Privacy

What we store

• Account: your email address, display name, username, and when you joined. If you use a password, we store only a salted bcrypt hash of it, never the password itself. If you sign in with Google, we get your name, email and profile picture from Google.
• What you log: games, platforms, dates, ratings, reviews and shelves.
• Security records: one-time links we email you (stored only as hashes, and they expire), and a counter that lets us sign you out everywhere.

What's public

Once you choose a username, your profile at /u/your-username shows your display name, username, profile picture, join date, the games you've logged with their ratings and reviews, and your shelves. Anyone can see it without signing in. Your email address is never shown.

Cookies

Only what signing in needs: a session cookie that keeps you signed in (for up to 14 days), plus short-lived security cookies used during sign-in. No analytics, advertising or tracking cookies.

Who else is involved

• Amazon Web Services hosts the site and its database, in London (UK).
• Resend delivers our emails (confirmations, password resets, account notices), so it sees your email address and the message.
• IGDB (owned by Twitch) provides game details and artwork. Searches go from our server to IGDB and aren't linked to you.
• Have I Been Pwned lets us warn you off passwords that have appeared in data breaches. Only the first five characters of a hash of the password are sent, so neither the password nor its full hash ever leaves our server.
• Google, only if you choose “Continue with Google”.

How long we keep it

Everything is kept while you have an account. When you delete your account, your profile, logs, reviews and shelves are removed from our database straight away. Our web server's logs record IP addresses and the pages requested, for security and troubleshooting, and are deleted after about two weeks.

Your choices

• Download your data any time from Settings → Your data (JSON, or your diary as CSV).
• Delete your account from Settings → Delete account.
• Anything else (corrections, questions, a copy of your data if you can't sign in): email support@beaten.games from your account's address. See Help & support.

If you're in the UK or EU, data protection law gives you rights to access, correct, delete and take a copy of your data. The tools above cover most of them, and we'll handle anything else by email.