Privacy Policy

1. Data Controller & Commitment

The data controller is Dan Adrian Radut, a private individual, who runs GameTome (https://gametome.app) and answers at the address given in section 10. GameTome is an independent game tracking platform built by gamers for gamers. We process your personal data under the EU General Data Protection Regulation (GDPR 2016/679).

3. Personal Data We Collect

We only collect data strictly necessary to provide the service:

• Account Data: username, email address, password stored only as a bcrypt hash, never in plain text (or your Google OAuth identifier, if you sign in with Google).
• Profile: your bio, up to three links and the header you pick (a screenshot from the catalog), plus your profile picture — the avatars you upload, deleted once nobody uses them any more, or, if you sign in with Google, the address of your Google account photo, which stays on Google’s servers and is loaded from there by the browser of whoever is looking.
• What others see: username, profile picture, header, bio, links and badges are always public. Your library, stats and activity are visible to everyone, only to mutual follows, or only to you, depending on the visibility you choose in your settings; anyone on either side of a block can’t see them. Reviews still appear on the game’s page, and lists you mark as public stay public.
• Gaming Chronicle: games added to your backlog, status (Playing, Completed, Wishlist, etc.), star ratings, reviews, spoiler flags, completion dates, play sessions (day, minutes, note and up to three screenshots), custom lists and your tier list.
• Interactions: comments posted on reviews, likes given, and follower/following connections with other gamers.
• Clubs: the clubs you found or join, with your role and join date, the messages you post on their boards, the games you suggest and the votes you cast, and the invites you send or receive. A private club’s board is read only by its members; a public club’s by anyone who opens it. Deleting your account removes your messages, your votes and the clubs you founded.
• Data from the services you choose to link — Steam, PlayStation Network, Xbox, GOG, Epic Games, EA app, Ubisoft Connect, Nintendo and RetroAchievements — or whose game list you paste (Battle.net): your account ID and name on that service, owned games, hours played per platform, and imported achievements and trophies. Where the service gives us one, we keep an access token encrypted, never your password. What each link reads is explained in section 5.
• Technical data: your IP address, kept for a few minutes in anti-abuse counters, and your phone’s identifier for push notifications, only if you turn them on in the app, deleted when you sign out.
• Browser extension: if you install and connect it, when you open a game page on Steam, IGDB or GOG it sends us that game’s identifier, to show you its status in your backlog, and the status you pick. On Steam Store pages, once a day and only while the extension is connected, it reads with your Steam session your steamid and the list of app numbers you own (games and DLC), and sends them to GameTome to import your DLC: we accept the list only if the steamid is the one verified on your account. We keep it on your account, include it in the data export, and delete it when you unlink Steam. It doesn’t read your history or other sites. The personal code that connects it stays in your browser; we only keep a fingerprint of it, the date it was created and the date it was last used, until you revoke it in your settings or change your password. If you turn it on in the extension’s window, on your Humble Bundle account pages, once a day, it reads the title, store and bundle of the keys you haven’t revealed yet and adds them to your “Keys to redeem”: it never reveals or reads a code. The codes you type into “Keys to redeem” yourself are stored encrypted, only you can see them, and they are included in your data export.
• Direct messages: if you write to someone you follow who follows you back, we keep the text, any attached game, the date and how far each of you has read. Only the two of you read them; staff read a message only if one of you reports it, and then they also see the five previous messages in that conversation. A message you delete disappears for both of you right away; its text stays on our server for 30 days, only so the other person can still report it, and is then erased. The same goes for the text before an edit: a message can be corrected in the first 15 minutes, and the original version stays for 30 days, hidden from both of you, only for reports. Deleting your account deletes your conversations entirely, including the other person’s messages. The messages you sent, including those deleted less than 30 days ago, are included in your data export.
• Android widget: if you add the GameTome widget to your home screen, the app gives it a personal code that can only read your current game and the first three in “Up next”. The code stays on your phone; we only keep a fingerprint of it, the date it was created and the date it was last used. It is deleted when you sign out in the app, change your password or after 90 days without use. If you revoke it in your settings, the app creates a new one the next time it opens, as long as the widget stays on your home screen.
• Security data: if you turn on two-step verification, the authenticator app secret and the backup codes, encrypted on our servers; with email verification, the one-time codes, valid for 10 minutes and deleted within a day of expiring. If you add a passkey, its public key, the name you give it and the dates it was added and last used: the private key stays on your device. When you sign in from a new device, we save its name (browser and operating system) with the dates of the first and last sign-in, and send you an email alert. The alert shows the approximate country, worked out from your IP address on our own server with a local database, without external services: the IP address is not stored for this. The country database is by NRO (nro.net), licensed CC BY 4.0.
• Reports and support: when you report content we keep the reason, your note and a copy of the content, which only administrators can see; the email notice they receive also carries your username, email and IP address. When you write to support we save in the database your name, email, category, subject and message, your account if you are signed in, the image if you attach one and, for a technical problem, the technical details you see under the form before sending it: only administrators read them. The same details, with your IP address, reach the info@gametome.app inbox by email.

How long we keep them: account data until you delete the account, or 7 days after sign-up if you never confirm your email address; closed reports for 12 months after closing; moderation actions for 24 months, and in any case while a ban or suspension is in force; support requests (in the database and in the mailbox) and report notices for at most 12 months after the request is closed; the log of the emails we send you (address, type of email and outcome, never the text) for 90 days; the text of messages removed from a club board or a game discussion, by whoever wrote them or by a club moderator, for 30 days, only so they can still be reported; backups for 7 days. The web server’s access logs are kept by Hostinger, for the period set in its privacy policy.

4. Cookies & Persistent Sessions

We use technical and preference cookies only, all of them ours: no measurement, advertising or profiling cookies. The session cookie (__Secure-authjs.session-token) travels with HttpOnly, SameSite=Lax and HTTPS and lasts up to 30 days. The full list, including the ones that live for five minutes, is in the Cookie Policy.

5. Integrated Technical Services

These providers receive part of the data, each only what it needs. The first group works for everyone; the others receive something only if you use the feature they serve.

6. Where the data lives

The site and the database live on Hostinger servers in Frankfurt, Germany, inside the European Union. Brevo is based in France and Upstash keeps its data in Ireland. Google, Cloudflare, GitHub, Twitch (IGDB) and the browsers’ notification services (Mozilla, Apple, Microsoft) also operate outside the European Union: for those transfers the European Commission’s Standard Contractual Clauses or the EU-U.S. Data Privacy Framework apply, which those providers have adopted. The gaming services you link, Discord and the donation platforms are often based outside the Union: data reaches them only because you ask for it, and each handles it under its own privacy policy, linked in section 5. All of them are optional: if you don’t use them, they receive nothing from us.

7. Your Privacy Rights (GDPR & Data Portability)

At any time, you hold the complete right to:

• Download a complete copy of your data in JSON (profile, games, lists, tier list, comments, follows, clubs and club messages, direct messages you sent, notifications, reports and moderation actions), or just your games in CSV, from the Backup section of your profile.
• Correct whatever is wrong: username, email, avatar, ratings, reviews, dates and hours can be changed from your profile at any time, and they stay the way you write them.
• Unlink Google sign-in and each linked gaming service from your settings: tokens and data that only serve that link are deleted as described in section 5.
• Object to a processing activity or ask us to restrict it, and withdraw a consent you had given — notifications, linked gaming services, signing in with Google — without losing your account or anything you put in it.
• Permanently delete your account and all associated data from Profile → Settings, or by writing to info@gametome.app if you can no longer sign in. The data disappears from the database immediately and from the backups within 7 days. Only the moderation records (username, reason, copy of the content in question) of accounts that received reports or moderation actions remain, along with emails sent to support, for the periods listed in section 3.

To exercise any of these rights, write to info@gametome.app: we answer within one month. If you believe we handle your data improperly, you also have the right to lodge a complaint with the supervisory authority of your country; in Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it).

8. Children

GameTome is meant for people aged 13 and over: that is the minimum age the app is published with on Google Play. In Italy, however, the law requires you to be 14 to sign up to an online service on your own, so a 13-year-old may use GameTome only with the consent of whoever holds parental responsibility; across the rest of the Union that threshold ranges from 13 to 16 depending on local law. We do not ask for a date of birth, we do not verify age and we do not profile anyone by it. If we learn that an account belongs to a child below the required age without that consent, we delete it. If you are a parent and think that is the case, write to info@gametome.app: the account’s username or email is enough.

9. Changes to this policy

This policy changes when the service changes. The date at the top of this page always shows the latest change, and every change appears in the changelog. A substantial change — new data, a new recipient, a different use — is announced on the site before it takes effect; if it needs your consent, we ask for it again.

10. Privacy Contacts

If you have any questions or data requests regarding this Privacy Policy, contact our team at: info@gametome.app