Privacy

You never need an account to play a public JoTo game. This page is about JoTo accounts only: what one keeps, why, for how long, and how to have it removed. For the games and joto.games, see the studio's privacy policy.

Parts marked Coming are being built. They are described now so you know before they arrive. Nothing marked that way is kept yet.

Who is responsible

JoTo Games, Rotterdam, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 73863157. Write to info@joto.games.

What an account keeps

Your name in games

• A name JoTo picks for you when you make an account. Not your Google name.
• A name you choose instead, on your account page: 2 to 20 characters, and it does not have to be unique. JoTo can reset a name that is offensive or someone's personal details. JoTo does not keep your earlier names.
• Coming Other players see your name on the TV and in games when you play signed in.

Your friend code

• A code that belongs only to your account, for you to share with friends, or with JoTo to get access to a game. It is not your account's ID. You can replace it on your account page, and the old one stops working straight away; JoTo does not keep it.

How you sign in

• Google: your email address and Google's ID for your Google account, so you can sign in again.
• Discord: Discord's ID for your account and the email address Discord gives us, for the same reason. JoTo asks Discord for those two things only. If Discord has not verified that email address, it cannot make a JoTo account or join one.
• An emailed code: your email address. JoTo emails a 6-digit code and a sign-in link from no-reply@joto.games, through its own joto.games mailbox, not a mailing service. Either one works once, for 10 minutes, and 5 wrong codes end it. While it works, JoTo keeps the address it went to and a scrambled copy of the code that cannot be turned back into it; both are deleted once it is used, ended or out of time. Opening the link changes nothing until you press Sign in on the page it opens.
• Two ways of signing in join into one account by themselves only when both give the same email address and both have verified it. On your account page you can add another way, with another address too.
• Nothing else from Google or Discord: no photo, no contacts, and no access to your account there.

The age check

• When you passed it. Not your date of birth: that is only used to check, never stored. Every new account passes it, whichever way you sign in.
• After the date, you tick "I am 16 or over" and agree to the terms of use. No account is made without the tick; the tick itself is not stored.

Your sign-ins and devices

• When each sign-in started, when it was last used (to the day), and which browser it was, so your account page can list them and you can sign any of them out. Not your IP address.
• Coming A TV you sign in with your phone: when, and until when.

Early access

• Which unreleased games JoTo has let you play, who allowed it and when.
• Coming Which group you are in (a test group, say), the invite link that added you, and the date your access ends, if it has one.

Progress

• Coming For each game you finish while signed in: which game, your place, how many played, how long it took, and when.
• Coming Your drawing, so it follows you to another phone.
• Coming If you play as a guest, your phone keeps each finished game's result for up to 7 days, so you can still save it by signing in. It stays on your phone and is never linked to an account unless you do.

Why, and on what basis

• To give you the account you asked for: signing you in and sending your sign-in code, your name, your friend code, early access and your progress. The basis is our agreement with you (Article 6(1)(b) GDPR). Without these there is no account.
• To keep accounts safe, and only for people old enough: your sign-in records, when you passed the age check, the record of who gave you access to what, the list of deleted accounts, and the backups. The basis is our legitimate interest in running accounts securely (Article 6(1)(f) GDPR).
• Nothing here is used for advertising or to build a profile of you.

Who sees it

Only JoTo. Games never see your email: when you open a game you have early access to, joto.games gets a short-lived pass naming your account's ID and the games it may open. While you are signed in, pages on joto.games can also ask for a pass that lasts about ten minutes and names your account's ID, your name and the games you have early access to; they keep it in memory, never in storage. Your friend code goes only where you share it. Coming Other players see your chosen name. We do not sell your data, show ads based on it, or share it with anyone else. It is kept on a server JoTo rents from TransIP, a Dutch hosting company, and a sign-in email goes out through JoTo's mailbox there. Google and Discord know you signed in to JoTo, because you signed in through them.

Cookies

Only to make signing in work. No tracking cookies.

• On account.joto.games: one keeps you signed in; one remembers for 30 minutes that you passed the age check while you finish making an account, and goes once you have; and one lasts 5 minutes while you are away at Google or Discord, so the answer that comes back is matched to you. An emailed code sets no cookie of its own.
• On joto.games: when you open a game you have early access to, one holds its pass for about an hour, and one lasts 15 minutes while you fetch that pass, so the pass that comes back is matched to you.
• A note on joto.games, in your browser's storage rather than a cookie, that you signed in, so its pages only ask account.joto.games for your pass when you have. It holds nothing else, and goes the next time a page there finds you signed out.

How long

• A sign-in lasts at most 30 days, and ends when you sign out. Coming A TV's ends when its room closes, and after 6 hours at most.
• Your account, and everything it keeps, stays until you delete it on your account page, or ask us to.
• Deleting takes everything above at once, and signs out every device. A pass that joto.games already holds is not called back: it stops working by itself, within ten minutes, or within an hour for a game you have early access to. Two records stay, each keeping your account's ID, a random code, and never your name or email: the list of who gave which account early access, so that list stays complete, and the list of deleted accounts.
• Encrypted backups are kept on JoTo's server for 14 days, so a deleted account is gone from them within 14 days. If a backup is ever put back, the list of deleted accounts deletes yours again before anyone can sign in.

Your rights

Your account page has a button to download everything it keeps as one file, and one to delete your account straight away. Deleting first checks it is really you, so nobody else can do it from a device you left signed in: an account with Google signs in to Google again, and Google must have asked for your password in the last ten minutes; any other account signs in again with a code JoTo emails to its address. You can also get a copy of what JoTo keeps about you, correct it, or have your account and everything linked to it deleted by emailing info@joto.games from the address you signed in with. You can ask us to limit what we do with it, object to it, or have it in a form you can take elsewhere. We answer within 30 days.

If you think we handle your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

Age

JoTo Play is for everyone, and playing without an account stores no personal data beyond the room. Accounts are for people aged 16 or over. The sign-up makes no account for anyone younger, so a younger player keeps playing as a guest. If you think a child under 16 has an account, write to info@joto.games and we delete it.