Legal
Privacy Policy
The data we process for the playtest program, why, who can access it, how long we keep it, and your rights.
Last updated: 2026-07-10
The French version of these documents is the authoritative reference. This English version is provided as a courtesy translation.
1. Who we are and scope
The data controller is ANKLEBREAKER CONSULTING, a Simplified joint-stock company (SAS under French law) with its registered office at 34 Rue du Président Wilson, 78230 Le Pecq, France (RCS Versailles 912 705 860), which operates the AnkleBreaker playtest platform.
This policy describes how we process your personal data within this program, in accordance with the EU General Data Protection Regulation (GDPR) and the French Data Protection Act.
The program is not open to children. You must be at least 16 to create an account, and at least 18 to take part in a playtest covered by a confidentiality undertaking, since that undertaking is a contract. If we learn that an account belongs to someone below those ages we delete it.
2. Data we collect
We collect only the data needed to administer the program:
- Steam: your Steam ID and public profile (display name, avatar).
- Discord: the “identify”, “email”, and “guilds.join” permissions.
- The email address used to apply and communicate.
- The profile you provide: CPU, GPU, RAM, operating system, country, timezone, languages, availability, and any biography, gameplay preferences, or favourite games you choose to add.
- If you apply as a content creator: your channel or profile links, your audience range, and — where you connect a channel for verification — the handle returned by that platform.
- Application, progress, XP, reward, and quest data, along with your playtest feedback.
- Play and reliability data for the games you are given access to: session activity, and a trust score used to review applications (see section 4).
- Technical anti-abuse data: a hashed form of your IP address and browser user-agent, kept with the record of your acceptance of these documents and used to rate-limit sign-ups.
- Email delivery data: whether a message we send you was delivered, bounced, opened, or its links clicked.
3. How we use your data, and on what legal basis
We use this data to administer your participation: process your applications, route you to playtests, grant keys and Discord access, communicate with you, and prevent abuse.
Preventing abuse includes detecting alternate accounts and ban evasion, through the linking of your accounts (see section 4).
Under Article 6 GDPR, each purpose rests on one of the following:
- Performance of the agreement between us (Article 6(1)(b)): running your account, reviewing your applications, delivering keys and Discord access, and sending you the transactional messages the program requires.
- Our legitimate interests (Article 6(1)(f)): preventing abuse, detecting alternate accounts and ban evasion, protecting confidential builds, and measuring whether our transactional emails are delivered and read so we can fix delivery problems. You may object to processing based on this ground — see section 8.
- Your consent (Article 6(1)(a)): optional messages such as the newsletter, and any non-essential cookie. You may withdraw consent at any time, without affecting processing carried out before you did.
- Compliance with our legal obligations (Article 6(1)(c)): accounting and record-keeping duties, and responding to lawful requests.
4. Account linking and identity graph
We may associate your Steam, Discord, and email accounts under a single identity. This linking is used to administer the program and to prevent ban evasion.
As a result, a program decision such as a ban applies to all accounts linked to your identity, and accounts sharing common signals may be flagged as possible “alts” for review by an operator.
We also compute a trust score from your play and moderation history across the games we run, and show it to operators when they review your application. Applications are accepted or rejected by a human operator; the trust score and alt flagging inform that person, they do not decide.
One decision is automated. Our anti-cheat system counts corroborating cheat reports against a player, and above a threshold it issues a ban by itself, without an operator reviewing it first. That ban is permanent by default, extends to every account linked to your identity, and may be reported to Steam. It stops you taking part in the program.
Because that decision is taken solely by automated means and significantly affects you, you have the right to obtain human intervention, to express your point of view, and to contest the decision (Article 22(3) GDPR). Write to us and a person will re-examine the ban, look at the reports behind it, and lift it if it was wrong.
5. Discord data and auto-join
With the “identify”, “email”, and “guilds.join” permissions, when you are accepted into a playtest we add your Discord account to the relevant game's private server and may assign you roles there.
We do not read your messages or direct messages. The Discord refresh token needed to add you is stored encrypted and is never shared with a third party.
6. Who can access your data, and transfers outside the EU
Your data is accessible to authorised AnkleBreaker Studio operators. When you apply to a game, the operators of that game can view your profile and application.
We also rely on the following providers, each of which receives only what its function requires:
- Amazon Web Services (hosting and email delivery) — European Union, Paris region.
- Discord Inc. (United States) — your Discord account identifier, so we can add you to a game's private server and assign roles.
- Valve Corporation (United States) — your Steam ID, to verify ownership and deliver playtest access or keys.
- Cloudflare, Inc. (United States) — the anti-bot check on our sign-up forms.
- If you connect a creator channel for verification, the platform you choose (for example Twitch, YouTube/Google, TikTok, or Kick, some of which are established in the United States) — to confirm the handle you claim.
Our hosting and email infrastructure is in the European Union. The providers above that are established in the United States necessarily receive the data described alongside them, which is a transfer outside the EU. Those transfers are covered by the European Commission's Standard Contractual Clauses and, where the provider is certified under it, the EU-US Data Privacy Framework. You may ask us for a copy of the safeguards that apply.
We do not sell your personal data.
7. Retention
We keep your data while your account is active, and delete it on request. Concretely:
- Account, profile, and application data: kept while your account exists, and erased when you ask us to. We do not currently delete inactive accounts automatically — if you want yours removed, ask and we will do it.
- Ban and enforcement history: kept without a time limit, because a ban that expired from our records could be evaded by deleting an account and registering again. It is kept in a reduced form: identifiers and the fact of the sanction.
- Anti-abuse data (hashed IP and user-agent) and the record of your acceptance of these documents: kept without a fixed limit, as evidence that consent and the confidentiality undertaking were obtained.
- Email delivery and engagement data: kept without a fixed limit, as a record of what was sent to whom and whether it arrived.
- If you unsubscribe or a message bounces, we keep your email address on a suppression list for as long as we operate the program, for the sole purpose of not contacting you again. Deleting your account does not remove this entry, because removing it would let us email you by mistake.
- Accounting and legal records: for the period the law requires.
We are working on defined maximum periods for the categories above, after which the data will be deleted automatically. Until those are in place we have described what we actually do rather than a duration we do not yet enforce. You can ask for your data to be erased at any time — see section 8 — and that request is honoured regardless of the periods above.
8. Your rights
Under the GDPR you have the right to:
- access your data and obtain a copy of it (Article 15);
- have inaccurate data corrected (Article 16);
- have your data erased (Article 17);
- obtain restriction of processing (Article 18);
- receive the data you provided in a portable format, and have it transmitted to another controller where technically feasible (Article 20);
- object at any time to processing based on our legitimate interests — including alt detection and email engagement measurement — on grounds relating to your particular situation (Article 21);
- withdraw your consent at any time where processing is based on it, without affecting what was done before (Article 7(3));
- define directives on what becomes of your data after your death (Article 85 of the French Data Protection Act).
To exercise any of these rights, write to us at playtest@anklebreaker-studio.com. We answer within one month.
Providing a Steam account, a Discord account, and an email address is necessary to take part in the program: without them we cannot verify ownership, deliver access, or contact you, and an application cannot be processed. Everything else — biography, hardware, gameplay preferences, creator channels — is optional and its absence has no consequence other than a less informed review.
9. What deleting your account does, and what survives it
On deletion we remove or de-identify your account so you can no longer be identified from it. Concretely:
- your Steam and Discord identifiers, your email address, and the links between them are removed from your identity;
- your profile — display name, biography, hardware, preferences — is erased;
- the Discord access granted to you is withdrawn: we remove your account from the private servers we added it to;
- your applications and their answers are stripped of everything identifying you, and the operator notes written about you are deleted.
Two things deliberately survive, because deleting them would defeat the purpose of deleting the rest. The record that an application existed, and its outcome, is kept in de-identified form — it no longer points to you, and is used only for programme record-keeping. Ban and enforcement history is kept as described in section 7, without which a ban could be evaded by deleting an account and registering again.
Data whose retention the law requires — accounting records in particular — is also kept for the period prescribed.
If you took part in the program before it moved to the current player-identity system, some older records may be held separately from your identity. Ask us and we will locate and erase those too; if you want confirmation of exactly what was removed, we will give it to you in writing.
10. Security, complaint, and contact
We protect your data with access controls and by encrypting sensitive tokens (such as the Discord token) at rest. Where our providers are established outside the European Union, section 6 sets out which ones and on what basis.
You have the right to lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) if you consider that the processing of your data does not comply.
For any question or to exercise your rights: playtest@anklebreaker-studio.com.