JoyCheck Privacy: Zero Data, Verified in DevTools

• Zero controller data is transmitted to any server, ever.
• All input handling runs in-browser through navigator.getGamepads() [1].
• You can verify this yourself in DevTools, Network tab, in under one minute.
• We operate from Dublin under GDPR. Access, deletion, and portability rights apply to any data tied to an account.

No. JoyCheck does not transmit controller input to any server, ever. The tester reads from navigator.getGamepads() on every animation frame and writes only to DOM elements on the page. There is no fetch(), no XMLHttpRequest, and no WebSocket touching controller state.

In 15 years of building browser tools, I have not shipped a single line of code that sends gamepad input upstream from JoyCheck. The architecture would not survive a code review if it did, because the W3C spec lets us avoid the network entirely.

This separates us from a category of online controller-test sites that proxy input through their servers for analytics or A/B testing. Those sites can see every button you press while the tab is open.

JoyCheck cannot, by design. The full request-flow walkthrough lives on our how-it-works page, and the API itself is documented on the MDN Gamepad API reference.

Open your browser's DevTools, switch to the Network tab, and exercise the tester for thirty seconds. No requests fire from joycheck.io for controller input events, because the Gamepad API resolves entirely inside the browser process. The check below takes under one minute, requires no install, and works on any modern browser.

1. Open joycheck.io in Chrome or Firefox.
2. Press F12 or right-click and choose Inspect.
3. Click the Network tab and clear the log.
4. Press any button on your controller and exercise the sticks for 30 seconds.
5. Watch the Network panel; no requests fire from JoyCheck for controller events.

You will see a small number of static requests on first page load: fonts, CSS, the page HTML itself. After that, the tab stays silent for as long as you test. Any future request that did appear would be immediately visible with full headers and payload.

JoyCheck the tester widget has zero analytics, zero cookies, and zero third-party scripts. JoyCheck the website has minimal standard logging: server access logs for security, the WordPress session and cache cookies the platform itself sets, and nothing else. There are no Google Analytics, Facebook Pixel, or remarketing trackers anywhere on the site.

• Server access logs. IP address, user-agent, page requested, response code. Retained 30 days for security and abuse prevention. Never tied to widget activity.
• No third-party advertising trackers. No Facebook Pixel, no Twitter pixel, no LinkedIn Insight Tag, no Google Ads remarketing.
• No third-party analytics scripts. If we add page analytics in future, we will use a privacy-respecting platform such as Plausible or Fathom, both cookieless and EU-hosted, and disclose it here first.
• WordPress session cookies. The site runs on WordPress, which may set session or caching cookies on certain page loads. These carry no tracking identifiers and are never shared with third parties.

For the broader product story, see our trust comparison page.

If we launch the Pro tier (saved controller profiles plus advanced DualSense metrics, around $5 a month), the data story shifts only for users who explicitly opt in at signup. The anonymous browser-only experience stays unchanged, and the free tester continues to operate without any account requirement.

Even for paying account holders, we store profile preferences (deadzone, calibration, layout name), never raw input streams. Profiles save locally first, in your browser.

• Profiles save locally first in your browser (IndexedDB and LocalStorage).
• Sync to an account server is opt-in only at signup.
• Synced data is limited to deadzone settings, custom calibration values, and saved layout names. Input streams stay in-browser as today.
• Account-level data is covered by the GDPR rights below.

We operate from Dublin, Ireland, so the General Data Protection Regulation applies. Every user gets the same three rights worldwide: access to any data tied to your email, deletion of that data on request, and portability in machine-readable JSON. We respond to a request within two business days at no cost.

• Right of access (GDPR Article 15). Receive a copy of any data tied to your email within 30 days.
• Right to erasure (GDPR Article 17). Delete any data tied to your email within 30 days.
• Right to data portability. Receive your stored profiles in a machine-readable format (JSON).

Email support@joycheck.io for any of these requests, or use our contact page. We respond within two business days, on-record.

This page was last updated on 2026-05-26. Material changes are noted at the top of the page with the new effective date, and we update this policy whenever we change what data the site or widget touches, not on a fixed schedule. The full terms-of-use are kept on the separate JoyCheck terms page.

1. W3C Gamepad API specification, w3c.github.io/gamepad
2. MDN Web Docs, “Gamepad API”, developer.mozilla.org/Gamepad_API
3. Plausible Analytics privacy policy, plausible.io/privacy
4. Fathom Analytics privacy policy, usefathom.com/privacy
5. MDN Web Docs, “IndexedDB API”, developer.mozilla.org/IndexedDB_API
6. GDPR Article 15, Right of access by the data subject, gdpr-info.eu/art-15-gdpr
7. GDPR Article 17, Right to erasure, gdpr-info.eu/art-17-gdpr