Privacy Policy
What we collect, why, and how to control it.
1. Who we are
Game Backlog (ivoo.pl) is operated by Piotr Smilgin, an individual sole proprietorship (jednoosobowa działalność gospodarcza) registered in Poland, NIP 7812091373, REGON 542041752, address Owocowa 1 lok. 10, 62-080 Tarnowo Podgórne, Poland. We are the data controller for the personal data described below.
Contact for any privacy question or request: support@ivoo.pl.
2. Data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Username, email, password (bcrypt-hashed) | Create and secure your account, sign you in | Contract (Art. 6(1)(b) GDPR) |
| Backlog entries: games added, status, priority, rating | The core service — tracking your backlog and computing recommendations | Contract |
| A short "mood" note and your rated/finished games | Sent to our AI provider (Anthropic) when you use the AI recommendation feature, to generate a personalised pick | Contract / consent (only sent when you use the feature) |
| Steam profile / library, if you use Steam import | Import your game list and playtime automatically | Contract (only when you initiate an import) |
| Purchase records: date, credited amount, price, currency (no card data) | Deliver AI credit packs, accounting/tax record-keeping | Contract; legal obligation (Art. 6(1)(c) — Polish accounting law requires 5-year retention) |
| IP address, request timestamps (server logs) | Rate-limiting abuse/brute-force attempts, security | Legitimate interest (Art. 6(1)(f)) |
| Last-active timestamp | Send a one-off email with a few picks if you've been away 2+ weeks — never repeated while you stay away. Turn it off in Account settings. | Legitimate interest (Art. 6(1)(f)) — you can opt out at any time |
| Analytics cookies (Google Analytics, Umami) | Understand traffic and usage patterns | Consent (Art. 6(1)(a)) — only set after you accept the cookie banner |
3. Who we share data with
We don't sell your data. We do use a small number of processors to run the service:
- Stripe (payments) — processes AI-credit purchases. We never see or store your card details. Stripe is based in the US; transfers are covered by Stripe's standard contractual clauses.
- Anthropic (AI) — receives your finished-games list, ratings and optional mood text only when you use the "Ask AI" feature, to generate recommendations. Based in the US, transfers covered by standard contractual clauses.
- Our email provider (SMTP) — delivers verification codes, password-reset links and account-related email.
- RAWG, Steam/SteamSpy, SteamGridDB, HowLongToBeat — public game-catalog APIs we query to fetch cover art, genres, tags and playtime estimates. These calls use our own API keys and do not send your personal data to them (Steam import is the one exception: if you paste your own Steam profile link, we query Steam's public API using the ID you provided).
- Google Analytics (GA4) and Umami — analytics, only after you accept cookies. Umami is self-hosted (analytics.ivoo.pl); GA4 is Google's.
4. How long we keep data
- Account and backlog data: for as long as your account exists, or until you delete it.
- Email verification codes: 15 minutes. Password-reset tokens: 1 hour.
- Purchase records: kept after account deletion (anonymized — no longer linked to your name or email) for 5 years, per Polish accounting-record retention rules.
- Server security logs: rotated on a rolling basis, not kept indefinitely.
5. Your rights
Under GDPR you can, at any time:
- Access & export your data — use "Export my data" in Account settings, or email us.
- Correct inaccurate data — most fields are editable directly in the app.
- Delete your account and personal data — use "Delete my account" in Account settings, or email us. (Purchase records survive in anonymized form — see §4.)
- Object to or restrict processing based on legitimate interest.
- Withdraw consent for cookies at any time via the "Cookie settings" link in the footer.
- Lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
6. Cookies
We use strictly-necessary storage (your login session, your cookie choice itself) with no consent needed, and optional analytics cookies (Google Analytics, Umami) that only load after you click "Accept" on the cookie banner. You can change your choice any time via the "Cookie settings" link in the footer.
7. Security
Passwords are hashed with bcrypt and never stored in plain text. Traffic is encrypted with TLS. Login, registration and password-reset endpoints are rate-limited against brute-force and enumeration attacks.
8. Children
This service is not directed at children under 16. We do not knowingly collect data from anyone under that age.
9. Changes to this policy
If this policy changes materially, we'll update the "last updated" date above and, for signed-in users, note it in the app.
10. Contact
Piotr Smilgin · NIP 7812091373 · Owocowa 1 lok. 10, 62-080 Tarnowo Podgórne, Poland
Email: support@ivoo.pl