How we handle your data

In Your Bag

What we collect

• Your email and a username, so you can sign in.
• Whatever you put on your profile (display name, bio, avatar, any links you add).
• Anything you create on VGDB: reviews, lists, articles, screenshots, collection entries, votes, reports, follows, and blocks.
• If you connect Steam, your Steam ID and public playtime. Only if you opt in, and you can disconnect any time in account settings.
• Page-view analytics via Google Analytics, including any search terms you type into search. A cookie-less ping reaches Google as soon as a page loads, before you've made a cookie choice; opting in via the banner is what lets Google set tracking cookies instead of just receiving that ping.
• Product analytics via PostHog: which features get used, error reports, and (for signed-in users) which actions you took. If you opt in via the cookie banner, that also includes masked session replay, a recording of what happened on screen with everything you type hidden. Routed through our own server at /ingest so ad-blockers don't break the site, and hosted in the EU. Browser tracking only fires if you opt in via the cookie banner; server-side capture of authenticated actions (like submitting a review) runs on legitimate interest, opt-out by emailing privacy@vgdb.co.
• Error reports and performance timing sent to Sentry, so we can keep the site running and fix things that break. This is website only, the mobile app doesn't send anything to Sentry. Default PII capture is off and your session cookie and sign-in token never leave our servers. Sentry receives error and performance data, not your Steam library or billing details. If you opt in via the cookie banner, you also get session replay, a masked recording of what happened on screen (all text and input values hidden), which helps us reproduce bugs.
• If you subscribe to a paid plan, your email and billing details, handled by Stripe. We never see your full card number. This is website only too.
• Session cookies to keep you signed in.
• Your IP address and browser info when you take a security-relevant action (signing in, moderation), kept in a security log for security and abuse prevention. We aim to delete these after 30 days, and the automatic clean-up for that now exists in our code, but it is not switched on yet, so some entries are currently older than that.

This covers the VGDB website and the VGDB mobile app (iOS and Android) alike. Anything marked website only above doesn't apply to the mobile app.

The List

Who else sees it

Supabase runs the database and authentication for us. Our hosting provider serves the site. PostHog (EU instance) processes the product-analytics events described above, including the masked session replay if you opt in. Google Analytics gets page-view counts and search terms as soon as a page loads, before you make a cookie choice; opting in via the banner is what lets it set tracking cookies instead of just a cookie-less ping. Sentry handles error monitoring and, if you opt in, its own masked session replay. Resend delivers our email, so it receives your address and whatever we send you: confirmation and sign-in links, password resets, the welcome note, any invite you send a friend, the occasional setup nudge, and the code that confirms an account deletion. If you subscribe, Stripe handles the payment. If you connect Steam, we talk to the Steam Web API on your behalf to fetch your public playtime. We use the YouTube Data API to display public channel info and recent videos on our Resources pages, but that is a server-side call with our key, not yours.

Those are the services that receive your personal data from us. What that is not is an inventory of every server your browser talks to while a page loads. Our headings come from Adobe Fonts on every page, cover art and screenshots come from the image CDNs behind the catalogue and store sources we credit, and a page carrying a YouTube or Spotify embed contacts that player when it loads. Your browser fetches those files directly, so each of those operators sees your IP address and browser, the way any site that loads a font or an image from elsewhere does, and that happens before you touch the cookie banner.

We don't run ads on VGDB and we don't sell your data, because there is no one to sell it to. Being precise about the one wrinkle: Google Analytics is permitted to reach a Google advertising domain as part of how it works, so we won't claim a blanket "nothing ever touches an ad network". What we can tell you is that ad storage, ad user data and ad personalisation are all set to denied before Analytics loads, there is no advertising option in our cookie banner to turn them on, and nothing here is used to target ads at you. No data brokers, no "trusted partners".

Your Rights

What you can ask us to do

UK GDPR gives you real rights over your data. You can see what we hold about you, correct it, delete it, take it with you to another service, or tell us to stop using it. Email privacy@vgdb.co and we'll sort it. If we don't, you can complain to the Information Commissioner's Office.

Crumbs

Cookies

Supabase session cookies keep you signed in (strictly necessary). Your cookie-banner decision lives in your browser's local storage (not a cookie, but the same idea), so we don't pester you on every visit. Google Analytics cookies and PostHog browser storage (a pseudonymous device id under ph_* keys) only land if you opt in via the banner. Manage the lot from the Cookie Preferences link in the footer.

YouTube

YouTube API Services

Our Resources section uses YouTube API Services to show gaming-channel info and recent uploads. None of your personal data is sent to YouTube through our use of it. By using this site you agree to the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can manage or revoke permissions on the Google security settings page.

If you are a channel owner and want your channel removed from VGDB, email paul@vgdb.co. We will take it down within 7 days.

Get In Touch

Contact

Any question about your data, email privacy@vgdb.co. I read every one of those.

Updates

When this changes

When we update this, we'll bump the "last updated" date at the bottom, and for anything material we'll post about it in the changelog.