Privacy
Provisional version: it states what is already decided. The complete version comes before the public opening.
What devingame keeps today, why, and for how long. Every feature that adds data completes this page.
| Data | Why | How long |
|---|---|---|
| Your account: username, e-mail address, hashed password, hashed two-factor secret and backup codes, the dates of the declared age, of the accepted terms, of the confirmation and of your last sign-in | Sign you in, protect your account, prove your consent | Until the account is deleted; 7 days for an account never confirmed; 3 years without a sign-in (an e-mail warns you 30 days before) |
| Your known devices: the hashed fingerprint of a cookie, the browser and system, the network of your IP address (never the whole address) | Alert you of a sign-in from a new device | 6 months after the last sign-in from the device |
| The resets of your two-factor authentication: dates of the request, of your confirmation and of its application | Recover your account after losing a phone | 1 year |
| Your linked accounts: your identifier and name on PlayStation, Xbox or Steam, the access tokens, encrypted; for Google, the kind and end of the access you gave. Of the copy Google prepares, only the installed games recognised are kept | Read your library on these platforms | Until you unlink it, delete the account or, for Google, the access ends; Google's copy, the time to read it |
| Your library: games, progress, trophies and achievements, playtime, statuses, monthly goals, activity, statistics | Follow your progress | Until the account is deleted (when unlinking, you choose to keep it or not) |
| The Takeout archive you send: only the list of installs and, for each game, its achievements and activity are read; then the import's count | Add your Android games and their progress | The archive is erased as soon as it is read; the count, 1 year |
| The synchronisation logs: which account, when, with which result | Understand a synchronisation that fails | 30 days |
| Your web game results: score, emoji grid, streaks | Keep your results and streaks | Until the account is deleted |
| Your profile: avatar, bio, platforms, languages, showcase, visibility settings | Present yourself, find each other between players (nothing is public until you decide so) | Until the account is deleted; a replaced avatar is erased |
| Your friends, your requests, your refusals and your blocks | Play with friends, protect yourself | Until either account removes it or is deleted; a refusal, 30 days |
| Your messages and their pictures (re-encoded, without EXIF data), who writes to whom and when | The messages | 12 months, pictures included; if you delete your account, your messages stay with their recipients, signed « deleted player », until they are purged |
| Your notifications (what they are about, never a message's text), your preferences, and the devices that receive them (the address of their browser's push service) | Tell you what happens to you, in the bell and on your devices if you asked | 90 days; a device, until you remove it or its browser forgets it |
| The events of your feed (platinum, game completed, new game, streak, goal) and the « Well done » | Share your feats with your friends — never a hidden game | 90 days |
| Your trophy help calls (game, platform, trophies, slot, language, places) and your answers to others' calls | Find players for online trophies | 30 days after the call expires (two hours after its slot) |
| The guides you propose and the dead links you report | Share guides | Until the account is deleted (a proposed guide stays, without your name) |
| Reports: a copy of the reported content, who reported (never revealed to the author), the decision and its motivation; sanctions | Moderate, prove a decision | 12 months after the decision |
| For a banned account: a fingerprint of its e-mail address, never the address | Refuse a new sign-up | As long as the ban holds |
| The archive of « Download my data » | Give you your data | 7 days after your request |
Who receives what
devingame is hosted on a server rented from Contabo; its e-mails leave from that server. When you link an account, Sony, Microsoft or Valve receive the read requests made on your behalf. IGDB receives game titles, to recognise them, never your identity. If you turn notifications on for a device, its browser's push service (Google, Mozilla, Apple…) carries an encrypted message. Other players only see what your settings show them.
No tracker, no ads, no font or script loaded from a third party. The only cookies are the session's, "remember me" and the recognition of your device, and your time zone (to show a slot at your time).
Your rights
You can download all your data or delete your account, yourself, at any time; correct your profile in the settings. For any other request or complaint, write to the point of contact; you may also refer to your data protection authority. My data