The short version. We never see your PlayStation, Xbox or Steam password — you sign in with the platform itself, and the resulting tokens stay in your iPhone’s Keychain. Your library syncs through your own iCloud, not our servers. This website sets no cookies and does not track you. If you join the wishlist we store your email address, and nothing else. We never sell your data or use it for advertising.
1. Who is responsible for your data
The data controller for the personal data described here is:
GamePanda is operated by Aleksey Zelenskiy in Belgium. Contact: [email protected].
GamePanda is pre-launch and not yet trading. The details Belgian and EU law require of a trader — a registered address, an enterprise number, a VAT number — will be published here before GamePanda+ goes on sale.
We have not appointed a Data Protection Officer: our processing is not large-scale monitoring or special-category data, so Article 37 GDPR does not require one. Privacy requests go to the address above and are handled by us directly.
This policy covers gamepanda.app (this website) and the GamePanda app for iPhone.
2. What we collect, and why
On this website
| Data | Why | Legal basis |
|---|---|---|
| Email address (wishlist) | To tell you when GamePanda launches | Consent — Art. 6(1)(a), confirmed by clicking the link we email you |
| IP address (transient) | Rate-limiting the signup form against abuse | Legitimate interest — Art. 6(1)(f) |
| Aggregate page views | Knowing which pages are read, in aggregate only | Legitimate interest — Art. 6(1)(f) |
Analytics run on our own self-hosted Umami instance. It sets no cookies, stores nothing on your device, does not fingerprint you and cannot identify you. That is also why this site has no cookie banner — there is nothing to consent to.
In the app
| Data | Why | Legal basis |
|---|---|---|
| Your library — games, editions, ownership, status, playtime, notes, collections | The core function of the app | Contract — Art. 6(1)(b) |
| Trophies and achievements you authorise us to read | Showing unified progress across platforms | Contract — Art. 6(1)(b) |
| Account identifier (Sign in with Apple, Google, or email) | Operating your account | Contract — Art. 6(1)(b) |
| Device push token, if you enable notifications | Sending price alerts you asked for | Consent — Art. 6(1)(a) |
| Crash diagnostics, if you opt in via iOS | Fixing what breaks | Consent — Art. 6(1)(a) |
Your library lives in your private iCloud, in Apple’s CloudKit private database. It is tied to your Apple Account and we cannot read it.
Platform tokens never reach our servers. When you connect PlayStation, Xbox or Steam you authenticate with that platform directly. GamePanda receives an access token, which is stored only in the iOS Keychain on your device. Disconnecting a platform erases it immediately.
We do not sell your data, share it with advertisers, build advertising profiles, or use your library to train models. We carry out no automated decision-making or profiling producing legal or similarly significant effects (Art. 22).
3. Payments
GamePanda+ is sold through the App Store. Apple is the merchant of record — your payment is made to Apple, and Apple does not give us your card details, billing address or full name. We receive only the subscription status needed to unlock features on your account.
4. Who else processes your data
| Processor | Purpose | Location |
|---|---|---|
| Apple | App Store distribution, iCloud/CloudKit sync, Sign in with Apple, push delivery, payments | EU / US |
| Resend | Wishlist and account email delivery | US |
| Cloudflare | Website hosting and DNS | EU edge / US |
| IGDB (Twitch/Amazon) | Game metadata lookups | US |
Our own backend and database run on self-hosted infrastructure in the EU — not on a third-party cloud — so there is no hosting provider in the list above to disclose for them.
Each processor listed acts under a data-processing agreement and only on our instructions. Where a transfer outside the EEA takes place, it relies on the European Commission’s Standard Contractual Clauses and, where the recipient is certified, the EU–US Data Privacy Framework. You may request a copy of the relevant safeguards at [email protected].
Metadata lookups (covers, release dates, prices) carry the game identifiers being looked up — not your identity.
5. How long we keep it
| Data | Retention |
|---|---|
| Wishlist email, unconfirmed | Not stored at all — an unconfirmed signup exists only inside the link we email you, and expires after 7 days |
| Wishlist email, confirmed | Until you unsubscribe, or 12 months after launch |
| Rate-limiting IP record | 15 minutes |
| Aggregate analytics | 24 months, in aggregate form |
| Account data | Until you delete your account, plus up to 30 days to complete erasure |
| Server logs | 30 days |
| Records needed for accounting or legal claims | As long as Belgian law requires |
6. Your rights
Under the GDPR you may access your data, have it corrected or erased, restrict or object to processing, receive it in a portable format, and withdraw consent at any time — withdrawal does not affect processing already carried out.
Email [email protected] and we will respond within one month, as Article 12(3) requires. We do not charge for this.
You can delete your account and all associated personal data directly in the app, under Settings → Account → Delete Account.
If you believe we have handled your data unlawfully you may lodge a complaint with the Belgian supervisory authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35, 1000 Brussels, Belgium — gegevensbeschermingsautoriteit.be
You may also complain to the supervisory authority where you live or work.
7. Security
Traffic is encrypted in transit (TLS). Platform tokens are held in the iOS Keychain and never transmitted to us. Access to production systems is restricted and authenticated. Backend requests are attested so that only genuine installations of the app can reach our API.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify the Belgian supervisory authority within 72 hours and inform you directly where the risk is high, as Articles 33 and 34 require.
8. Children
GamePanda is not directed at children. You must be at least 16, or 13 where your country has set a lower age of digital consent under Article 8(1) GDPR and your guardian permits it. We do not knowingly collect data from children below that age; if you believe we have, write to [email protected] and we will erase it.
9. Changes
We will post any revised policy here with a new date and version. If a change materially affects your rights we will tell wishlist subscribers and account holders before it takes effect.
10. Contact
- Privacy and data-protection requests — [email protected]
- Help with the app — [email protected]
- Legal notices — [email protected]
- Anything else — [email protected]