1. Controller
The controller of your personal data is Paul Buttle (an individual, United Kingdom), trading as VGDB. Contact: privacy@vgdb.co.
2. Personal data we process
We process the following categories of personal data:
- Account identifiers (email, user id). Purpose: operate the service and authenticate you. Lawful basis: performance of a contract. Retention: until account deletion.
- Profile data (username, display name, avatar, bio, optional social links). Purpose: render your public profile. Lawful basis: contract (username) and consent (optional fields). Retention: until account deletion or field clearing.
- User-generated content (reviews, lists, articles, screenshots, collection entries, votes, reports, follows, blocks). Purpose: operate the service and display community content. Lawful basis: contract. Retention: until you delete the content or your account.
- Steam integration data (Steam ID, public playtime). Processed only if you connect Steam. Lawful basis: consent. Retention: until you disconnect Steam or delete your account.
- Technical data (IP address during a session, user agent). Purpose: security, rate limiting, CSP reports. Lawful basis: legitimate interest. Retention: records in our security audit log (separate from the page-view records described below) are meant to be kept no longer than 30 days. An automatic purge for this now exists in our code, but it is not yet scheduled to run, so some records currently persist longer than that window until it is. This does not cover CSP violation reports, which are written to server-level logs outside this database and are not governed by this window. Rate-limiting data is handled separately again: our general request rate limiter is held only in server memory and is never written to a database, and the mobile app's failed-sign-in limiter stores a hashed address (not the address itself) that an existing automated job clears within 24 hours.
- Product analytics data (page views, feature interactions, captured exceptions, session replay recordings with all inputs masked, a pseudonymous device identifier, and - for signed-in users - the user id linked to those events). Processed by PostHog Inc. via its EU instance (
eu.i.posthog.com), routed through our same-origin /ingestreverse proxy. Purpose: understand which features are used, diagnose errors, and improve the Service. Lawful basis: (a) consent under UK GDPR Article 6(1)(a) and PECR Regulation 6 for browser-side capture, gated by the cookie banner's Analytics toggle; (b) legitimate interest under UK GDPR Article 6(1)(f) for server-side capture of authenticated actions (signup, login, content creation), with opt-out available via privacy@vgdb.co. Retention: events for up to 7 years and session replay recordings for 30 days, as configured on our PostHog project. - First-party page-view data (a random per-tab session identifier, the page you viewed, and user agent, stored in our own database rather than a third-party tool). Purpose: page-view counts shown on games, profiles, reviews and lists. Lawful basis: consent under UK GDPR Article 6(1)(a) and PECR Regulation 6, gated by the cookie banner's Analytics toggle. Retention: for as long as the page you viewed still exists.
- Page-view analytics data (page URLs, referrer, anonymised IP, user-agent-derived device class). Processed by Google LLC via Google Analytics 4. Lawful basis: consent. Retention: as configured in the Google Analytics property settings.
- Error and performance data (website only: stack traces, request URLs and timings, and session replay recordings with all text and input values masked). Processed by Sentry (Functional Software, Inc.). Default PII capture is off and Authorization headers and session cookies are stripped before an event leaves our servers. Session replay recording only runs if you opt in via the cookie banner's Analytics toggle. Lawful basis: legitimate interest (error and performance monitoring keeps the Service running) for the error and performance data; consent for session replay. Retention: as configured on our Sentry project.
- Payment data (website only: email, and billing and subscription details Stripe collects directly from you at checkout; we never see full card numbers). Processed only if you subscribe to a paid plan, by Stripe, Inc. Lawful basis: performance of a contract. Retention: for as long as Stripe's own financial record-keeping obligations require, even after you delete your VGDB account.
- Cookies: see §6.
This policy covers the VGDB website and the VGDB mobile app (iOS and Android) alike. Categories marked "website only" above are not collected through the mobile app.
3. Sources
Directly from you. For Steam integration data, from the Steam Web API as an authenticated third-party call made on your behalf.
4. Recipients and processors
We share personal data only with processors that run infrastructure on our behalf:
- Supabase — database, authentication, and storage.
- Our hosting provider — serves this website.
- PostHog Inc. — product analytics, EU instance (
eu.i.posthog.com). Receives the events described in §2 via our same-origin /ingest reverse proxy. Acts as our processor under a Data Processing Addendum. - Google LLC (Google Analytics 4), aggregate page-view counts and product-usage events, including search terms you type into search. Cookieless technical pings reach Google as soon as a page loads, before you make a cookie banner choice, as part of Google's Consent Mode. Google Analytics cookies (see §6) are set only once you opt in via the cookie banner.
- YouTube Data API (Google LLC)— server-side queries for public channel metadata and recent uploads. No user credentials are sent. See §10.
- Steam Web API (Valve Corporation)— queried on your behalf only if you connect Steam.
- Sentry (Functional Software, Inc.), error monitoring and performance tracing across our web servers and browser, plus consent-gated, masked session replay. See §2 for exactly what it receives.
- Resend, transactional email delivery. Receives your email address and the contents of the messages we send you: email confirmation and sign-in links, password resets, email-change confirmations, the welcome email, onboarding reminders, and the one-time code that confirms an account deletion. Also receives an address you enter yourself when you invite someone to VGDB. Acts as our processor. No marketing email is sent through it.
- Stripe, Inc., payment processing for paid subscriptions. Acts as our processor for the payment data described in §2, and independently as a controller for its own regulatory obligations (fraud prevention, financial record-keeping).
The list above covers the processors that handle personal data on our behalf. It is not an inventory of every third-party server your browser contacts while a page renders. Those contacts also include Adobe Fonts (Typekit), which serves our heading typeface from use.typekit.net on every page of this site; the image CDNs of the catalogue and store sources we credit, which serve cover art and screenshots; and embedded YouTube and Spotify players on the pages that carry them. In each case your browser requests the file directly from that operator, so that operator receives your IP address and user agent. The font request is made on every page load, including this one, and it is not gated on your cookie choice.
We do not sell personal data and we do not operate advertising on VGDB. We are not claiming that no request ever reaches an advertising domain: our Content Security Policy permits Google Analytics to contact *.g.doubleclick.net, which is part of how Analytics operates. What is true is that Google Consent Mode v2 defaults for ad_storage, ad_user_data and ad_personalization are set to denied before Google Analytics loads, and the cookie banner offers no advertising category that could grant them, so no advertising or remarketing signal is authorised. No data brokers.
5. International transfers
Our hosting provider operates in the United Kingdom. Supabase, our database and storage provider, processes data in its EU region (Frankfurt, Germany). Transfers of personal data from the UK to the EEA do not require additional safeguards, because the UK government's adequacy regulations recognise EEA member states, including Germany, as providing an adequate level of data protection.
6. Cookies
We use the following browser storage:
- Session / auth cookies (Supabase). Strictly necessary. Keep you signed in.
- Cookie-banner decision record. Strictly necessary. Stored in your browser's local storage (not an HTTP cookie) so we don't prompt you on every visit.
- Google Analytics cookies (
_ga, _ga_*). Set only with your explicit consent via the cookie banner. Used for aggregate page-view counts. - PostHog browser storage (a pseudonymous device id and session metadata under the
ph_* keys, stored in local storage and a first-party cookie; opt-in/out flag stored under __ph_opt_in_out_<token>). Set only with your explicit consent via the cookie banner. Used for product analytics as described in §2. - Page-view tracking (
vgdb:session-hash, a random per-tab id, and vgdb:viewed:*, a per-page dwell timestamp; both in session storage). Set only with your explicit consent via the cookie banner. Used to record page-view counts as described in §2.
Manage your consent at any time via the Cookie Preferences link in the footer.
7. Data subject rights (UK GDPR articles 15–22)
You have the right to: access your personal data; have inaccurate data rectified; have data erased; restrict processing; port your data to another service; object to processing; and withdraw any consent at any time without affecting the lawfulness of prior processing. To exercise any of these rights, email privacy@vgdb.co.
8. Automated decision-making
We do not use solely automated decision-making or profiling that produces legal effects or similarly significantly affects you.
9. Right to complain
If we fail to handle your personal data properly, you can complain to the Information Commissioner's Office (ico.org.uk). We would rather you write to us first so we can fix it.
10. YouTube API Services
This site uses YouTube API Services to display gaming-channel metadata (channel name, description, avatar, banner, subscriber count, video count, view count) and a channel's recent public uploads (title, thumbnail, duration, view count, publish date) on the Resources section. These requests are made server-side using our API key. No personal data about you is sent to YouTube through our use of the API.
By using this site you also agree to be bound by the YouTube Terms of Service and acknowledge the Google Privacy Policy. You can revoke YouTube API Services' access to your data via the Google security permissions page, though note that VGDB does not request access to your YouTube account, so there is typically nothing for you to revoke.
If you are a channel owner and would like your channel removed from the VGDB catalogue, email paul@vgdb.co. We will remove the listing within 7 days.
11. Changes to this policy
Material changes are announced in the changelog and reflected in the "Last updated" date at the foot of this page.
12. Contact
privacy@vgdb.co