Privacy policy

We store the Telegram user id and the name given at login. We do not store a Telegram username or profile photo. We also store a hash of the login proof so the same login cannot be reused. That hash is not the Telegram id.

We also store your preferences (language, currency, reference country, the countries you want to see, and the community notice switches), wishlist, price alerts, notification channels, played marks, ratings from 1 to 5, short reviews, helpful votes, and the reason and optional note on a report. A notification channel can be a Telegram chat id or an app push token. If you register web push or an email address, that address is stored too. Those two kinds of notice are not sent. The credential used to refresh a login is stored only as a hash.

You can also sign in with a passwordless email, Google, Apple, or Telegram. We match the account to the identifier from the provider, not to the email shown on screen. The same email does not merge two accounts by itself.

We store the sign-in method, the provider's identifier, the email and name the provider gave us, whether that provider had verified the email, and the linked and last-used times. Apple may give a hidden forwarding address instead, and usually sends the name only on the first sign-in.

We use this data to run the website and the app, to send the price notices and community notices you turned on, to keep logins safe, and to handle community reports.

Google and Apple sign-in is checked on our server with an authorization code and the signing keys that provider publishes. The code email is sent through the configured mail service, currently Resend. After we send you to a provider, that provider handles its own sign-in screen. GreenDock does not load a Google or Apple script.

We do not sell personal data. Pages do not load third-party advertising or analytics scripts. The login page loads Telegram's login widget. Other pages do not.

The community rules say what is public. Your Telegram name is not public. The name on a player page is the nickname you chose.

The connection IP is used for three things: estimating a reference country from a local country database, limiting requests for a short time, and writing the host's system log. The IP is not written to the database. Estimating the country does not send your IP to DB-IP. Exchange rates are fetched by the server from a public rate service. That request does not include your account or your IP.

API request logs and the website server's error log both include the connection address. They stay in the host's system log and are deleted after about 30 days.

Sending a code has its own limits: 3 times per email address in 15 minutes and 10 per day, and 10 times per connection IP in 15 minutes and 50 per day. These sit on top of the site and API request limits that already exist. When you are not signed in, the site forwards your IP to the API only with a verified service credential. Linking while signed in counts against the IP the API sees. Codes and sign-in requests expire after 10 minutes. We do not keep provider access, refresh, or ID credentials, passwords, or plaintext codes. For the sign-in and abuse-control window we keep hashed state, a one-time check value, short-lived sign-in context, a 10-minute navigation cookie that is cleared when used, salted code digests, attempt counts, and digests used for IP quotas. Maintenance removes expired sign-in requests and email-quota rows older than one day.

• csrf: a security check. Browser scripts can read it. Kept for about 1 day.
• auth_navigation_google and auth_navigation_apple: an encrypted sign-in handoff. Scripts cannot read it. Kept for about 10 minutes, and cleared when used or when it expires.
• web_access: an encrypted login credential. Scripts cannot read it. Kept for 30 days.
• web_refresh: an encrypted refresh credential. Scripts cannot read it. Kept for 30 days.
• locale: your language. Scripts cannot read it. Kept for 1 year.
• currency: your currency. Scripts cannot read it. Kept for 1 year.
• reference: your reference country. Scripts cannot read it. Kept for 1 year.
• currency_picked: whether you chose a currency yourself. Scripts cannot read it. Kept for 1 year.
• tz: the device time zone, used to show times. Scripts can read it. Kept for 1 year.

Light and dark theme is stored in the browser's local storage, not in a cookie.

On HTTPS, these cookies are sent only over HTTPS.

Telegram: when you log in, the browser connects to telegram.org and oauth.telegram.org. We receive the user id and name. If you turn on Telegram price alerts, the bot sends the game name, region, price, discount, sale end time, and a link to the game page to your Telegram chat. If you turn on community notices, the bot also sends the number of players who found your short reviews helpful, the games on your wishlist that are on sale and their prices, and this week's highly rated community games to the same chat.

The browser loads game covers directly from image hosts, such as Nintendo's image servers. Those hosts can see your IP address and browser information.

Hosting: the site and the database run on an Oracle Cloud virtual machine. A connection passes through that machine, so it can see the IP. Database backups are uploaded to Oracle cloud storage. Offsite backups are deleted after 14 days. The machine keeps only the newest 3 copies.

App push: if you register push in the app, we send the push token and the notice to Expo (exp.host). The notice includes the game name, region, price, sale end time, and the game page path.

The exchange-rate service open.er-api.com, the DB-IP country data, and Apple's iCloud Private Relay egress list are downloaded by the server. Those requests do not include your account and do not forward your IP.

After you confirm deletion on the delete-account page, the account is disabled at once, every login stops, notices stop, price alerts turn off, and the Telegram login is unlinked. Short reviews, ratings, votes, reports, marks, and the nickname are deleted at once.

The rest of the personal data, including the wishlist, price alerts, preferences, notice history, notification channels, and login credentials, is removed by a daily job after 30 days. The job's run time can make the actual removal later. The login-proof hash is kept until that grant expires, plus one minute.

Deleting the account removes sign-in methods and unfinished sign-in data that still belongs to the account immediately, and signs out every session. Login and code-quota rows with no account owner stay only until they expire, and a daily job removes rows older than a day, so they can remain for up to two days. Other account content still follows the existing retention and deletion rules. Linking a sign-in method does not by itself turn on notices. Notices still go to Telegram. Removing a Telegram sign-in does not stop notices already set for that Telegram chat.

Deleted data can remain in a backup until that backup is discarded. The machine keeps at most 3 copies, and offsite backups are deleted after 14 days. Public game and price data stays. Signing back in creates a new account with none of the old data.