Privacy Policy
Effective date: 2026-05-25 Data Controller: [not specified] ([not specified]) Data Protection Officer: [not specified], [not specified]
This Privacy Policy explains what personal data we process when you use ProGameInfo, why we process it, how long we retain it, and what rights you have under the EU General Data Protection Regulation (GDPR) and equivalent laws.
If you do not agree with the practices described here, do not use the Service.
1. Data we collect
1.1 Data you provide directly
- Account data: email address, username, display name, password (stored as Argon2 hash; we never see the plaintext after registration).
- Profile data: avatar URL, language preference, optional bio, optional country, optional links you choose to add (Discord handle, Twitch handle, etc.).
- Connected accounts: when you link Discord, Google, or Steam, we receive the provider's user ID, the provider's display name, and email (where the provider exposes it). We store an encrypted reference to the linked identity but not the OAuth refresh token in plaintext.
- Content you submit: wiki articles, forum posts, party ads, comments, server descriptions, profile fields, support and abuse reports.
- Communications: emails you send to support, abuse, or legal addresses.
1.2 Data collected automatically
- Session data: a SHA-256 hash of the IP address used to sign in, the User-Agent header, the timestamp, and the resulting session ID. We store the hash of the IP, not the IP itself, to allow correlation of abuse without keeping a direct identifier.
- Two-factor metadata: encrypted TOTP secret if you enable 2FA, hashed recovery codes.
- Cookies and similar technologies: see section 6.
1.3 Data we do **not** collect
- We do not run third-party advertising trackers.
- We do not collect biometric data, facial recognition, or health data.
- We do not collect data from minors under the age of digital consent (16 in the EU). Accounts found to belong to minors are deleted on discovery.
2. Why we process your data (legal bases under GDPR)
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Creating and operating your account | Performance of contract (Art. 6(1)(b)) |
| Authentication and session management | Performance of contract |
| Publishing UGC and showing it to other users | Performance of contract |
| Operating the search, catalog, and notification systems | Performance of contract |
| Investigating abuse, fraud, and security incidents | Legitimate interest (Art. 6(1)(f)) - protecting users and the Service |
| Responding to law enforcement requests | Legal obligation (Art. 6(1)(c)) |
| Responding to DMCA / copyright notices | Legal obligation; legitimate interest of the rightsholder |
| Sending essential transactional emails (verify, reset password, security alerts) | Performance of contract |
| Aggregating anonymous usage statistics | Legitimate interest |
We do not process special categories of data (Art. 9 GDPR) unless you voluntarily publish such information in your profile or content. If you do, you do so on your own initiative and consent.
3. Who can see your data
- Public: your username, display name, avatar, profile bio, and any content you have voluntarily published to public surfaces (wiki articles, public party ads, profile, forum posts).
- You only: your email address, your accepted-policy history, your DSAR exports, your notifications, your account-settings pages.
- Service operators: a limited number of named operators of [not specified] who have access for support, abuse handling, and security operations. They are bound by confidentiality.
- Sub-processors: hosting (cloud-provider name to be disclosed in the data-processing addendum), email delivery, error tracking, and file storage. Each sub-processor is bound by a Data Processing Agreement and processes data only on our documented instructions.
- Law enforcement: upon receipt of a lawful request, see section 10 below.
We do not sell your personal data.
4. International transfers
Hosting infrastructure is located in [not specified]. Where personal data is transferred outside the European Economic Area, we rely on the EU Standard Contractual Clauses (SCCs) or an adequacy decision of the European Commission. A list of sub-processors and the transfer mechanism for each is available at [not specified].
5. Retention
| Data | Retention |
|---|---|
| Account data (active accounts) | Until you delete the account |
| Account data after deletion request | 30-day grace period, then anonymized |
| Session records (IP hash, UA, timestamp) | 90 days |
| Security logs (failed logins, 2FA events) | 1 year |
| UGC you have published | Until you delete it; backups for up to 90 days after deletion |
| DMCA reports and decisions | 2 years from resolution |
| Law enforcement disclosure records | 5 years |
| Financial / billing records (if applicable) | As required by tax law (typically 7-10 years) |
Anonymized usage statistics may be retained indefinitely as they are no longer personal data.
6. Cookies and local storage
We use the minimum necessary set of cookies and localStorage items to operate the Service:
- Essential (always on, no consent required): authentication session, refresh-token storage, anti-CSRF tokens, the consent record itself.
- Functional (consent required, off by default): language preference, theme preference, dismissed banners, UI layout state.
- Analytics / marketing: none as of the effective date. If we add any, we will update this section and ask for fresh consent.
You can manage your choices at any time from the cookie banner or from Account → Privacy.
7. Your rights under GDPR
You have the right to:
- Access the personal data we hold about you (Art. 15) - export available from /account/privacy or by emailing [not specified];
- Rectification (Art. 16) - most fields are editable in your profile; for fields you cannot edit, contact [not specified];
- Erasure (Art. 17, the "right to be forgotten") - account deletion from /account/privacy;
- Restriction of processing (Art. 18);
- Data portability (Art. 20) - the export bundle is provided in JSON;
- Object to processing based on legitimate interest (Art. 21);
- Withdraw consent at any time, where processing is based on consent.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you reside, work, or where the alleged infringement took place. A directory is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.
Requests are answered within 30 days. We may ask for proof of identity before acting on requests that would expose or modify your data.
8. Automated decisions
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects on you. Automated abuse-detection (rate limiting, spam filters) may temporarily restrict your actions but is always subject to human review on appeal.
9. Security
- All connections to the Service use TLS 1.2 or higher.
- Passwords are stored as Argon2id hashes with per-user salt.
- IP addresses are stored as SHA-256 hashes rather than as direct identifiers.
- Two-factor authentication is available and recommended.
- Access to production data is limited to named operators, logged, and subject to internal audit.
- Security incident reports: [not specified].
In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and, where the risk is high, notify you directly.
10. Law-enforcement requests
We disclose user data to law enforcement only on receipt of a lawful request (court order, prosecutor's request, or equivalent statutory mechanism) from a competent authority. We do not voluntarily share data outside this framework.
Where the law allows, we may notify the affected user. Where the law forbids notification (gag order or equivalent), we will withhold notice and disclose the existence of such requests only in aggregated transparency reports.
A transparency report listing the number of requests received and complied with is published annually at [not specified].
11. Changes to this Policy
We may revise this Policy. The latest version is published at /legal/privacy and identified by an effective date. Material changes are notified in-app on next sign-in; continued use of the Service after the new version takes effect constitutes acknowledgment.
A history of versions is available at [not specified].
12. Contact
Data Protection Officer: [not specified] - [not specified] Lead supervisory authority: [not specified] Postal address: [not specified]