Privacy Policy · Games Assemble

1. Data controller

Games Assemble is a project run by its owner as an individual, with no formal business activity at this time. The owner acts as the data controller for your personal data and can be reached at [email protected] for any question about this policy. Games Assemble unifies your Steam, Epic and GOG game libraries.

2. Data we process

• Account: your email address (for magic-link login).
• Store connections: identifiers for your accounts (SteamID, Epic, GOG) and encrypted access tokens (AES-256-GCM) to read your library at your request.
• Library: games you own, playtime, and enriched metadata.
• Personal content: statuses, notes, reviews and ratings you add.

3. Purpose and legal basis

We process this data to provide you the service (unifying and enriching your library), on the basis of performance of the contract/service and your consent when connecting each store. We don't use your data for unsolicited marketing and we don't sell it.

4. Third parties and processors

To operate, the service communicates with: the Steam, Epic and GOG APIs (at your request, to read your library); and metadata sources such as RAWG, SteamGridDB and OpenCritic. We also use infrastructure providers (hosting, image storage and email delivery). Each processes only the minimum data necessary.

If you choose to support the project with a donation via Ko-fi, that transaction is handled entirely by Ko-fi and its payment gateway (PayPal or Stripe, your choice) — Games Assemble never receives or stores your card or payment account details. That donation is independent of your account in the app and doesn't require signing in.

5. Security

Store tokens are stored encrypted at rest and never sent to your browser. All communication is over HTTPS. Credential exchange and refresh happen exclusively on the server.

6. Retention and your rights

We keep your data for as long as you have an account. You can exercise your rights of access, rectification, erasure, portability and objection (GDPR) by writing to [email protected]. Deleting your account cascades to delete your connections, library and personal content.

7. International transfers

The main infrastructure is hosted in the European Union. When a provider is located outside the EEA, appropriate safeguards apply (standard contractual clauses).

8. Contact

For any question about privacy: [email protected].