// Security
Data Handling
Last updated June 19, 2026
Data Types#
Userplay processes and stores three categories of data:
- Studio data — workspace configuration, project settings, user management, billing details.
- Player data — email addresses (when used for invites), demographic data collected during playtest setup, consent records.
- Session data — screen recordings, audio (microphone and system audio, when the player consents to microphone capture), and basic device metadata required for playback. Userplay does not capture webcam video.
A full breakdown of every data category — including source, purpose, and retention — is in Data Processed.
Storage and Encryption#
All production data is hosted in the United States.
| Layer | Encryption |
|---|---|
| Data in transit | TLS 1.2 or higher, on all client and internal traffic |
| Data at rest | AES-256 at the storage layer (PlanetScale, Mux, Cloudflare R2) |
| Backups | Encrypted with the same standards as the primary store |
Video and audio files are stored at Mux, with recordings, audio, and telemetry also held in Cloudflare R2 object storage. Recording metadata is stored in Userplay’s database (PlanetScale). None of it is accessible from the public internet without authenticated, authorized requests routed through Userplay’s application layer.
Retention#
Default retention windows:
| Data type | Default | Configurable |
|---|---|---|
| Session recordings | 12 months from session completion | Yes — workspace owners can set shorter retention per workspace or per playtest |
| Account and workspace data | Lifetime of the workspace | Deleted within 30 days of confirmed workspace closure |
| Support communications | Up to 24 months from last contact | No |
Deletion#
When a recording is deleted:
- It is soft-deleted immediately — it disappears from the UI and can no longer be played back.
- The underlying video and audio asset is removed from Mux storage within 30 days of soft-deletion (hard delete).
- Any associated telemetry is hard-deleted in lockstep with the asset.
- Database backups containing the recording’s metadata age out within Userplay’s 7-day backup retention window.
Deletion is not reversible. Once a recording is soft-deleted, it is considered gone.
When a workspace is closed:
- All members lose access immediately.
- The workspace remains in a partially recoverable state for 30 days — contact support@userplay.io within that window to restore.
- After 30 days, all recordings, telemetry, and account data are removed within the following 60 days.
Data Minimization#
Userplay defaults to capturing as little as needed:
- Microphone capture is off by default and requires explicit per-playtest enablement.
- Userplay does not capture webcam video.
- Studios can limit recording to a specific application window or browser tab rather than the full screen.
- Players see exactly what will be captured before any recording starts and can decline or stop at any time.