Privacy policy

• Your collections, notes, diary and everything else you save are private unless you choose to share them.
• One thing is on unless you turn it off: your likes and ratings count, anonymously and only in aggregate, towards suggestions for players with similar taste.
• We don't sell your data, show ads, or use analytics or advertising trackers.
• Some features send what they need to other services: an AI model for content checks, photo scans, summaries and suggestions, an email service for password emails, and the gaming platforms you link.
• You can download your data, or delete your account and everything in it, from the Account page at any time.

When you use Game Vault, we store:

• Your account: your email address, name and username, and your password in hashed form (it can't be read back, even by us). If you sign in with Google, we store the ID Google gives your Google account, so we know it's you next time, and when you linked it. Not your Google password, and none of Google's sign-in tokens.
• Photos you upload: your profile picture and any collection covers, after they've passed the content check.
• Your collection: collections and sub-collections, games, owned copies, statuses, ratings and likes, playtime, trophies and achievements, your diary, play sessions and reviews, picks, your gift list, challenges and Wrapped, and your settings and preferences.
• Linked gaming accounts: the Steam ID, PlayStation online ID and account ID, and Xbox gamertag and ID you link, plus the game lists, playtime and trophies we sync from them.
• Sign-in sessions: for each device you're signed in on, the IP address and browser (user agent) it signed in from, so the session can be checked and ended.
• What we learn about your taste: which game pages you open and when you ask “Is this for you?” (counted per game), the games you mark Not interested with any reasons and note you give, and anything you've taken out of What we've learned. It's worked out from these and what you've saved. See how Game Vault learns what you like.
• Feature use: how many times a day you open each part of the site (Collections, Diary, Discover and so on), to show you which features you use most. Only counts per part per day: never which page, game or search.
• Likes you give to other players' shared collections and reviews. Pages only ever show how many likes something has, never who gave them.
• Reports and appeals you send, with the reason and any details, and what a moderator decided. The person you report isn't told who reported them.
• Photo scan matches: when you add games from a photo, which game you picked for each title the AI read (not the photo). These help suggest the right game next time: for you straight away and, anonymously, for other players once at least two people have made the same correction.
• Spreadsheet imports: the file name and rows of a spreadsheet you import, so an import can pick up where it stopped.

To stop abuse, we also count attempts:

• Signing in, signing up and password resets are counted by IP address and the kind of request, whether or not you're signed in. These counters aren't linked to your account and aren't deleted: each one keeps an IP address, a count and the time of the last attempt.
• Searches and other costly features are counted by your account, or by your IP address when you're not signed in. These counters are deleted after 24 hours.

Nothing you save is public until you choose to share it. Your public profile and what it shows are set in Sharing & linked accounts. When it's on, anyone (signed in or not) can see your username, profile picture and headline numbers (games owned, trophies, playtime), and:

• Shown unless you turn them off: your latest platinums, what you're playing now, and your picks.
• Off until you turn them on: your stats and AI taste profile, your gift list, your challenges, and your diary. A shared diary shows what you played each day and for how long, trophies you earned, your play sessions with their notes and the times you logged, and your ratings and reviews. Your reviews then also appear on each game's Community tab.

Some things are shared from their own pages. A collection you share appears on your public profile and on the Community page, but only while your profile is public. A Wrapped you share can be seen by anyone with its link, even while your profile is off; it shows your username.

Your email address is never shown to other players, and neither is your display name: public pages use your username. Notes, and whether you liked a game, stay private even in a shared collection.

Your likes and ratings count, anonymously and only in aggregate, towards “loved by players with your taste” suggestions for others. A game is only suggested once several players agree, and nobody sees who. You can turn this off at any time on What we've learned.

• To run your account and the features you use: storing your collection, syncing trophies, stats, Discover and Wrapped.
• To tailor suggestions and AI answers to your taste, which you can see, correct or reset.
• To keep the community safe: checking what you write and upload against the community policy, handling reports and appeals, and preventing abuse.
• To send the emails you need: the link to confirm your email address, password reset links, approving and confirming a change of email, a notice when your password changes or when a password or Google sign-in is added to or removed from your account, and a note if someone tries to sign up with your address. We don't send marketing email.

We don't sell your data. We use these services to run Game Vault, and each one only receives what its job needs:

• Google Cloud hosts the site and the database where everything above is stored. Like any host, it keeps logs of requests to the site, including IP addresses, for its standard retention period.
• Resend sends our emails. It receives your email address, your name (for the greeting) and the message, such as a confirmation or password reset link. When you change your email, it also receives the new address.
• Google Sign-In, only if you choose Continue with Google. We ask Google for your name, your email address and whether Google has verified it, and the ID of your Google account (the “openid”, “email” and “profile” permissions, nothing more). Google's answer can include a link to your Google profile picture; we don't keep it. Your Google name becomes your Game Vault name after the same check as any name (if it can't be used, you're called “Player” until you change it). We don't post anything to Google or read anything else from your Google account, and we don't keep Google's access tokens. Google knows you signed in to Game Vault, as with any site you sign in to with Google. You can remove Google from Account › Sign-in methods once you have a password, and in your Google account's security settings.
• An AI provider (Google's Gemini, through the Gemini API on our paid Google Cloud account, unless we tell you otherwise here) receives:
  • the text and photos you save, to check them against the community policy;
  • the photos you scan, to find the games in them;
  • the column headings and first few rows of a spreadsheet you import, when we can't tell its columns apart ourselves;
  • for recommendations, taste profiles, “Is this for you?” and gift ideas: a summary of your stats, ratings, likes and statuses, excerpts of your reviews, and your Not interested reasons and notes;
  • if your diary is public, your reviews (text and rating) may be among the up to 15 recent reviews from public diaries used to write the shared “what players say” summary on a game's Community tab.
  It isn't sent your email address, and we don't use your data to train AI models. On the paid Gemini API, Google doesn't use what we send to improve its products either.
• IGDB (owned by Twitch) provides game details and cover art. When a search can't be answered from our own copy of the catalogue, the search words are sent to IGDB, without anything that identifies you.
• Steam (Valve), PlayStation Network (Sony) and Xbox via OpenXBL: when you link an account, we send the Steam ID, PlayStation online ID or account ID, or Xbox gamertag or ID you gave us, to fetch your games, playtime and trophies. What they return depends on your privacy settings there.
• UPCitemdb receives the barcode numbers you scan, to find the product. Nothing else is sent.
• Wikidata is asked for game credits (who made a game), by game. Nothing about you is sent.

Covers and icons are loaded through our own servers, and fonts are served by us, so your browser doesn't contact these services when you browse. Some of these services are based in other countries, including the United States, so your data may be processed outside the country you live in.

Our moderators can see content that's been reported or appealed, the reports about it, and the display names of the person who reported it and the person who wrote it. We may also share information if the law requires it, or to protect people from serious harm.

To look into reports and keep the community safe, our staff can see an account's name, email address, when it joined and was last active, how many games, collections and reviews it has, and the reports about it. They can suspend an account (it can't sign in, and what it shared is hidden until the suspension ends), sign it out everywhere, or close it (it's deleted for good 30 days later unless the decision is reversed). The site's owners can also view the site as an account sees it, read-only and for up to an hour, to check a problem. Every one of these actions is recorded, with who did it, when and why.

We don't use advertising, analytics or third-party cookies. Game Vault sets only these:

• Your sign-in cookie, which keeps you signed in. It lasts 7 days and is renewed while you use the site. Signing out removes it.
• Hide swear words, set only if you turn that on, so it works from the first moment a page loads.
• Collection view, set when you choose grid or list, or how many games a page shows, so your collections open the same way next time.

Your browser's local storage also remembers a few display choices on this device: which chart each Stats card shows, and whether the photo scan panel is collapsed. While you add games from a photo, the tab remembers which collection they're going to. None of this is sent to us.

• Your account and everything in it is kept until you delete it, or delete the parts you no longer want.
• Deleted collections and games stay in Recently deleted for 30 days so you can restore them, then are deleted for good (or straight away if you choose “Delete forever”).
• Scanned photos are deleted as soon as you've reviewed or dismissed the scan, and after 24 hours at the most. Photos that break the community policy are deleted straight away. The scan's list of matches is deleted after 7 days.
• Spreadsheet imports are deleted 14 days after they were last worked on. The games you imported stay in your collection.
• Sign-in sessions expire 7 days after you last used them. Signing out ends one, and resetting your password signs you out everywhere. The record of an expired session (with its IP address and browser) is only removed when that browser comes back with its old cookie, or when you delete your account; until then it stays in our database.
• Email confirmation and change-of-email links work for 24 hours. They aren't stored: each link carries its own signed code.
• Password reset links work for an hour. The record of a link that expired unused (a random code and your account's internal ID) stays in our database, even after you delete your account.
• Sign-in, sign-up and reset counters (by IP address) aren't deleted. Other counters are deleted after 24 hours.
• What we've learned and feature-use counts are kept until you choose Start afresh on What we've learned, or delete your account.
• A game's Community summary is shared by everyone and isn't rewritten straight away when someone stops sharing their diary or deletes their account, so it may reflect their review until it's next written.

The content check remembers its decisions by a fingerprint of the text or photo, never the content itself, so unchanged content isn't checked twice. Copies of the database kept as backups may hold deleted data for a limited time until they're replaced.

• See and download your data: Account › Your data downloads everything saved for your account as a JSON file, including how you sign in (password, Google), except your hashed password and sign-in sessions. Scanned photos aren't included, and nor are reports other people made about your content. Items in Recently deleted are listed, not included in full: restore one to get it back into the download.
• Correct it: change your name, username, picture and settings in Account, edit anything you've saved, and correct or reset what we've learned about your taste.
• Control sharing: turn your public profile, each part of it, and each shared collection or Wrapped on or off at any time, and opt out of counting towards suggestions for others.
• Unlink a platform in Sharing & linked accounts.
• Delete your account: Account › Delete account deletes your account and everything in it straight away, for good, including your photos, sessions, likes, reports and what we've learned.

Depending on where you live, you may have other rights over your data, such as to object to how it's used or to complain to a data protection authority. To ask about any of them, email support@your-game-vault.app.

You must be at least 13 to use Game Vault, and if you're under 18 you need a parent or guardian's permission (see the terms). If you think a child under 13 has an account, email support@your-game-vault.app and we'll remove it.

Connections to Game Vault are encrypted, passwords are stored hashed, and every request for your private data checks that it's you. Sign-in attempts are rate-limited. Google sign-in only joins an existing account whose email has been confirmed. No system is perfectly secure, so use a password you don't use anywhere else.

If we change what we store or who we share it with, we'll update this page and the date at the top.

See the FAQ, or email support@your-game-vault.app.

Services mentioned: Google Cloud, Resend, Google Gemini API, IGDB, OpenXBL, UPCitemdb, Wikidata.