Privacy policy
Draft version. This text will be completed before the public launch.
Who is responsible
The data controller is Lucas, publisher of VERDICTED. For any question or request about your data: contact@verdicted.app.
User data
When you sign in with Steam: your Steam ID (SteamID64), your public name, avatar and profile URL, your game library and playtime, your settings, your feedback on recommendations, your calibration answers and, if you fill it in, the satisfaction survey (4 ratings and an optional comment). We never receive your Steam password.
Why, and on what basis
Computing, explaining and improving your recommendations, and running your account: performance of the service you ask for (GDPR art. 6.1.b). Securing the service (abuse limits, technical logs): legitimate interest (art. 6.1.f). Your data is never sold, rented or used for advertising.
Training data (non-registered players)
To learn which games go well together, we analyse public Steam libraries, including those of players who don't use VERDICTED, found through public friend lists. We only keep an encrypted fingerprint (HMAC) of the Steam ID, the games played and the playtime: no name, avatar or link. Basis: legitimate interest (art. 6.1.f), namely improving recommendation quality, with limited impact as this data is already public and pseudonymized. You can object at any time on the "Opt out" page; making your library private on Steam also stops the collection.
Recipients and processors
Our hosting provider, in the European Union. Valve (Steam): we query the Steam API with your ID to read your public profile and library. IGDB (Twitch): we only send game identifiers, never data about you. No other sharing.
Retention
Account: as long as it exists, then deleted immediately and permanently when you delete it. Sign-in sessions: 30 days. Training data: as long as it is used for training, and at most 3 years after collection. After an objection, only the fingerprint is kept, so the account is never collected again.
Your rights
Access, rectification, erasure, portability, restriction and objection. From the "My account" page: export all your data (JSON) and delete your account in one click. For anything else, write to contact@verdicted.app. You can also lodge a complaint with your data protection authority (in France, the CNIL: cnil.fr).
Security
Encrypted connection (HTTPS), session tokens stored hashed, data access restricted to the server, training-data identifiers pseudonymized with a secret key.
Cookies
Only essential cookies (session, Steam sign-in security). Audience is measured without cookies and without storing IP addresses. See the Cookies page.