The short version. Your PlayStation, Xbox and Steam passwords never reach us. PlayStation and Xbox sign in on the platform’s own page; Steam signs in inside the app, with your password encrypted on the device before it goes to Steam. The resulting tokens stay in your iPhone’s Keychain. Your library is stored on your iPhone and we keep no copy of it, though your wishlist is mirrored on our servers so we can alert you, and Discover sends us a short list of game identifiers to base its suggestions on. This website sets no cookies and uses only anonymous, cookieless page-view analytics. If you join the wishlist we store your email address, plus the time and IP address you signed up from as our record that you agreed. GamePanda never sells your data or uses it for advertising; the embedded YouTube player follows Google’s privacy terms described below.
1. Who is responsible for your data
The data controller for the personal data described here is:
GamePanda is operated by Aleksey Zelenskiy in Belgium. Contact: [email protected].
GamePanda is pre-launch and not yet trading. The details Belgian and EU law require of a trader (a registered address, an enterprise number, a VAT number) will be published here before GamePanda+ goes on sale.
We have not appointed a Data Protection Officer: our processing is not large-scale monitoring or special-category data, so Article 37 GDPR does not require one. Privacy requests go to the address above and are handled by us directly.
This policy covers gamepanda.app (this website) and the GamePanda app for iPhone.
2. What we collect, and why
On this website
| Data | Why | Legal basis |
|---|---|---|
| Email address (wishlist) | To tell you when GamePanda launches | Consent (Art. 6(1)(a)), given by ticking the box on the signup form |
| IP address, with the time you signed up | Kept with your wishlist entry as our record that the consent was really given | Legal obligation to evidence consent (Art. 7(1)) |
| IP address (transient) | Rate-limiting the signup form against abuse, and the bot check described below | Legitimate interest (Art. 6(1)(f)) |
| Aggregate page views | Knowing which pages are read, in aggregate only | Legitimate interest (Art. 6(1)(f)) |
The signup form is protected by Cloudflare Turnstile, which checks that a real person is submitting it rather than a script. It receives your IP address and some technical signals from your browser to make that judgement. It sets no tracking cookie and is not used to profile or identify you; it exists so that automated signups cannot flood the list or exhaust our email allowance. Most visitors see nothing more than a small badge, though it may occasionally ask you to confirm with a click.
Analytics run on our own self-hosted Umami instance. It sets no cookies, stores nothing on your device, does not fingerprint you and cannot identify you. That is also why this site has no cookie banner: there is nothing to consent to.
In the app
| Data | Why | Legal basis |
|---|---|---|
| Your library (games, editions, ownership, status, playtime, notes, collections) | The core function of the app | Contract (Art. 6(1)(b)) |
| The games on your in-app wishlist, if you are signed in | Telling you when one of them is released, or drops in price | Contract (Art. 6(1)(b)) |
| Trophies and achievements you authorise us to read | Showing unified progress across platforms | Contract (Art. 6(1)(b)) |
| Account identifier (Sign in with Apple, Google, or email) | Operating your account | Contract (Art. 6(1)(b)) |
| GamePanda account ID, purchase history and subscription status | Validating purchases and managing GamePanda+ access through RevenueCat | Contract (Art. 6(1)(b)) |
| Account-linked purchase history and subscription status | Subscription analytics in RevenueCat’s dashboard, to understand purchases and subscription performance | Legitimate interest (Art. 6(1)(f)) |
| Device push token, if you enable notifications | Sending price alerts you asked for | Consent (Art. 6(1)(a)) |
| Crash diagnostics, if you opt in via iOS | Fixing what breaks | Consent (Art. 6(1)(a)) |
Your library stays on your device. The library itself, with your ownership, status, playtime, notes and collections, is stored on your iPhone. We keep no copy of it, and it is not synced through iCloud, so it does not travel between your devices on its own. It is included in your iPhone’s own backups, which are covered by Apple’s terms rather than ours.
Two parts of it do leave your device, and both are worth reading. The rest of this section is about your library; the account identifier, push token and crash diagnostics in the table above are separate, and so are the award details your device contributes when you sync trophies.
Your wishlist is mirrored on our servers. If you are signed in, the games on your in-app wishlist are sent to us and stored against your account, and kept up to date as you add and remove them. That is what lets us tell you when one of them is released or drops in price, which cannot be done from your device alone. It is a list of game identifiers, not your library, and it is deleted with your account.
Discover asks for suggestions. When you open Discover, the app sends us up to 100 game identifiers from your library and up to 20 from your wishlist, along with a device identifier. We look those identifiers up in our own game database and send the resulting list of titles, genres and themes to Google (Gemini), which returns the themes we then search on. Your name, email address and platform accounts are not part of it, the result is cached so it is not repeated on every visit, and nothing about you is used to train anyone’s model. If you never open Discover, this one does not happen.
YouTube trailers use YouTube’s unmodified embedded player. When you choose a YouTube trailer, your device connects directly to Google and YouTube to load and play it. Google says its services may receive your IP address, device and browser information, and player activity such as the video watched and interactions with content or ads. Depending on your Google settings, Google may use that information for service delivery, analytics, personalisation and advertising. GamePanda does not receive the embedded player’s data or use it to select advertising. Google’s processing is described in the Google Privacy Policy and the YouTube Terms of Service.
Platform tokens never reach our servers. PlayStation and Xbox sign in on the platform’s own web page. Steam signs in inside the app: your password is encrypted on the device using Steam’s public key and sent to Steam, never to us. In each case GamePanda receives an access token, which is stored only in the iOS Keychain on your device. Disconnecting a platform erases it immediately.
GamePanda does not sell your data, build advertising profiles, use your GamePanda account or library data for advertising, or use your library to train models. The embedded YouTube player is a Google service governed by the policies linked above. We carry out no automated decision-making or profiling producing legal or similarly significant effects (Art. 22).
3. Payments
GamePanda+ is sold through the App Store. Apple is the merchant of record. Your payment is made to Apple, and Apple does not give us your card details, billing address or full name. We receive purchase records and subscription status needed to validate purchases and unlock features on your account.
RevenueCat manages subscription access. When you sign in to GamePanda, we identify your subscription profile to RevenueCat using your GamePanda account ID. RevenueCat processes App Store purchase records and subscription status to validate purchases, restore access and determine which paid features your account can use. These records also support subscription analytics in RevenueCat’s dashboard, including purchase history and subscription-performance charts. Its SDK also sends technical information such as device type and operating system. This purchase history is linked to your GamePanda account; it is not anonymous. RevenueCat does not receive your card details. See RevenueCat’s privacy policy for its processing information.
4. Who else processes your data
| Provider / processor | Purpose | Location |
|---|---|---|
| Apple | App Store distribution, Sign in with Apple, push delivery, payments | EU / US |
| RevenueCat | Subscription validation, purchase history, subscription analytics and GamePanda+ entitlement management linked to your GamePanda account ID | US |
| Resend | Wishlist and account email delivery | US |
| Cloudflare | Website hosting and DNS, and the Turnstile bot check on the signup form | EU edge / US |
| IGDB (Twitch/Amazon) | Game metadata lookups | US |
| Generating Discover recommendations from a list of game titles and genres | US | |
| Google / YouTube (independent service) | Embedded trailer playback; Google may process device, browser and player activity under its own privacy terms | US |
Our own backend and database run on self-hosted infrastructure in the EU, not on a third-party cloud, so there is no hosting provider in the list above to disclose for them.
Where a provider acts as our processor, it acts under a data-processing agreement and only on our instructions. The embedded YouTube player is an independent Google service governed by Google’s own terms. Where a transfer outside the EEA takes place, it relies on the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards at [email protected].
Metadata lookups (covers, release dates, prices) carry the game identifiers being looked up, not your identity.
5. How long we keep it
| Data | Retention |
|---|---|
| Wishlist email | Until you unsubscribe, or 12 months after launch |
| Wishlist consent record: your address, the time you signed up and the IP you signed up from | Kept while we hold the address, as the evidence that we were entitled to mail you. We keep it if you unsubscribe too — both to show the original consent was real, and so that a later signup cannot quietly put you back on a list you left. Ask us at [email protected] and we will erase it |
| The games on your in-app wishlist | Until you remove the game, or until you delete your account |
| Discover recommendation profile, kept against a device identifier | 7 days, then it is discarded and rebuilt the next time you open Discover |
| Rate-limiting IP record | 15 minutes |
| Aggregate analytics | 24 months, in aggregate form |
| Account data: your profile, sign-in identities, sessions, price watches and wishlist | Deleted when you delete your account |
| Operational records still tied to your account id, such as push registrations, notification settings and subscription entitlements | Kept until you ask us to erase them at [email protected], which we complete within one month |
| Server logs | 30 days |
| Records needed for accounting or legal claims | As long as Belgian law requires |
6. Your rights
Under the GDPR you may access your data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time. Withdrawal does not affect processing already carried out.
Email [email protected] and we will respond within one month, as Article 12(3) requires. We do not charge for this.
You can delete your account directly in the app, under Settings → Account → Delete Account. That removes your sign-in identities, your active sessions, your price watches and your wishlist, and erases your name, email address and profile image from our records. To have anything that remains erased as well, email [email protected] and we will complete it within the same one month.
If you believe we have handled your data unlawfully you may lodge a complaint with the Belgian supervisory authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35, 1000 Brussels, Belgium. gegevensbeschermingsautoriteit.be
You may also complain to the supervisory authority where you live or work.
7. Security
Traffic is encrypted in transit (TLS). Platform tokens are held in the iOS Keychain and never transmitted to us. Access to production systems is restricted and authenticated. Backend requests carry a device attestation from Apple’s App Attest, which we monitor to identify traffic that does not come from a genuine installation of the app.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Belgian supervisory authority within 72 hours and inform you directly where the risk is high, as Articles 33 and 34 require.
8. Children
GamePanda is not directed at children. You must be at least 16, or 13 where your country has set a lower age of digital consent under Article 8(1) GDPR and your guardian permits it. We do not knowingly collect data from children below that age; if you believe we have, write to [email protected] and we will erase it.
9. Changes
We will post any revised policy here with a new date and version. If a change materially affects your rights we will tell wishlist subscribers and account holders before it takes effect.
10. Contact
- Privacy and data-protection requests: [email protected]
- Help with the app: [email protected]
- Legal notices: [email protected]
- Anything else: [email protected]