Privacy Policy

1. Who is responsible for your data

The data controller is Mariusz Górski, an individual developer operating GamePile as a personal project. For any question about this policy or about your data, write to [email protected].

There is no separate Data Protection Officer; requests are handled directly by the developer.

2. What data we collect

We collect only what the app needs in order to work:

• Account data — your email address, a securely hashed version of your password (we never store the password itself), your account status, and an optional note you may include when requesting access.
• Profile data — your gamertag, your chosen avatar and card style, your profile visibility setting (public or private), and whether the aging effect is enabled.
• Your game library — the games you add and everything you record about them: which screen they sit on, completion details (platform, date, fun score), retirement reasons, your own review scores and notes, and "poke" activity. This history is stored as an append-only event log, so earlier entries remain recorded until the data is deleted.
• Discovery activity — the recommendation cards you add, defer, or dismiss, and your taste and filter preferences.
• Social data — friend requests you send or receive, and your confirmed friendships. Friends can see your activity for a given game; other users never see your email address.
• Technical data — a login token stored securely on your device, and server logs recording the requests made to the service (method, path, response status, and timing) for troubleshooting. Our hosting provider may additionally process connection data such as IP addresses at the infrastructure level.

3. What we do not collect

The app contains no analytics, advertising, crash-reporting, or user-tracking SDKs of any kind. We do not collect your location, your contacts, your device identifiers, or an advertising ID. We do not build advertising profiles and we do not sell or rent your data to anyone.

Some settings never leave your device at all: your language choice, text-size preference, tutorial progress, and unsaved drafts are stored locally on your phone only.

4. Cookies on this website

This website uses only strictly necessary cookies. It sets no advertising, analytics, or tracking cookies, and the Android app itself uses no cookies for its own features.

• guest_lang — remembers whether you chose English or Polish, so the site stays in your language. It stores nothing but that choice.
• admin_token — a session cookie set only when an administrator signs in to the management panel. Ordinary app users never receive it.

5. Why we use your data, and on what legal basis

• To provide the service — creating and maintaining your account, storing your game library, generating recommendations, and running the friends features. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• To keep the service secure — authenticating you, preventing abuse, and diagnosing faults. Legal basis: our legitimate interests in a secure and functioning service (Art. 6(1)(f) GDPR).
• To communicate with you — sending account approval notices and password reset links. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

6. Who your data is shared with

We do not sell your data. It is shared only with the service providers needed to run the app:

• Resend — delivers transactional email (account approval, password resets). It receives your email address.
• IGDB (Twitch / Amazon) — supplies game information. Searches are made by our server, not your device, so IGDB does not receive your IP address for searches. However, cover art and screenshots are loaded directly by the app from IGDB's image servers, which means IGDB receives your device's IP address when images load.
• YouTube (Google) — game trailers are played through an embedded YouTube player inside the app. When you open a trailer, Google receives your IP address and device information and may set cookies, under Google's own privacy policy.
• HowLongToBeat and RAWG — supply playtime estimates and game data. These are queried by our server only; your device never contacts them directly.
• Google Play — distributes the app and handles the open testing programme, under Google's own privacy policy.
• Our hosting provider — stores the database and runs the server on our behalf.

7. International transfers

Some of the providers above (notably Resend and Google) process data outside the European Economic Area, including in the United States. Such transfers rely on the European Commission's Standard Contractual Clauses or an applicable adequacy decision. You may contact us for more detail on the safeguards in place.

8. How long we keep your data

Your account data and game library are kept for as long as your account exists. When an account is deleted, we remove its event history, discovery activity and preferences, profile, friendships, and any outstanding password reset tokens from the database.

Password reset tokens expire shortly after they are issued. Cached game information from IGDB, HowLongToBeat, and RAWG describes games rather than people and is not personal data.

9. Your rights

Under the GDPR you have the right to access your data, to correct it, to have it erased, to restrict or object to its processing, and to receive it in a portable format. To exercise any of these rights, write to [email protected]. We will respond within one month.

The app has no self-service account deletion screen: erasure requests are carried out by hand by the developer once you ask. This is a deliberate limitation of the current testing phase, not a refusal — your request will be honoured within the same one-month period.

If you believe your data is being handled improperly, you may lodge a complaint with the supervisory authority in the EU country where you live or work. The authority for the controller is the Polish one: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

The app does not carry out automated decision-making that produces legal effects concerning you. Game recommendations are suggestions only.

10. How your data is protected

Traffic between the app and our server is encrypted in transit. Passwords are stored only as bcrypt hashes, and your login token is held in your device's secure storage. Access to the administration panel requires a separate administrator account.

No system can be guaranteed completely secure. If a breach affects your rights, we will notify you and the supervisory authority as required by law.

11. Children

The app is not directed at children, and we do not knowingly collect their data. Under the GDPR the age of digital consent is set by each EU country and falls between 13 and 16; if you are below the age that applies where you live, please do not create an account without your parent or guardian's permission. If you believe a child has created an account, contact us and we will delete it.

12. Testing-phase notice

GamePile is currently distributed as an open test (alpha). The app is under active development, and data may be reset or lost between test builds as part of that process. Please do not treat the app as the only record of anything you would be sorry to lose.

13. Changes to this policy

If this policy changes, the revised version will be published on this page with a new "last updated" date. Significant changes will also be announced in the app or by email.

14. Contact

Questions, requests, and complaints: [email protected].