Privacy notice

Effective date: 25 September 2026 Controller Group Play, Cloooncoose North, Castlerea, Co. Roscommon, Ireland. Privacy contact: contact@groupplay.com; alternative: dragosloghin2@gmail.com. The service is for people aged 18 or older. Data collected We store email, display name, a one-way password hash, verification/account status, hashed server session tokens, device labels and session dates. Room data includes ownership, membership, titles, queue links, invitations and playback state. We store playlists, chat, reports and security audit events including IP address and time. Registration records confirm age eligibility and terms revision without asking for date of birth or an identity document. Audio and direct connections Current sharing features do not upload audio files to Group Play. External audio is fetched from its source. Direct device streaming exchanges temporary connection descriptions and IP candidates through our signalling service; audio travels between participants, who can learn one another's network addresses. We retain metadata, not an audio recording. Any historical files stored before uploads were disabled require a separate operator inventory and retention decision. Purposes and legal bases Account, invitation and room processing provides the service you request under our agreement. Proportionate security and abuse investigation rely on legitimate interests in protecting users and the service, subject to your rights. Binding legal obligations provide a separate basis where applicable. Optional advertising tracking requires consent where the law requires it; agreeing to the terms is not advertising consent. Recipients Authorised company administrators manage accounts, investigate reports and make purpose-recorded exports. Invited participants see room titles, links, display names and chat. Hosting and email providers process information needed to operate the service. External audio and artwork providers receive network requests and may process IP/device data under their own policies. If enabled and permitted by consent choices, Google and vendors identified by its consent interface process advertising information. We do not sell account details. International transfers External providers may operate outside the EEA. Before enabling a transfer, Group Play must document the provider, destination, adequacy decision or other safeguards such as standard contractual clauses and any necessary supplementary measures. Ask the privacy contact about actual transfers. This notice does not assert that unconfigured providers or safeguards are already in place. Retention and deletion Records are kept while needed for the service and proportionate security or legal purposes. Automatic chat and security-log deletion is disabled by the operator. Records are reviewed and deleted manually when no longer necessary; no automatic deletion schedule is active. Account erasure is available through authorised administration following a verified request. A documented, time-limited legal hold can defer erasure for a legitimate matter and must be reviewed. Backups and hosting/email logs require their own documented retention schedule. Temporary connection signals are short-lived and expired connection data is unavailable to room participants. Contact us for current retention details before submitting sensitive information. Your rights Depending on the circumstances you may request access, a copy, correction, erasure, restriction, objection or portability. Withdraw optional advertising consent at any time without affecting prior lawful processing. Contact us, preferably from your registered email; identity checks must be proportionate. We normally respond within one month and explain any lawful extension. Legal obligations or the establishment, exercise or defence of claims may limit erasure; we explain applicable limitations. You may complain to the Irish Data Protection Commission at www.dataprotection.ie or your competent supervisory authority. Security and disclosure Passwords are hashed and administrative APIs require a Master session; exports and account actions are audited. Security cannot be guaranteed. Production must use HTTPS and restrict administrator, database and backup access. Legal requests are assessed for authority, jurisdiction and scope; a request alone does not authorise disclosure. This version does not use automated decisions producing legal or similarly significant effects. Changes We publish a dated notice and retain revision history. Material changes are brought to your attention as appropriate. Contact messages When you use Contact us, we store your supplied name, email, subject and message in the private company inbox to handle your enquiry. Signed-in messages include your account ID; guest email addresses are unverified. We use a keyed hash of the connection IP, expiring one-use challenges and submission limits to deter spam. Challenge records and messages currently have no automatic deletion schedule and require manual retention review. Contact records linked to an account are included in its access export and permanent erasure, subject to applicable holds. News thumbnail images may be loaded from the image host chosen by the company, which receives the network request.