Privacy Policy

When you sign in with Google, we store your email address and your Google account identifier. We never see your Google password, and we do not keep Google's sign-in tokens.

When you use Ihroteka, we store what you put on your shelf: library entries, copies, playthroughs, ratings, reviews, game lists, your wishlist, and your consoles. We also store your display currency, your avatar, counts of a few on-site actions that unlock arcade achievements, and the name, scopes, and last-use time of each API key you create. An API key itself is stored only as a one-way hash, so nobody can read it back.

If you connect a store or a language model, we store what that connection needs: a Steam Web API key and SteamID64, a GOG or Epic refresh token, or your model provider's API key. These are encrypted before they reach the database and are never shown back to you, except the last four characters of a model key.

We use your data to provide account access, store your collection, compute your insights, achievements, and timeline, and operate the service reliably.

Achievement boards show the share of players holding each achievement. That share is counted across all accounts, names nobody, and stays hidden until enough players have unlocked something. We run no analytics or advertising.

We process personal data to provide the service you signed up for (contract performance) and to keep it secure and running (legitimate interests). Connecting a store or a language model is optional and happens only when you choose it (consent).

You can withdraw that consent at any time by disconnecting the store or model in Settings, which deletes the stored credential.

We do not sell personal data. We share it only with the services Ihroteka runs on: Hetzner hosts the servers and the database, Cloudflare carries every request to the site and stores the database backups, and Pydantic Logfire receives the application's traces, logs, and metrics.

Traces and logs record the requests made to the service so that problems can be diagnosed: the address of each request, including any search you type, and how long it took. Log lines identify you by your account identifier, mostly as a shortened one-way hash, and your email address appears only as a one-way hash when you register. They do not contain your email address or anything you save, such as a review. Passwords, keys, tokens, and cookies are redacted before they leave the server.

Some features send data elsewhere only when you use them. A store sync reads your owned games from Steam, GOG, or Epic with the credential you connected. Drafting a review sends the game's name and catalog summary, your rating, and your pros and cons to the model provider you chose, under your own account with them.

Game details come from IGDB (run by Twitch) and exchange rates from ExchangeRate-API; neither receives any data about you. Cover art loads in your browser straight from IGDB's image servers, which see your IP address as any website you visit does.

We may disclose data when required by law or to protect users, the public, or the integrity of the platform.

We keep your data for as long as your account exists. Nightly database backups are kept for 14 days, so anything you delete is gone from every backup within 14 days. Traces and logs are kept for the retention period of our Logfire plan and then deleted by Logfire.

To delete your account, ask through the Contact page. We then delete your account together with everything it holds - library, reviews, lists, wishlist, consoles, achievements, API keys, and connections - and its copies in backups age out within 14 days.

Depending on your location, you may have rights to access, correct, export, delete, or restrict processing of your personal data.

You can export your full library at any time from Settings, and request other actions through the Contact page.

Every connection to the site uses HTTPS, connected credentials are encrypted, and API keys are stored only as one-way hashes.

No method of transmission or storage is fully secure, so we cannot guarantee absolute security.