Privacy Policy

1. Controller

2. Data we process

• Account: name, email, profile picture, username, bio, banner, and the date and version of the terms you accepted.
• Storefront identifiers and tokens: Steam ID, PSN Account ID and Online ID, Xbox XUID and gamertag, PSN NPSSO, Microsoft OAuth tokens.
• Riot account data: Riot ID (gameName#tagLine), PUUID, region, summoner level, League of Legends / TFT rank, win and loss counts, champion mastery.
• Game data: library, playtime, achievements, statuses, scores, reviews and recommendation comments, wishlist, favourite games and characters, pinned achievements, and a daily history of your playtime.
• Social content: direct messages, group chats, follow relationships, the users you block, and notifications.
• Presence: the time of your last visit and, for connected storefronts, the game you are currently playing.
• Moderation: reports you file (what you reported and why), reports about you, and restrictions of your account.
• Product signals: your votes on planned features.
• Beta feedback: your message, the page you were on, your browser details and, if you attached one, a screenshot of that page.
• Technical access data: IP address, user-agent, request time and URL, and a short-lived counter keyed to your IP address or account for rate limiting.

3. Sign-up and sign-in

Registration and sign-in with Google or Discord (OAuth) or with Steam (OpenID). We store the identity attributes the provider hands over (name, email, provider-side ID, profile picture). We accept a Google or Discord sign-in only if the provider has verified the email address. We do not send sign-in emails. When you accept the terms, we record the date and the version you accepted, which includes your confirmation that you are at least 16 years old.

The Service is not directed at children under 16; we delete accounts we learn belong to younger users.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

4. Connected storefronts and Riot Games

When you connect a storefront we fetch data on your behalf and cache it in our database to avoid re-syncing every session.

• Steam: SteamID64, profile data, library, playtimes, achievements.
• PSN: NPSSO token (encrypted), Account ID, Online ID, trophies, playtimes, library.
• Xbox: Microsoft OAuth tokens (encrypted), XUID, gamertag, library, achievements.
• Riot Games (League of Legends / TFT): Riot ID (gameName#tagLine), the resulting PUUID, region, summoner level and profile icon, ranked tier / division / LP, win and loss counts, and top champion mastery.

While you are connected, we also read from the storefront which game you are currently playing, to show it as your status (see section 5).

Riot data is read from the official Riot Games API and is limited to public information Riot already shows for your account. We use it only to display your competitive profile (your rank and related stats); we never derive an alternative skill rating, and we only show the account you link yourself. MyGamingLog is not endorsed by, sponsored by, or affiliated with Riot Games. Riot Games, League of Legends, and Teamfight Tactics are trademarks or registered trademarks of Riot Games, Inc.

You can disconnect at any time under Settings, Connections. Access tokens (and the Riot link) are deleted on disconnect; cached library data persists until you remove it.

Please note: disconnecting deletes the copy of the sign-in token that we store. It does not invalidate the token on the platform’s side (Sony, Microsoft, and so on). If you believe your platform account is compromised, change your password there or use the platform’s “sign out everywhere” option.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

5. Profile, library and presence

Library, scores, statuses, reviews, favourites and achievements are stored in our database. Profile visibility defaults to public; you can set it to friends only or private in Settings, and hide single games.

Presence. We store when you last visited, to show an online indicator, and, for connected storefronts, the game you are currently playing. Who sees this follows your presence setting: by default only people you follow each other with; you can make it public or hide it completely in Settings.

Playtime history and votes. We keep a daily record of your playtime per game, which powers your playtime statistics, and your votes on planned features.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

6. Messages, reviews and moderation

Direct messages are shown only to the sender and the recipient. We do not read them; we access them only if the law obliges us to or to handle a report about a message. Group chats are visible to the members of the group. Reviews and recommendation comments are public on the game's page and on your profile.

Reports and blocks. Reports (who reported what, the reason, and our decision) are stored to handle notices under the Digital Services Act; the reported member is not told who reported them. Blocks are stored until you lift them. When we hide content or restrict an account (a timeout or a ban), we store that with the reason. Hidden text is kept, not shown, so the decision can be reviewed and reversed. A profile picture or banner we remove is deleted.

Administrator access. Our administrators (the operator and the people he authorises to moderate, who are bound to confidentiality) can see profile content, including on private and friends-only profiles, and in addition your account email address, your linked Steam, PlayStation and Xbox identifiers, when you were last active, who you blocked and who blocked you, reports about you and by you, restrictions of your account, your sync history including error messages, the group messages you sent, and any beta feedback you sent including screenshots. They use this only to run and moderate the service, investigate abuse or security incidents, and meet legal obligations.

Legal basis: Art. 6(1)(b) GDPR for messages and reviews; for reports, blocks, restrictions and administrator access Art. 6(1)(f) GDPR (legitimate interest in a safe service) and Art. 6(1)(c) GDPR with Arts. 16 and 17 DSA.

How to report illegal content: see the contact points in the Imprint.

7. Beta feedback

If you send feedback with the feedback button, we store your message, the page you were on, your browser details and, if you attached one, a screenshot of that page. The screenshot is stored as an image file under a random, unguessable address.

Legal basis: Art. 6(1)(b) GDPR (contract performance).

8. Technical data and cookies

Each request transmits IP address, user-agent, time and URL. They appear in the logs of our hosting provider and are deleted after at most one day. To protect the service against abuse we count requests per IP address or account; these counters are deleted within a day.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure service).

Strictly necessary cookies

We set a small number of first-party cookies that the site cannot work without: the sign-in session (30 days), short-lived security tokens while you sign in or connect a storefront (10 to 15 minutes), a one-hour marker that you ticked the box at sign-up, a seven-day marker that you have accepted the current terms, during the private beta a five-minute marker that your account has access, and a one-year cookie that remembers your answer to the analytics banner. None of them is used for tracking. Your browser's local storage also keeps a few settings, such as the colour theme and your banner answer with its date. We set no advertising cookies and do no cross-site tracking.

Legal basis: Art. 6(1)(f) GDPR and §25(2) No. 2 TDDDG.

Analytics and error reporting (only with your consent)

PostHog (product analytics, hosted in the EU) and the browser part of Sentry (crash reports with the page and your internal user ID) store information in your browser and send data only after you accept them in the banner. With your consent our server also records one analytics event when you start signing in. If you decline, no analytics event and no browser crash report is sent, and nothing is stored in your browser for them.

Legal basis: Art. 6(1)(a) GDPR and §25(1) TDDDG (consent). You can withdraw at any time with the button below, with effect for the future.

Error reports from our servers

Errors that happen on our own servers are reported to Sentry so we can find and fix them. Those reports carry the error, the affected route and your internal user ID, never your email, name or IP address.

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure service).

Images and videos from other services

Game covers, screenshots, achievement icons and profile pictures are loaded by your browser directly from the servers of IGDB (Twitch), Valve, Sony, Microsoft, Riot Games, Discord and Google. Game pages show trailer preview images from YouTube (Google). Each of these providers receives your IP address and browser details when a page shows their content. The YouTube player itself loads only when you press play, in YouTube's privacy-enhanced mode (youtube-nocookie.com).

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing game media without copying it).

9. Recipients and third countries

Transfers outside the EU rely on the basis named in each row: the EU Standard Contractual Clauses (SCC), the EU-US Data Privacy Framework (DPF), an adequacy decision, or, where you ask us to connect a service, Art. 49(1)(b) GDPR.

10. Retention

• Account, library, reviews, favourites, playtime history, votes, follows, blocks and notifications: until you delete your account.
• Undo copy after a library reset: 48 hours.
• Direct messages: until you or the other person deletes their account; then the whole conversation is erased. Single messages cannot be deleted yet.
• Group messages: they stay part of the group's conversation. When you delete your account, your name is removed and your messages show “Deleted user”.
• Reports: until the account of the person who reported or of the person reported is deleted.
• Restrictions of your account: until they are lifted or your account is deleted.
• Beta feedback and screenshots: until you delete your account.
• Sign-in sessions: until you sign out, or 30 days after you last used them.
• Storefront tokens and the Riot link: until you disconnect or delete your account.
• Hosting logs: at most one day.
• Rate-limit counters: deleted within a day.
• Error reports at Sentry: deleted automatically after at most 90 days.
• Analytics data at PostHog (only with consent): kept while we need it to understand how the site is used; on request we delete your analytics profile.
• Backups: our database provider keeps a restore history; data deleted from the database leaves it after at most 30 days.

11. Your rights

You have the following rights under the GDPR:

• Access (Art. 15)
• Rectification (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Objection (Art. 21)
• Withdrawal of consent (Art. 7(3))

In Settings you can download your data and delete your account yourself. For everything else, an informal message to contact@mygaminglog.com is enough; we respond within one month.

12. Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also complain to the authority of the place where you live or work.

We have not appointed a data protection officer, because the law does not require one for a service of this size. Data protection questions go to contact@mygaminglog.com.

13. Changes

The date at the top of this page shows when it last changed. If a change affects what we do with your data, we point it out on the site.