Privacy Policy

1. Who is responsible for your data

The data controller is Mariusz Górski, an individual developer operating GamePile as a personal project. For any question about this policy or about your data, write to [email protected].

There is no separate Data Protection Officer; requests are handled directly by the developer.

2. What data we collect

We collect only what the app needs in order to work:

• Account data — your email address, a securely hashed version of your password (we never store the password itself), and your account status. The email address and password are required to create an account; without them no account can be created, and everything else is optional or comes from using the app. When you create an account, we record that you accepted the Terms of Service and this policy, which version of each, and when. Accounts created before sign-up moved into the app may also hold the optional note sent with the original access request; it is no longer collected.
• Profile data — your gamertag, your chosen avatar and card style, your profile visibility setting (public or private), and whether the aging effect is enabled.
• Your game library — the games you add and everything you record about them: which screen they sit on, completion details (platform, date, fun score), retirement reasons, your own review scores and notes, "poke" activity, and your diary entries. A diary entry is public by default, which means your confirmed friends can read it; you can make any entry private, and then nobody but you sees it. This history is stored as an append-only event log, so earlier entries remain recorded until the data is deleted.
• Discovery activity — the recommendation cards you add, defer, or dismiss, and your taste and filter preferences.
• Social data — friend requests you send or receive, your confirmed friendships, the games you recommend to friends and the ones friends recommend to you, with the notes attached to them, and the users you block. Your confirmed friends see your activity feed and your public diary entries. If your profile is public, any signed-in user who looks up your gamertag can see your profile and your game board; if it is private, only your friends can. Other users never see your email address.
• Reports — if you report a diary entry, a recommendation or a gamertag, we record who reported it, who it concerns, the reason, any detail you add, and a snapshot of the reported content as it was at that moment. The report is emailed to the developer so it can be reviewed. The reported person is not told that a report was made or by whom.
• Technical data — a login token stored securely on your device, and server logs recording the requests made to the service (method, path, response status, timing, and, for a signed-in request, your user id) and the errors it produces, for troubleshooting and for the usage statistics described below. Our hosting provider may additionally process connection data such as IP addresses at the infrastructure level.

3. What we do not collect

The app contains no analytics, advertising, crash-reporting, or user-tracking SDKs of any kind. We do not collect your location, your contacts, your device identifiers, or an advertising ID. We do not build advertising profiles and we do not sell or rent your data to anyone.

Some settings never leave your device at all: your language choice, text-size preference, tutorial progress, and unsaved drafts are stored locally on your phone only.

4. Cookies on this website

This website uses only strictly necessary cookies. It sets no advertising, analytics, or tracking cookies, and the app itself uses no cookies for its own features.

• guest_lang — remembers whether you chose English or Polish, so the site stays in your language. It stores nothing but that choice.
• admin_token — the session cookie set when you sign in to this website, whether to your personal web panel or, for an administrator, the management panel. It keeps you signed in and is removed when you sign out.

5. Why we use your data, and on what legal basis

• To provide the service — creating and maintaining your account, storing your game library, generating recommendations, and running the friends features. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure and safe — authenticating you, preventing abuse, reviewing reports, and diagnosing faults. Legal basis: our legitimate interests in a secure, safe and functioning service (Art. 6(1)(f) GDPR).
• To understand how the service is used — counting, from the records above, requests, errors, sign-ups, active accounts and how games are added and moved, so the developer can see what works and what breaks. The statistics are computed on our own server, seen only by the developer and never shared; no analytics service or SDK is involved. Legal basis: our legitimate interests in maintaining and improving the service (Art. 6(1)(f) GDPR).
• To communicate with you — sending the emails your account needs, such as a welcome message, password reset links, a notice when your password changes, and notices about your account's status. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

6. Who your data is shared with

We do not sell your data. It is shared only with the service providers needed to run the app:

• Resend — delivers the app's emails (such as password resets and account notices). It receives your email address.
• IGDB (Twitch / Amazon) — supplies game information. Searches are made by our server, not your device, so IGDB does not receive your IP address for searches. However, cover art and screenshots are loaded directly by the app from IGDB's image servers, which means IGDB receives your device's IP address when images load.
• YouTube (Google) — game trailers are played through an embedded YouTube player inside the app. When you open a trailer, Google receives your IP address and device information and may set cookies, under Google's own privacy policy.
• HowLongToBeat and RAWG — supply playtime estimates and game data. These are queried by our server only; your device never contacts them directly.
• Google Play and Apple (the App Store and TestFlight) — distribute the Android and iOS apps and run their testing programmes, each under its own privacy policy.
• Cloudflare — carries all traffic between the app or browser and our server, protecting the service from abuse, so it receives your IP address and the requests you make. It also stores our encrypted database backups, which it cannot read.
• Our hosting provider — stores the database and runs the server on our behalf.

7. International transfers

Some of the providers above (notably Resend, Cloudflare, IGDB (Twitch / Amazon), Google and Apple) process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision. You may contact us for more detail on the safeguards in place.

8. How long we keep your data

Your account data and game library are kept for as long as your account exists. When an account is deleted, we remove its event history, diary entries, discovery activity and preferences, profile, friendships, recommendations sent or received, blocks placed by or against it, reports filed by or about it, and any outstanding password reset tokens and email verification links from the database. Afterwards only the account's id and the date of its deletion — not its email address or anything else — are kept for up to 60 days, only so that the deletion can be carried out again if the database is ever restored from a backup.

Request logs are deleted after 14 days and error logs after 30 days. Copies of the database are kept as encrypted backups for up to 30 days, so data removed from the database, including a deleted account, also disappears from the backups as they rotate out, at the latest 30 days later. Password reset tokens expire shortly after they are issued. Cached game information from IGDB, HowLongToBeat, and RAWG describes games rather than people and is not personal data.

The developer is notified by email about new sign-ups, account-deletion requests and reports. A sign-up notice carries the email address concerned and, if one was sent, the note to the developer; a deletion-request notice carries the email address and account id concerned; a report notice carries the gamertags and account ids of the people involved and the reported content. These messages are kept in the developer's mailbox and are not removed when an account is deleted.

9. Your rights

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable format. To exercise any of these rights, write to [email protected]. We will respond within one month.

Much of this you can do yourself. Your personal web panel shows the history recorded on your account and lets you download your whole record as a single file. You can ask for your account to be deleted without writing to anyone — in the app (open your profile and choose Delete account) or from the panel — or by email as the public deletion page explains; whichever route you use, the developer carries the deletion out by hand within 30 days.

If you believe your data is being handled improperly, you may lodge a complaint with the supervisory authority in the EU country where you live or work. The authority for the controller is the Polish one: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

The app does not carry out automated decision-making that produces legal effects concerning you. Game recommendations are suggestions only.

10. How your data is protected

Traffic between the app and our server is encrypted in transit. Passwords are stored only as bcrypt hashes, and your login token is held in your device's secure storage. Access to the administration panel requires a separate administrator account.

No system can be guaranteed completely secure. If a breach affects your rights, we will notify you and the supervisory authority as required by law.

11. Children

The app is not directed at children, and we do not knowingly collect their data. Under the GDPR the age of digital consent is set by each EU country and falls between 13 and 16; if you are below the age that applies where you live, please do not create an account without your parent or guardian's permission. If you believe a child has created an account, contact us and we will delete it.

12. Testing-phase notice

GamePile is currently distributed through testing programmes (Google Play testing and TestFlight). The app is under active development, and data may be reset or lost between test builds as part of that process. Please do not treat the app as the only record of anything you would be sorry to lose.

13. Changes to this policy

If this policy changes, the revised version will be published on this page with a new "last updated" date. If a change affects your rights, we will also tell you about it by email.

14. Contact

Questions, requests, and complaints: [email protected].