Privacy policy

Controller

Ana Gissela Torres Cruz, Spain. Data protection contact: rgpd@gameslibrary.app.

What we process and why

Account data (email, password hash, name, username, language, country if you add it) to provide the service — legal basis: contract.

Collection data (games, consoles and accessories, platforms, prices paid, notes, photos you upload, wishlist) to provide the service — contract.

Billing data (handled by Stripe; we store customer and subscription identifiers, plan, interval and status) — contract and legal obligation.

Usage of AI features (counts per month) to enforce plan limits — contract.

Technical logs (IP address, user agent, timestamps) for security — legitimate interest.

Messages sent through the contact form (name, email and message) to answer you — consent, which you give with the checkbox and can withdraw at any time.

Analytics cookies on the public website only with your consent (see the cookie policy).

Emails we send

All emails are sent from info@gameslibrary.app through our own mail server, hosted by BanaHosting (SMTP). We do not use email marketing platforms.

Account emails (confirming your address and a reminder if it is still unconfirmed, sign-in links, password resets and a welcome message when a paid plan starts) are part of the service — contract. They cannot be switched off while the account exists.

Account reminders: if you have not added any game some days after confirming your email, or have not added one in 30 days, we may write to suggest how to continue. They contain no offers or prices — legitimate interest in helping you use the service you signed up for. Every reminder includes a link to stop receiving them, and you can also ask at rgpd@gameslibrary.app.

Price-drop alerts: only for the wishlist games on which you switch on an alert (Basic and Premium) — contract, at your request. Each alert email has a link to switch that alert off, and you can switch alerts off in your wishlist at any time.

Public collection wall

Your collection is private unless you publish it. If you switch on the public wall (on the welcome screen or in Settings → Public profile), anyone with the link can see your username, display name, bio, country flag, member-since date and the games in your collection at /@username; optionally, you can also open a page per game. It never shows your email, prices paid, estimated values, purchase dates or notes. You can switch it off at any time; the page then stops being available, although search engines may take some time to drop copies they had stored.

Processors

Supabase (database, file storage and authentication, EU region Paris), Cloudflare (hosting and network), BanaHosting (email server for sending emails and the info@ mailbox), Neutral B (receives and manages messages sent through the contact form), Stripe (payments), Anthropic (Claude) and Google (Gemini) for AI features: the photo or query you submit is sent to the model to be processed; Anthropic is used first and Google only as a fallback, and under their API terms the content is not used to train their models. IGDB/Twitch and RAWG receive only the game searches, not your identity. Google Tag Manager/Analytics only with consent. Anthropic, Google, Stripe and Cloudflare may process data outside the EEA (mainly in the United States); those transfers rely on the EU–US Data Privacy Framework or Standard Contractual Clauses.

Links to stores and affiliation

Price comparisons and "where to buy" buttons link to external stores. Some of those links may be affiliate links: they are marked as such, and if you buy, the store or the affiliate network (for example Awin) may pay us a commission at no extra cost to you. We do not share your account data with stores or networks; they may record the click and set their own cookies on their websites under their own policies.

YouTube videos (Walkthroughs)

The Walkthroughs section and game pages show video guides through the YouTube API Services. We store public data about those videos (title, channel, duration, view count) for up to 30 days and, if you watch them, which video and minute you reached, so you can resume — contract. Videos play in YouTube's embedded player (youtube-nocookie.com) and nothing from YouTube loads until you press play; from then on YouTube's Terms of Service (www.youtube.com/t/terms) and Google's Privacy Policy (policies.google.com/privacy) apply.

Retention

Account and collection data: while your account exists and up to 30 days after deletion in backups. Billing records: as long as tax law requires (Spain: generally 4–6 years). Contact form messages: while we handle your request and afterwards only as long as needed for any follow-up or claim. Logs: up to 12 months.

Your rights

Access, rectification, erasure, restriction, portability and objection, and withdrawal of consent at any time. You can export your data and delete your account from Settings. For any request write to rgpd@gameslibrary.app. You may also lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local authority.

Security

Data is encrypted in transit and at rest, access is restricted per user by row-level security, and passwords are never stored in clear text.

Children

The service is not directed at children under 16.