Privacy Policy

01Who we are & overview

GameSave ("GameSave", "we", "us", or "our") provides a desktop application and online services (the "Service") that unify your PC and retro game libraries into a single gamified progression system, including GameScore, Credits (CR) and experience (XP), achievements, an in-app store, and global leaderboards.

This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, how long we keep it, how we protect it, and the choices and rights you have. It applies to the GameSave desktop app, the websites at gamesave.app and its subdomains, and related services that link to this policy.

For the purposes of European and United Kingdom data protection law, GameSave is the "controller" of the personal information described in this policy. If you have questions, you can reach us at any time at privacy@gamesave.app.

02Scope of this policy

This policy covers personal information we process when you:

• visit our websites or request a beta invite;
• create and use a GameSave account;
• link a gaming platform (such as Steam, GOG, Epic, Xbox, EA, Ubisoft, itch.io, Battle.net, Riot Games or PlayStation) or add retro libraries;
• earn, spend or are awarded Credits, GameScore or XP;
• make or request a purchase or refund in the in-app store;
• appear on leaderboards or participate in challenges; or
• contact us for support, press or other reasons.

It does not cover the privacy practices of third parties we do not own or control, including the gaming platforms and stores you link, payment providers, or external sites we link to. Their handling of your information is governed by their own privacy policies.

03Information we collect

a. Information you provide to us

• Account information - your username/handle, email address, and a securely hashed password. We never store your password in plain text.
• Profile information - optional details such as a display name, avatar image, and preferences you choose to add.
• Beta & waitlist information - the email address you submit to request an invite, and the invite code you redeem.
• Communications - the contents of messages you send us (for example via the contact form or support email), including your name, email and message.
• Purchase & refund information - records of in-app store transactions, the items involved, and any refund requests you submit.

b. Information collected automatically

• Device & technical data - IP address, browser and user-agent, operating system, and a device/machine identifier used to secure your account and enforce activation and anti-fraud limits.
• Usage & activity data - actions you take in the Service, such as games added, sessions, completions, achievements unlocked, challenges completed, and economy events (CR/GS/XP earned or spent). This data is essential to operate the progression system and keep the leaderboards accurate and fair.
• Approximate location - we may derive a coarse, country/region-level location from your IP address for security, fraud prevention and analytics. We do not collect precise GPS location.
• Log & diagnostic data - server and application logs, error reports, and timestamps used to operate, secure and improve the Service.

c. Information from third parties

• Linked gaming platforms - when you link Steam, GOG, Epic, Xbox, EA, Ubisoft, itch.io, Battle.net, Riot Games, PlayStation or similar, we use your existing session/tokens to verify, via that platform's own API, identifiers and the games you own. We store only what is needed to confirm ownership and maintain the link (such as a platform user identifier and encrypted credentials/tokens). We never ask for or store your platform passwords.
• Service providers - we may receive limited information from providers that help us deliver email, hosting, security and analytics.

We do not knowingly collect special categories of sensitive data (such as health, biometric, or precise geolocation data) and we ask that you not send such information to us.

04How we use information

We use personal information to:

• create, authenticate and secure your account;
• provide the core Service - your unified library, progression, achievements, challenges, store and leaderboards;
• verify game ownership so that progression and rankings are legitimate;
• operate the economy and maintain the integrity of Credits, GameScore and XP, including server-side validation, rate-limiting and anomaly detection;
• detect, investigate and prevent fraud, cheating, abuse and security incidents;
• process purchases, refunds and related support;
• send service and transactional messages (such as verification, invite keys, security alerts and replies to your enquiries);
• provide customer support and respond to your requests;
• understand how the Service is used and improve it; and
• comply with legal obligations and enforce our terms.

We do not sell your personal information, and we do not use it for cross-context behavioural advertising. We may send you product news only where permitted, and you can opt out of non-essential messages at any time.

05Legal bases for processing (EU/UK)

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases under the GDPR and UK GDPR:

• Performance of a contract - to provide the Service you sign up for, including your account, progression and the store.
• Legitimate interests - to secure the Service, prevent fraud and cheating, maintain leaderboard integrity, and improve our product, balanced against your rights.
• Consent - where required, for example for certain optional communications or non-essential storage; you may withdraw consent at any time.
• Legal obligation - to comply with applicable laws, respond to lawful requests, and keep required records.

06Cookies & local storage

Our websites and app use a minimal set of cookies and local/in-memory storage that are strictly necessary to operate the Service - for example to keep you signed in, to remember preferences, and to protect against abuse. We do not use third-party advertising cookies or sell data collected through cookies.

You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent parts of the Service from working. Where local law requires consent for non-essential storage, we will request it.

07How we share information

We share personal information only as described below, and never sell it:

• Service providers / processors - vendors that host our infrastructure, send our email, and provide security and analytics, acting on our instructions under contract.
• Gaming platforms - when you link a platform, we exchange the minimum information needed to verify ownership through that platform's API.
• Payment providers - where purchases are processed, transaction information is handled by the relevant payment provider under its own terms.
• Public leaderboards & profiles - your handle, avatar, rank and certain progression metrics may be visible to other users as part of the competitive features. You control aspects of what you display.
• Legal & safety - to comply with law, enforce our terms, or protect the rights, property and safety of GameSave, our users or others.
• Business transfers - in connection with a merger, acquisition, financing or sale of assets, subject to this policy.
• With your direction - when you ask us to share information.

08Data retention

We keep personal information for as long as your account is active and as needed to provide the Service, and afterwards only as long as necessary for the purposes described in this policy - such as security, fraud prevention, leaderboard integrity, dispute resolution, and legal compliance.

When you close your account, we delete or anonymise personal information that we no longer need. For integrity reasons, certain non-identifying records (for example, anonymised platform-link rows that prevent a single platform account from being re-used to inflate leaderboards) may be retained. Backups are purged on a rolling schedule.

09How we protect data

We use technical and organisational measures appropriate to the risk, including: passwords stored using a strong, modern hashing algorithm; encryption of sensitive linked-platform credentials; encryption in transit (HTTPS/TLS); server-authoritative validation of the economy; rate-limiting and anomaly detection; access controls; and audit logging of administrative actions.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. Please use a strong, unique password and keep your credentials confidential. If we become aware of a personal data breach that affects you, we will notify you and the relevant authorities where required by law.

10International data transfers

GameSave operates from the United States and may process information in the United States and other countries where we or our service providers operate. These countries may have data-protection laws different from those in your country.

Where we transfer personal information out of the EEA or the UK, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, or another lawful transfer mechanism. You may request more information about these safeguards using the contact details below.

11Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or port your personal information, to object to or restrict certain processing, and to withdraw consent. We honour these rights as required by applicable law and never discriminate against you for exercising them.

To make a request, email privacy@gamesave.app or use our contact form and choose "Privacy & data request". To protect your information, we will take reasonable steps to verify your identity before acting, typically by confirming control of your account email. An authorised agent may submit a request on your behalf with proper authorisation.

We aim to respond within the timeframes required by the laws that apply to you (generally 30-45 days, with extensions where permitted).

12US state privacy rights

Residents of certain US states - including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and others with comprehensive privacy laws - may have rights to confirm whether we process their personal data, to access, correct and delete it, to obtain a portable copy, and to opt out of "targeted advertising", the "sale" of personal data, and certain "profiling". GameSave does not sell personal data and does not use it for targeted advertising.

You may exercise these rights using the contact details in this policy. Where a state grants a right to appeal a decision about your request, you may appeal by replying to our response or emailing privacy@gamesave.app with "Appeal" in the subject line.

13California privacy rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you specific rights regarding your personal information. This section serves as our California notice at collection and privacy rights disclosure.

Your California rights

• Right to know / access - the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
• Right to delete - to request deletion of personal information we collected from you, subject to exceptions.
• Right to correct - to request correction of inaccurate personal information.
• Right to opt out of sale/sharing - we do not sell or "share" (for cross-context behavioural advertising) personal information, so there is nothing to opt out of; we will honour Global Privacy Control signals as a valid request where applicable.
• Right to limit use of sensitive personal information - we do not use sensitive personal information for purposes that would trigger this right.
• Right to non-discrimination - we will not discriminate against you for exercising your rights.

Categories of personal information collected (last 12 months)

We collect these categories from you, from your device, and from gaming platforms you link, for the business purposes described in Section 4. We disclose them only to service providers/processors and as otherwise described in Section 7. We have not sold or shared personal information in the preceding 12 months.

Shine the Light: California Civil Code 1798.83 lets California residents request information about disclosures to third parties for their direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing.

To exercise any California right, contact privacy@gamesave.app or use the contact form. We will verify your request via your account email and respond within the CCPA timeframes. Authorised agents may submit requests with written permission and verification.

14EEA & UK rights (GDPR / UK GDPR)

If you are in the European Economic Area or the United Kingdom, you have the following rights in respect of your personal data, exercisable free of charge in most cases:

• Access - to obtain confirmation of, and a copy of, the personal data we hold about you.
• Rectification - to have inaccurate or incomplete data corrected.
• Erasure - to have your data deleted in certain circumstances ("right to be forgotten").
• Restriction - to restrict processing in certain circumstances.
• Portability - to receive certain data in a structured, machine-readable format and have it transmitted to another controller where technically feasible.
• Objection - to object to processing based on legitimate interests, and to direct marketing at any time.
• Withdraw consent - where processing is based on consent, at any time, without affecting prior processing.
• Automated decisions - rights in relation to solely automated decisions with legal or similarly significant effects (see Section 16).

To exercise these rights, contact privacy@gamesave.app. You also have the right to lodge a complaint with your local supervisory authority. In the UK, that is the Information Commissioner's Office (ICO) at ico.org.uk. In the EEA, it is the data protection authority in your country of residence. We would, however, appreciate the chance to address your concerns first.

15Children's privacy

The Service is not directed to children. You must be at least 13 years old (or the minimum age of digital consent in your country, which may be higher - for example 16 in parts of the EEA) to create an account. We do not knowingly collect personal information from children under the applicable minimum age.

If you believe a child has provided us personal information without appropriate consent, contact privacy@gamesave.app and we will take steps to delete it. We comply with the US Children's Online Privacy Protection Act (COPPA) and equivalent provisions of the GDPR and UK GDPR.

16Automated decisions & anti-cheat

To protect the economy and the integrity of our leaderboards, we use automated checks that validate awards, enforce rate limits, and flag anomalous or suspicious activity. These checks may temporarily limit actions or flag an account for human review.

We do not use these systems to make solely automated decisions that produce legal or similarly significant effects about you without human involvement, except where permitted by law. Where a decision (such as a suspension) would have a significant effect, a human reviews it, and you may contact us to express your view, obtain an explanation, and request reconsideration.

17Third-party links & services

The Service links to and integrates with third-party platforms and websites (such as gaming stores and our community Discord). We are not responsible for their content or privacy practices. We encourage you to review the privacy policies of any third party before providing them your information.

18Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. When we make material changes, we will update the "Effective date" above and, where appropriate, provide additional notice (for example, in-app or by email).

Your continued use of the Service after an updated policy takes effect constitutes acceptance of the changes, to the extent permitted by law.

19How to contact us

If you have any questions, concerns or requests regarding this Privacy Policy or your personal information, please contact us:

• Privacy enquiries & data requests: privacy@gamesave.app
• General support: support@gamesave.app
• Contact form: gamesave.app/contact

GameSave is the data controller responsible for your personal information. This Privacy Policy is governed by the laws of the State of California, United States, without regard to its conflict-of-laws principles, except where mandatory data-protection laws of your country of residence apply.