gameplay statistics. It is not a list of email addresses.

Designers may use this information to identify and coordinate with playtesters, analyze gameplay, investigate issues, and follow up on feedback. Designers may not use players' email addresses for unrelated marketing purposes or disclose them to unauthorized third parties, unless expressly permitted under a separate agreement between the respective player and designer outside the Platform, and in accordance with applicable data protection laws.

4.3 Administrators

Authorized administrators may access personal data as needed to manage accounts and games, maintain security, provide support, and operate the Platform.

4.4 Service providers

Infrastructure and communications providers may process data on our behalf under appropriate agreements and safeguards. The providers in use are named in section 7.

5. Replays and game histories

The Platform can retain sequences of actions and game states so sessions can be analyzed or replayed. Replays and saved game states can include the display name used in that game. Replays may remain personal data even if direct identifiers are removed, where players can still be identified. Access is restricted according to game participation, cohort membership, and role permissions.

6. Cookies and tracking

We use necessary cookies for authentication, session continuity, and security. We do not use analytics or advertising cookies.

7. Service providers and international transfers

BalancingAct.studio uses Render for application hosting, database storage, and backups, and Resend for transactional emails, such as account confirmation and password-reset codes. These providers may process personal data in the United States and other countries where they or their subprocessors operate.

Where personal data is transferred internationally, we rely on applicable adequacy decisions, including the Swiss–US and EU–US Data Privacy Frameworks for appropriately certified organizations, or other legally recognized transfer mechanisms.

For transfers to countries or recipients not covered by an applicable adequacy decision, we use appropriate safeguards as required by Swiss and EU data protection laws, such as standard contractual clauses and supplementary measures where necessary.

Copies of the production database may be made for testing and development on the Operator's systems and the Platform's test environment, under the same access restrictions.

8. Retention and deletion

We retain personal data only as long as necessary for the purposes described in this Policy or as otherwise permitted or required by law. Gameplay data may be retained indefinitely to support ongoing game development, analysis, and replay functionality, subject to applicable data protection rights and obligations.

You may request account deletion by emailing daniel@BalancingAct.studio. We will delete or anonymize personal data where required, subject to lawful retention needs. Deleting an account removes the account and the seats, feedback, and drafts tied to it. A stored game state or replay may still contain the display name used in that game, and the match record is kept. A game replay or feedback entry that can still identify you remains personal data and must be treated accordingly. Backups may be deleted on a defined rotation, subject to access restrictions and applicable law.

9. Data security

We use appropriate technical and organizational safeguards, including access controls, secure authentication, encryption in transit, and measures for monitoring, backups, and incident response as applicable. No online service can guarantee absolute security.

10. Your rights

Depending on applicable law and circumstances, you may request access to, correction or deletion of, or information about your personal data; object to certain processing; request restriction or portability where applicable; and withdraw consent where processing relies on consent. Legal exceptions may apply. Contact daniel@BalancingAct.studio to exercise your rights; we may verify your identity.

You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC/EDÖB) and, where relevant, an EU/EEA supervisory authority.

11. Automated game calculations

Games may automatically calculate scores, outcomes, and statistics. These are intended as gameplay functions, not decisions producing legal or similarly significant effects on individuals. We will update this Policy before introducing any profiling or automated decision-making.

12. Children

The Platform is intended for users aged 16 or older. We do not knowingly solicit registrations from users below the applicable minimum age. The registration form does not ask for a date of birth. If we learn that an ineligible child has registered, we will take appropriate steps in accordance with applicable law.

13. Policy changes

We may update this Privacy Policy to reflect changes in processing or applicable law. We will publish the current version and give additional notice or seek consent where legally required.

14. Contact

Daniel Lawniczak
3097 Liebefeld, Switzerland
daniel@BalancingAct.studio