Privacy Policy

1. Controller

2. Data we process

• Account: name, email, profile picture, username.
• Storefront identifiers and tokens: Steam ID, PSN Account ID / Online ID, Xbox XUID, PSN NPSSO, Microsoft OAuth tokens.
• Riot account data: Riot ID (gameName#tagLine), PUUID, region, summoner level, League of Legends / TFT rank, win and loss counts, champion mastery.
• Game data: library, hours, achievements, statuses, scores, reviews, wishlist.
• Social content: direct messages, group chats, follow relationships, banners.
• Technical access data: IP, user-agent, session cookie, request timestamp.

3. Sign-up and sign-in

Registration via email magic-link or OAuth (Google, Discord, Steam). We store the identity attributes provided (name, email, provider-side ID, profile picture).

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4. Connected storefronts and Riot Games

When you connect a storefront we fetch data on your behalf and cache it in our database to avoid re-syncing every session.

• Steam: SteamID64, profile data, library, playtimes, achievements.
• PSN: NPSSO token (encrypted), Account ID, Online ID, trophies, playtimes, library.
• Xbox: Microsoft OAuth tokens, XUID, gamertag, library, achievements.
• Riot Games (League of Legends / TFT): Riot ID (gameName#tagLine), the resulting PUUID, region, summoner level and profile icon, ranked tier / division / LP, win and loss counts, and top champion mastery.

Riot data is read from the official Riot Games API and is limited to public information Riot already shows for your account. We use it only to display your competitive profile (your rank and related stats); we never derive an alternative skill rating, and we only show the account you link yourself. MyGamingLog is not endorsed by, sponsored by, or affiliated with Riot Games. Riot Games, League of Legends, and Teamfight Tactics are trademarks or registered trademarks of Riot Games, Inc.

You can disconnect at any time under Settings → Connected Accounts. Access tokens (and the Riot link) are deleted on disconnect; cached library data persists until you remove it.

Please note: disconnecting deletes the copy of the sign-in token that we store. It does not invalidate the token on the platform’s side (Sony, Microsoft, and so on). If you believe your platform account is compromised, change your password there or use the platform’s “sign out everywhere” option.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4a. Steam Library Roast

The Steam Library Roast lets you see a summary of your Steam library without filling in a sign-up form. When you start it, we create an account for you automatically, identified by your Steam ID and a placeholder e-mail address. You do not have to enter anything.

What we read from Steam for this: your public profile name and avatar, the list of games on your account, how long you have played each of them, and when you last played them. This is the information your public Steam profile already shows. We do not read your friends, your messages, your purchases, or your payment details.

Automatic deletion. If you do not choose to keep the account, we delete it, and everything stored with it, automatically 30 days after your last visit. Coming back resets that window. If you do keep it, by choosing a username, it becomes a normal MyGamingLog account and this automatic deletion no longer applies.

You can delete the account yourself at any time in settings, without waiting for the 30 days.

The result page has a link that can be shared. It is only reachable by that link, it is not listed anywhere, and if your profile is not public we also ask search engines not to index it.

Legal basis: Art. 6(1)(b) GDPR (performance of a contract you requested by starting the Roast).

5. Profile and library

Library, scores, statuses, and achievements are stored in our database. Profile visibility defaults to public; you can set it to friends only or private in settings.

Our administrators may access profile content, including content on private and friends-only profiles, where necessary to operate and moderate the service, investigate abuse or security incidents, or comply with legal obligations. This access is limited to those purposes.

Legal basis: Art. 6(1)(b) GDPR (contract performance), and for administrator access Art. 6(1)(f) GDPR (legitimate interest in a safe service) and Art. 6(1)(c) GDPR (legal obligations).

6. Messages and reviews

Direct messages are visible only to sender and recipient. Group chats are visible to group members. Reviews are public on the relevant game's detail page.

Legal basis: Art. 6(1)(b) GDPR.

Report illegal content (DSA Art. 16): send the link plus a brief reason to [CONTACT EMAIL (TODO)].

7. Technical data and cookies

Each request transmits IP, user-agent, timestamp and URL. These appear in Vercel's standard hosting logs and are deleted within 30 days.

We set one strictly necessary session cookie (NextAuth) to keep you signed in. No tracking, advertising, or analytics cookies are set.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the service) and §25(2) TTDSG (strictly necessary cookie).

8. Recipients and third countries

Transfers to third countries (in particular the USA) are based on EU Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework.

9. Retention

• Account and library: until you delete your account.
• Direct messages: until deleted by you or the recipient; anonymised on account deletion.
• Server logs: 30 days.
• Storefront tokens: until disconnect or provider invalidation.
• Riot link: Riot ID, PUUID, and region are kept until you disconnect Riot or delete your account.

10. Your rights

You have the following rights under the GDPR:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Withdrawal of consent (Art. 7(3))

An informal message to [CONTACT EMAIL (TODO)] is enough; we respond within one month.

11. Right to lodge a complaint

You may complain to a data protection supervisory authority, in particular in the EU Member State of your residence, workplace, or the place of the alleged infringement (Art. 77 GDPR).

12. Changes

We adjust this policy when the underlying processing changes. Material changes are announced in-product or by email.