Userplay is launching soonGet Started
Userplay
Discord0.8kGet Started
Browse security docs Toggle navigation

// Security · Architecture

Playtest Recording

Last updated May 31, 2026

This page describes the core data path — how a playtest session goes from creation to storage to playback.

Actors#

  • Studio member — a user in a Userplay workspace who creates and reviews playtests.
  • Tester — a person invited to complete a playtest via a unique link. Testers do not need a Userplay account.
  • Userplay backend — application services on Render that handle recording lifecycle, authentication, and metadata.
  • Mux — video ingest, storage, and playback.
  • Cloudflare — edge delivery in front of both the application and Mux playback URLs.

Step-by-Step Flow#

1. Playtest creation#

A studio member configures a playtest in the Userplay web app: objectives, prompts, capture toggles (screen, microphone, webcam), AI processing toggle, and retention policy. The configuration is stored in Userplay’s database on Render.

2. Tester invite#

Userplay generates a unique, signed playtest URL for each tester. The URL grants single-purpose access to the playtest and the upload endpoint for the corresponding recording.

When the tester opens the URL, Userplay shows them a consent screen describing what will be captured (screen, mic, webcam), by which studio, and under what retention. The tester must explicitly accept before recording starts. See Tester Privacy.

4. Capture#

The Userplay recorder — a web-based client running in the tester’s browser — captures the configured tracks locally on the tester’s machine. Nothing is streamed to Userplay during recording; the upload happens after the session ends.

5. Upload#

The recorder uploads chunked video and audio to Mux’s direct-upload endpoint via a pre-signed upload URL issued by the Userplay backend. The pre-signed URL is single-use and bound to the tester’s session. All transport is over TLS.

6. Storage#

Mux ingests the upload, transcodes to delivery-ready renditions, and stores the asset. Userplay persists the Mux asset ID, recording metadata (duration, dimensions, timestamps), and workspace association in its database on Render. Raw recording files live in Mux; all derived data lives in Render’s database.

7. Optional downstream processing#

  • If AI processing is enabled, audio is sent to Audio Transcription and video to Video Analysis.
  • If the studio and tester have both enabled the optional Chrome extension, post-gameplay telemetry is uploaded separately and stored alongside the recording.
  • If the studio has opted out of AI processing, neither step runs.

8. Review#

Studio members with the appropriate workspace role can play back the recording in the Userplay web app. Playback URLs are signed by the Userplay backend on demand and expire on a short TTL. Signing requires an authenticated session with the appropriate workspace role.

9. Retention and deletion#

The recording is retained per the workspace’s retention policy (default 12 months). Workspace owners can delete a recording at any time; deletion soft-deletes the Mux asset immediately, with hard deletion from Mux storage within 30 days. See Recording Access.

Access Controls#

  • Tester upload endpoints are scoped to a single playtest session and expire after upload completes or the playtest window closes.
  • Playback is available only to authenticated studio members in the workspace that owns the recording.
  • Workspace owners can further restrict playback to specific roles or members per playtest.
  • Userplay employees do not access workspace recordings except in the narrow circumstances described in Recording Access.