Privacy

This page says three things: what we hold about you, what we do with it, and how you get it back or delete it. It describes this site specifically — every claim below matches something in the code.

Last updated 2026-08-24

The short version

Browsing without signing in: we keep no record tied to you. One cookie remembers your language, and anonymous analytics count the visit.
Signed in: we keep your library, your ratings and the taste profile computed from them, because that is what a match score is made of.
You can export everything and delete your account from inside the app. Deletion removes the rows; it is not a flag.
We do not sell your data and we do not hand it to advertisers.

If you never sign in

A gvg_locale cookie remembering whether you chose English or Chinese.
Ordinary server logs — IP address, browser, the address requested — produced by our host to debug faults and stop abuse.
If analytics are enabled on this deployment, Google Analytics counts the visit with its own cookies. We see totals, not people, and an ad blocker or a browser privacy setting stops it.

What signing in adds

Signing in with Steam or Google gives us what that provider chooses to tell us:

Steam — your Steam ID, public persona name and avatar. If you run the import, also the games you own and the hours on each.
Google — your Google account ID, email address (and whether it is verified), name and avatar. We request openid email profile and nothing else: we cannot read your mail, your contacts or anything beyond those three.
Neither password ever reaches us. Both sign-ins happen on the provider’s own page.

What you then make on the site:

Library status for a game — played, want to play, not interested — with the rating and hours you set.
Your onboarding answers, your settings, and your recent searches.
The taste profile computed from all of it: a weight on each of the six axes. This is the whole basis of a match score; without it the site has nothing personal to say.

If you attach an email address for account recovery, we store the address. The one-time code is stored only as a salted hash, never in plain text, and expires within minutes.

Cookies

Cookie	What it does	How long
`gvg_session`	Keeps you signed in	30 days, HttpOnly — page scripts cannot read it
`gvg_locale`	Remembers your language	Until you change it
`gvg_txn`	Proves the browser that started a sign-in is the one that finished it	Minutes
`gvg_consent`	Remembers whether you said yes or no to the line below	180 days
`_ga`, `_ga_*`	Google Analytics — only after you accept	Set by Google

Cookies beginning gdp_ are the same things under their former names, kept so older sessions do not break.

Analytics is the only one of these you are asked about, because it is the only one that is not needed to serve you the page. In the EEA, the UK and Switzerland the tag does not load at all until you accept; everywhere else it loads unless you decline, and you can decline at any time from Cookie settings at the foot of any page. Refusing costs one click, exactly like accepting, and nothing else on the site changes either way.

There are no ads on this site and no advertising cookies. If that ever changes, this page changes first.

Where it lives and who touches it

The database is Neon (managed PostgreSQL); the site and its APIs run on Vercel.
Recovery codes go out through the mail provider configured for this deployment.
Sign-in and catalogue data come from Valve (Steam) and Google.
Visit counts, if enabled, go to Google Analytics.

Those servers may sit outside the country you are reading from. Beyond the providers that make the site work, we pass your data to no one, and we sell it to no one. The only exception is a valid legal demand.

How long we keep it

Sessions expire 30 days after they were issued; you can also sign out of every device at once.
Account data stays until you delete the account, at which point the account, library, taste profile and sessions are removed from the database.
Email codes last minutes.
Server logs follow our host’s own retention, which is short.

Your rights, and how to use them

You do not have to write to us for the two that matter most — they are buttons:

Export everything — Settings hands you a JSON file with your account, library, taste profile and imported Steam data.
Delete your account — also Settings, and it deletes rather than deactivates.
Unlink a provider or sign out everywhere — your account page.

If the law where you live gives you further rights — GDPR, CCPA or another — write to support@gamevgame.com and we will do it.

Children

This site is not aimed at children under 13, and we do not knowingly collect anything from them. If you believe a child has an account here, write to us and we will remove it.

Changes, and how to reach us

The date at the top moves when the words change. A change to what we do with your data — analytics beyond counting, or advertising — will be announced on the site rather than buried here.

Questions: support@gamevgame.com. See also the terms.