How to handle player data requests in a game: access and deletion

Sooner or later a player writes "delete my account and everything you have on me", or "send me my data". The account in your game backend is the obvious part. The chat transcripts, screenshots and device logs sitting in your support tool are the part studios forget.

Published 31 October 2026 by the Inngame team. This is a practical guide, not legal advice: check your own obligations with someone qualified, especially if you sell in many countries.

What players can ask for

Under the EU's GDPR, which applies as soon as you have players in the EU, a player can ask you to:

Show them their data (article 15, right of access): a copy of the personal data you hold and what you use it for.
Hand it over in a usable format (article 20, portability), for data they gave you.
Delete it (article 17, right to erasure), unless you have to keep some of it, for example invoices you must keep for tax law.

You have one month to answer, which can be extended by two more months for complex or numerous requests, as long as you tell the player within the first month (article 12(3)). The UK GDPR has the same rights, and several US states have similar ones.

What the stores require

Both mobile stores add their own rule on top, focused on accounts:

Apple: since 30 June 2022, an app that lets people create an account must also let them start deleting that account from inside the app (App Store Review Guideline 5.1.1(v)). Sending them to a website is not enough.
Google Play: an app that lets people create an account must let them request its deletion in the app, and must also give a web link where they can request it without reinstalling the app. The final deadline was 31 May 2024.

If your game has no accounts at all, these two rules may not apply, but the GDPR still does: a support conversation tied to a device id is personal data too.

The forgotten part: support data

A single support conversation in a game usually holds more than people expect:

the messages themselves, often with a name, an email or a purchase reference typed by the player;
screenshots, which can show a username, a friends list or a location;
device details: model, OS, language, time zone, app version;
recent logs, which may contain ids;
the notes your team wrote about the player.

Deleting the game account while all of this stays in a helpdesk is an incomplete deletion. When a player asks for a copy of their data, it should be in the copy too.

A workflow that holds up

Check who is asking. Answer through a channel tied to the account: the in-game chat, the email on file, a logged-in page. Sending someone's data to whoever emails you first is a data leak of its own.
List every place the player exists. Game backend and saves, analytics, crash reporting, support tool, mailing list, payment provider. Write the list down once and keep it up to date; you will reuse it.
Decide what you must keep. Payment records and invoices usually have a legal retention period. Keep those, delete the rest, and tell the player what you kept and why.
Act, then confirm. Export or delete everywhere on the list, then tell the player it's done. Keep a record of the request and the date you answered, without keeping the data itself.
Automate the common case. An in-game "Delete my data" button that does it all, plus a retention period for old closed conversations, means most requests never reach a person.

How this works with Inngame

Inngame stores conversations and files in the EU, and gives you a tool for each step:

In the game: a "Delete my support data" button calls Inngame.DeleteData() (Unity) or Inngame.shared.deleteMyData() (iOS). It deletes the player, their conversations and photos on the server, then the local copy.
From your backend: when an account is deleted in your game, call DELETE /v1/users/:id so support data goes with it. Only an admin can delete players; AI agents connected through the API can't.
For access requests: on the player's page, Export data downloads everything held on them as JSON: profile, devices, conversations with translations and context, tags, bug reports, and photos as links valid for 7 days. Your team's internal notes are included and labelled, so review the file before sending it. The same export is available as GET /v1/users/:id/export.
For everything else: each app can delete closed conversations automatically after a period you choose, from 30 days to 2 years. Every export and deletion is written to the audit log.

The details are on the Privacy & data page. For the integration itself, see how to add an in-game support chat to a Unity game.

Start the 14-day trial

Questions

How long do I have to answer a GDPR request?

One month from receiving it. You can extend by two further months for complex or numerous requests, if you tell the player within the first month.

Do I have to delete purchase records when a player asks?

Usually not all of them. The right to erasure doesn't apply to data you must keep to meet a legal obligation, such as invoices under tax law. Keep what the law requires, delete the rest, and tell the player.

Is a support chat personal data if the player never logged in?

Yes, if it can be linked to a person: a device id, an email typed in a message or a screenshot with a username is enough.

Does Apple accept a web page for account deletion?

No. Apple requires that people can start deleting their account from inside the app. Google Play asks for both: an in-app path and a web link.

Sources: GDPR, Regulation (EU) 2016/679 (articles 12, 15, 17 and 20); Apple App Review: account deletion; Google Play: app account deletion requirements. Checked 31 October 2026.