Personal data
Privacy policy
What Game Picker does with your data, one processing at a time, exactly as the code does it. Controller: Yoan BISOGNO, 45 Rue Jean Moulin, 78400 Chatou — bisogno.yoan@gmail.com.
In short
- No advertising trackers, no third-party analytics, no data resale.
- Without an account: one strictly necessary session cookie and preferences (language, theme, filters) stored in your browser.
- With an account: your e-mail, hashed password and history. With Premium: your purchase (Stripe) and, if you choose, your Steam library and wishlist, your price alerts.
- Server hosted in France (Oracle, Paris region). Three providers outside the EU may see a piece of data: Stripe (payment), Resend (alert e-mails), Valve (reading your public Steam profile).
Processing activities
Browsing session
- Data
gp.sidcookie (random identifier), anonymous session preferences (chosen filters, pulled games) stored server-side.- Purpose
- Make the machine work: keep your settings, your last pull, your logged-in account; protect the site from abuse.
- Legal basis
- Legitimate interest (operation and security) — strictly necessary cookie, exempt from consent.
- Retention
- 30 days after your last visit, then deleted automatically.
- Access
- The publisher only, on the server.
- Outside EU
- None.
User account
- Data
- E-mail, password (bcrypt-hashed, never readable), optional nickname, creation and purchase dates, acceptance of the terms.
- Purpose
- Recognise you across devices, keep your Premium unlock, answer your requests.
- Legal basis
- Performance of the contract (terms of use) — and legal obligation for purchase-related data.
- Retention
- As long as the account exists. Deleted on request or from the account menu; purchase records are kept 10 years (accounting law).
- Access
- The publisher.
- Outside EU
- None.
Premium unlock payment
- Data
- E-mail, amount, Stripe payment id, date. Your card number is entered at Stripe and never passes through the site.
- Purpose
- Collect the purchase, activate the unlock, issue the invoice, handle refunds.
- Legal basis
- Performance of the contract (terms of sale) and legal obligation (accounting, invoicing).
- Retention
- 10 years for records (French Commercial Code).
- Access
- The publisher and Stripe Payments Europe Ltd (Ireland), payment provider.
- Outside EU
- Stripe may transfer data to the United States under the Data Privacy Framework and standard contractual clauses.
Steam library and wishlist (Premium, on your action)
- Data
- Your Steam ID, public Steam name and avatar, the list of games you own (with playtime) and your wishlist, as made public by you on Steam.
- Purpose
- Pull games you already own, pull from your wishlist, tell you about wishlist deals.
- Legal basis
- Performance of the contract, at your explicit request (“Sync” button) — withdraw at any time (“Disconnect”).
- Retention
- While the Steam connection is active on your account; deleted as soon as you disconnect or delete your account.
- Access
- The publisher. Data is read through Valve Corporation’s public API (Steam).
- Outside EU
- Valve Corporation is based in the United States: the read request sends them your Steam ID.
History, feedback and tastes
- Data
- Pulled games, “playing / not for me / done” and the optional reason, watched games, inferred preferences (genres, styles).
- Purpose
- Avoid repeating games, learn your tastes, power “My pile” and price alerts.
- Legal basis
- Performance of the contract (a feature you use).
- Retention
- Free account: last 5 pulls; Premium: while the account exists. Erasable at any time (“Clear all”).
- Access
- The publisher.
- Outside EU
- None.
Price alerts by e-mail (Premium)
- Data
- Your e-mail, watched games and detected deals.
- Purpose
- Send you a digest when a game from your pile or wishlist goes on sale.
- Legal basis
- Performance of the contract: a service you enable yourself (“Price alert” / wishlist); disable it in the app or through the link at the bottom of every e-mail.
- Retention
- Up to 60 alerts per account; e-mails are not kept by the publisher.
- Access
- The publisher and Resend, Inc. (United States), e-mail delivery provider.
- Outside EU
- Resend processes the address and message content in the United States under standard contractual clauses (Resend data processing agreement).
“With my friends” rooms
- Data
- Room code, chosen nickname, votes.
- Purpose
- Pull a game as a group.
- Legal basis
- Performance of the contract.
- Retention
- In memory only, erased 3 hours after the room is created.
- Access
- Room participants and the publisher.
- Outside EU
- None.
Usage measurement
- Data
- Aggregate counters (pulls, store clicks, shares, store clicked, game pulled) — no identifier, no IP address, no cookie.
- Purpose
- Know whether the service is useful and which partners work.
- Legal basis
- Legitimate interest (service improvement); non-identifying data.
- Retention
- Daily counters 90 days, raw log 13 months maximum.
- Access
- The publisher.
- Outside EU
- None.
Security and technical logs
- Data
- IP address and requested pages in the web server logs (nginx); IP in memory to rate-limit requests.
- Purpose
- Detect abuse, diagnose failures.
- Legal basis
- Legitimate interest (security) and legal retention obligation for connection data.
- Retention
- Server logs: 12 months maximum; rate limiting: 10 minutes in memory, never written to disk.
- Access
- The publisher; the host Oracle has infrastructure access.
- Outside EU
- None (server in Oracle region eu-paris-1, France).
Third-party content displayed
- Data
- When a page shows a game’s artwork, your browser downloads it directly from the provider, which sees your IP address: RAWG (media.rawg.io), IGDB / Twitch (images.igdb.com, Amazon Web Services), Valve (Steam). Steam prices are read by the server, not by your browser.
- Purpose
- Show game artwork.
- Legal basis
- Legitimate interest (content display) — no cookie set, no account data sent.
- Retention
- According to those providers’ policies (CDN logs).
- Access
- Those providers.
- Outside EU
- Servers may be located in the United States (Twitch/Amazon, Valve).
Discord bot (if you invite it to your server)
- Data
- The command content (/game…) is processed on the fly to reply; nothing is stored, neither your Discord id nor your server.
- Purpose
- Pull a game from Discord.
- Legal basis
- Performance of the contract.
- Retention
- No retention.
- Access
- The publisher; Discord Inc. (United States) relays messages under its own terms.
- Outside EU
- Via Discord.
Your rights
You have the rights of access, rectification, erasure, restriction, objection and portability.
- In the app: account menu → “Export my data” (full JSON file) and “Delete my account” (immediate erasure of the account, history, feedback, alerts and Steam connection; only purchase records are kept for the legal period). “Clear all” in My pile erases history and preferences. “Disconnect” removes Steam data.
- By e-mail: bisogno.yoan@gmail.com — answer within one month. Proof of identity may be requested in case of reasonable doubt.
- Complaint: you may lodge a complaint with the CNIL (French data protection authority) — cnil.fr, or with your local authority.
Security
Encrypted connection (HTTPS, HSTS), hashed passwords (bcrypt), httpOnly and secure session cookie, protection against forged requests, rate limiting, security headers (CSP). Data is backed up daily on the server (14-day retention). Should a data breach put you at risk, you will be informed within the GDPR deadlines.
Minors
The service is intended for people aged 15 and over. Games shown may be rated PEGI 16 or 18: Game Picker displays information about them but does not sell them.
Changes
This policy is updated when the service changes; the date at the bottom of the page applies. Substantial changes are announced on the site.
Last updated: 20 September 2026