Cookie Policy
GameTome respects your privacy and uses strictly necessary technical cookies only.
No advertising, no profiling
GameTome uses no advertising cookies, no Meta or Google Ads pixels and no measurement cookies of any kind, and never shares browsing data with commercial brokers. Every cookie listed below is ours, and every one of them is either strictly necessary or a preference: none of them exists to recognise you elsewhere.
Technical Cookies Used
This is the list of cookies that can end up on your device, with how long they last and what they are for. None of them measures visits or builds a profile.
Keeps you signed in with an encrypted JWT token, sent over HTTPS only. It expires after 30 days without a visit: every day you use the site, the count starts again.
HttpOnly · Secure · SameSite=Lax
The Google sign-in round trip: they tie the request that left from here to the answer coming back from Google, and stop anyone else from slipping their own in. They are deleted as soon as the sign-in ends.
HttpOnly · Secure · SameSite=Lax
When you sign in with Google from the phone app, the trip goes out through the browser: this cookie holds the two halves together for as long as it takes to finish, and your language and theme travel with it for the same ten minutes, so the page you land back on does not change appearance in front of you.
HttpOnly · Secure · SameSite=Lax
When you sign in with Google and something is still to be proved — the account password, or the second-factor code — this cookie holds the sign-in pending for five minutes. It is not a credential: on its own it opens nothing.
HttpOnly · Secure · SameSite=Lax
When you press “Link Google Account” from your profile, the server notes down — signed — that the next return from Google is a link for you. If a different account comes back, the linking is refused instead of creating a second account. It lasts five minutes.
HttpOnly · Secure · SameSite=Lax
When you sign in with Steam, it ties the return from Steam to the browser you started from, so nobody can sign you into someone else’s account. It is deleted as soon as the sign-in ends.
HttpOnly · Secure · SameSite=Lax
When you link Nintendo from your profile, the server keeps here — encrypted — the key for that sign-in attempt, which Nintendo asks for back when you paste the link. It only works for your account, is only read by the Nintendo linking address and is deleted as soon as linking succeeds. It lasts ten minutes.
HttpOnly · Secure · SameSite=Lax · Path=/api/auth/nintendo
They stop another site from starting a sign-in or a redirect in your name. They last as long as the form you are filling in.
HttpOnly · Secure · SameSite=Lax
A random number with no meaning, set only when you sign in. It lets us recognise the browser you usually sign in from, so a sign-in from a new device reaches you as an alert and the usual ones don’t.
HttpOnly · Secure · SameSite=Lax
Remembers whether you chose the dark or the light theme. The second one, gametome_theme_auto, says you have not chosen and the site follows your system theme.
SameSite=Lax
Remembers the interface language you chose.
SameSite=Lax
The admin panel uses two cookies of its own. They exist only in the browser of whoever administers the site, after signing in and passing the second factor: they are never placed on a visitor’s device.
What stays on your device besides cookies
Your browser also keeps things that are not cookies and never travel to us: local storage, which holds the theme, the language and the update notice you have already dismissed, and the service-worker cache, which keeps a few pages so the site opens even without a connection. They stay on your device, are sent to no server, and are removed by clearing this site’s data in your browser settings.
How to delete or block them
You can view, delete or block these cookies from your browser settings. If you block the sign-in and security ones you will not be able to sign in to your account; if you delete the preference ones, the site goes back to its default language and theme.
In the Windows, Linux and Android apps the cookies live inside the app: they are deleted by clearing the app’s data from the system settings, or by uninstalling it.
Who else sees something when you open a page
None of these writes a cookie on the gametome.app domain, but all of them receive your IP address: technically, that is what it takes to send you a reply. Worth knowing, even though none of it triggers a banner.
- Hostinger — hosts the site and the database on servers in Frankfurt (Germany). Like any host it records the IP address of requests in its server logs; it does not measure visits or build profiles.
- Cloudflare Turnstile — the “I am not a robot” box on sign-up, sign-in and the support form. It lives in a frame served by Cloudflare and sees the IP only of people who open those three pages. On that domain, not on ours, it may store something of its own to recognise repeated attempts: we do not write it and we cannot read it.
- IGDB, Steam, PlayStation Network and Google — they serve the cover art, the achievement icons and the profile pictures straight to your browser. They do not pass through our servers, so they receive the IP of whoever is looking at the page they appear on.
Why there is no cookie banner
Consent is required for cookies that are not necessary to the service: measurement, advertising and profiling. There are none here — not even a statistics one — so there is nothing to accept or refuse, and a banner would only make you click for nothing. If we ever added one, the banner would arrive before that cookie, not after.
The legal basis is Article 5(3) of the ePrivacy Directive (2002/58/EC), implemented in Italy by Article 122(1) of the Privacy Code (Legislative Decree 196/2003): cookies strictly necessary for the service you ask for do not require consent.
Questions about cookies
If something here does not add up, or you want to know more about one of these cookies, write to us at info@gametome.app
Who the data controller is