Who we are
Vplay is a personal, non-commercial project run by one owner, who is responsible for your data. Contact us through a ticket in our Discord server.
What we collect
From Discord, when you sign in
- Your Discord user ID, username and display name, and your profile picture link.
- Whether you are a member of our Discord server.
We ask Discord only for your basic profile and your server list. We never see your Discord password, email address or messages.
Your WhatsApp number
- The phone number you verify, and a short-lived 6-digit code that expires after 10 minutes.
- The messages you send to our WhatsApp number (for example "verify") and the messages we send you: verification codes and alerts when the shared Steam account is signed in from your account.
The connection check
- Your IP address, the date and time, and the result of the check.
- The approximate location (city, region, country) and network provider linked to that IP address, and whether it looks like a VPN or proxy.
- The IP address of your first passed check, kept as your registered connection, and a count of VPN attempts.
When you connect to Steam
- The Steam QR screenshot you upload is read in memory to approve the sign-in and is not saved.
- We record that a sign-in happened, when, and how many times.
- When you agreed to the rules, and which version.
Automatically
- Our hosting provider and Cloudflare process your IP address and basic request details (such as browser type) to deliver and protect the site. Their logs are kept under their own policies.
- We count public page views and estimate unique visitors by country, hour and day to understand how Vplay is used. These first-party statistics use a keyed hash of the connection IP address and browser user agent; the analytics files do not store the original IP address or user agent. Country codes come from Cloudflare when available.
- Visitor statistics are kept for up to 400 days and are visible only to the administrator. No analytics cookies or third-party analytics scripts are used. Admin pages and known bots are excluded.
Why we use it
- To confirm that you are who you say you are and are allowed to use Vplay.
- To protect the shared account from misuse, VPNs, account sharing and bans.
- To warn you on WhatsApp whenever the shared account is signed in from your account, so you can spot misuse.
- To enforce the Terms of Service, including bans.
- To understand overall website traffic and which countries visitors come from.
We use this data because it is needed to provide the service you asked for, and because we have a legitimate interest in keeping a free, shared library safe. We never sell your data or use it for advertising.
Who we share it with
Only the services needed to run Vplay:
- Discord — sign-in and checking server membership.
- WhatsApp — sending and receiving verification messages and alerts, through our own linked WhatsApp number.
- proxycheck.io — receives your IP address during the connection check to tell us its location, network and whether it is a VPN.
- Steam (Valve) — receives the sign-in approval for the shared account.
- Cloudflare and our web host (Spaceship) — deliver and protect the website. Our Discord bot and WhatsApp connection run on a server at Hetzner.
We may also share data if the law requires it. Some of these services are outside Sri Lanka, so your data may be processed in other countries.
How we protect it
Account data is stored in an encrypted file on our server, which only the owner can reach. Cookies are secure, HttpOnly and cannot be read by other sites. Only the owner can see the admin dashboard.
How long we keep it
- Verification codes: 10 minutes.
- Your sign-in cookie: up to 30 days, or until you sign out.
- Your account, connection checks and sign-in history: while you are a member. If you are banned, we may keep your Discord ID, phone number and IP details to stop you from joining again.
Your rights
You can ask to see, correct or delete your data, or to stop using Vplay at any time. Open a ticket in our Discord server. Deleting your data ends your access. You may also complain to the data protection authority in your country (in Sri Lanka, the Data Protection Authority).
Children
Vplay is not meant for children under 13, and we do not knowingly collect their data.
Changes
We may update this policy. The date at the top shows the latest version.