What we hold, and for how long

The short version

• No analytics, no advertising, no third-party trackers. There is no measurement script in these pages at all. Nothing you read here is reported to anybody.
• Nothing is sold or shared for marketing. Not to advertisers, not to publishers, not to the companies whose games are in the catalogue.
• Your profile is private by default. Signing up does not put a page about you on the internet; you choose that, later, in Settings.
• Deleting your account deletes it. Immediately, from Settings, with no queue and no grace period.

What an account holds

The row that is created when you sign up, and everything you can later put on it:

• A handle, unique and public wherever you post. If you signed in with Google we invent a first one from your display name; you are meant to change it.
• An email address, if you signed up with one or connected Google. It is used for signing in and for reaching you about the account. There is no mailing list to be on.
• A password, if you set one — stored as an scrypt hash with a random salt, never as you typed it. Sign in with Google or Steam and there is no password at all.
• Eight aptitude numbers from calibration, plus your input device, your stance on assists, the platforms you play on and any accessibility needs you told us about. These are the whole reason the site can give you a different number from the published one.
• A display name, a bio and a picture, if you fill them in.
• A price region, so store prices are shown in a currency that means something to you.
• Housekeeping — when the account was made, when the welcome screen was shown, when you were last seen, your XP total, and a trust score that is used by the anti-spam checks.

What you write

Ratings, wall entries, quick verdicts, head-to-head votes, library statuses, game comments, chat messages and reactions are all stored against your account. Most of them are the point of the site: a rating nobody can see is not a rating, and a wall chart is written for the next player.

Comments and chat messages are stored as you wrote them, and edits keep the message rather than a history of drafts. When you report a message, the report keeps a copy of the text as it was at that moment — which is why editing something after it has been reported changes nothing.

Chat is not end-to-end encrypted and nobody should treat it as private. Moderators can read messages in any room, including private ones, and blocking somebody hides them from you without hiding them from moderation. Voice is the exception, and only because of how it is built: calls go directly between the browsers in them, nothing is recorded, and there is no transcript for anybody to read afterwards.

Who can see your profile

Three settings, and the default is the strictest one. You change it in Settings.

• Private. The default. Your profile page returns a 404 — not “this profile is private”, which would confirm the handle exists, but the same answer a handle nobody registered gives.
• Fingerprint. The shape of your aptitudes, the month you joined, how many games you have beaten and rated, the hardest thing you have cleared, and your rank. Numbers and a chart; nothing you wrote.
• Full. The above plus the things you chose and wrote — display name, picture, bio, and any Twitch or YouTube channel you connected.

Which shelves of your library are listed is a separate choice, and starts empty at every tier. You can publish what you have beaten while keeping what you bounced off to yourself — that shelf is the most personal column in the table and is the one most likely to be quoted back at somebody.

Visibility governs your profile, not your posts. A comment, a wall entry or a chat message is public where it sits, under your handle, whatever this setting says — the profile it links back to is what stays shut. Ratings feed the community fingerprint for a game either way, and there they are one anonymous number among many.

Pictures you upload

An uploaded avatar is decoded, rotated upright, cropped and re-encoded to a 256-pixel WebP before anything is stored. The file you chose is discarded at that point, and the copy that is kept carries none of its metadata — no camera, no timestamp, no GPS coordinates from a photo taken on a phone.

Where the result lives is a deployment’s choice: a storage bucket if one is configured, otherwise a row in the database. Either way it is served under your profile and deleted with your account. The preset pictures and the generated identicons are drawn from your handle and store nothing.

Google, Steam, Twitch and YouTube

Google sign-in tells us three things: Google’s permanent identifier for your account, the email address on it, and the display name and picture attached to it. The identifier is what we match on — an email address can change hands, and that one is stable. We do not receive your Google password, and we ask for nothing beyond who you are. Signing in with Google for the first time creates an account; after that it is simply a way in. There is no button in Settings to unlink it yet; ask at sharedwork37@gmail.com and we will remove the link, provided you have set a password first so you are not locking yourself out.

Steam is two separate things. Signing in through Steam uses OpenID and hands over your SteamID and nothing else — Valve never sees a password of ours and we never see one of theirs. Connecting the account then lets us ask Steam’s Web API for your public profile name and picture, the games you own, your playtime and your achievements, so the site can read your aptitudes from what you have actually finished instead of from eight sliders. That reads whatever your Steam privacy settings make public, which are yours to change on Steam. Disconnecting removes the link and everything synced under it — but keeps the games you personally confirmed you had beaten, because those are your statements about yourself rather than Steam’s data about you.

Twitch and YouTube are decoration: connecting one stores the channel it points at so it can be shown on your profile. They are not credentials and disconnecting one cannot lock you out.

Cookies and sessions

There is no cookie banner because there is nothing to consent to. Every cookie this site sets is one it needs to work; none of them profile you and none of them are read by anybody else.

• The session cookie. Set when you sign in, good for 30 days, and holding a random token. The database stores only a SHA-256 digest of that token, so the contents of our own session table cannot be used to sign in as you. Signing out deletes both ends. Changing your password ends every other session.
• A guest calibration cookie. If you answer the eight questions before making an account, the answers live in this cookie so the site can re-score for you. It is folded into your account when you sign up, and it is the only reason a signed-out visitor has any state at all.
• A price region cookie, holding the region you picked.
• Short-lived sign-in cookies. Each trip out to Google, Steam, Twitch or YouTube leaves a one-time value behind for a few minutes so the reply can be checked against the request that started it. They are a security measure and are deleted on use.

Your theme choice is kept in the browser’s local storage rather than a cookie: it is never sent to the server, because the only thing that needs it is the page you are looking at.

Everyone else who is involved

Running the site means other companies handle parts of it. None of them are sent anything for their own purposes.

• The host and the database provider. They hold what the site holds, and their request logs — which include IP addresses — are how a server is operated and how abuse is investigated. Those logs are the provider’s and are kept for their standard, short window.
• A storage bucket, on deployments that use one, holding avatar images and nothing else.
• Google, Valve, Twitch and YouTube, when you choose to connect to them — and only then.
• IGDB and the Steam store, for catalogue metadata about games. Requests to those are about games, never about you.
• A language model, used to draft the difficulty profile of a game the first time it is imported. It is sent public catalogue text about that game. No account data, no comment, no chat message and no rating of yours is ever sent to it.

We will hand something over to law enforcement when we are legally required to, and not otherwise. Where we are permitted to tell you first, we will.

How long things are kept

The general rule: the things that are useful forever are kept, the things that rot are swept. Deleting your account cuts across all of this — see below.

Sessions

30 days from sign-in, and expired rows are cleared out whenever anybody signs in. Signing out deletes yours immediately.

Sign-in attempts

A week. Each row is the address a sign-in or sign-up was tried from and a one-way hash of the name typed into the box — never the name itself, so this cannot be read back as a list of anybody. It is what stops passwords being guessed at speed.

Notifications

Read ones for 90 days, unread for 180, then swept. An unread badge from six months ago is not mail waiting to be read.

Ratings, walls, verdicts, library

For as long as the account exists. They are the record the site is built from, and you can edit or remove any of them yourself.

Comments and chat messages

Kept until deleted. Private rooms that go quiet are closed rather than erased, so the people who were there can still read them.

Voice

Not recorded at all. The handshake notes two browsers exchange to connect are deleted within minutes.

Reports and moderation records

Kept indefinitely, including the copy of the reported text. A moderation history that erases itself cannot show a pattern, and a pattern is the only thing that distinguishes a bad day from a bad actor.

Room invites

Expired codes are deleted a month after they lapse; the log of who tried a code, after a week.

Votes cast

A week. Every arrow you click is noted separately from the vote itself — which account, what it was on, and whether it was allowed — because a limit on how fast anybody can vote needs something to count, and one account burying another under a hundred downvotes should be visible to a moderator afterwards.

Uploaded pictures

Until you replace or remove them. The previous picture is not kept.

Linked accounts

Until you disconnect them. Disconnecting Steam also removes what was synced from it, keeping only the games you confirmed yourself.

Server logs

The hosting provider's, on their schedule, measured in days. The site keeps no request log of its own — the three logs above, sign-in attempts, invite codes tried and votes cast, each kept a week, are the whole of what it writes down about what you do.

Deleting your account

Settings → Delete, type your handle, and it is done in that request. There is no confirmation email, no seven-day window and no way to undo it, which is why it asks you to type the handle rather than press a second button.

Gone with the account: your email, your password, your aptitudes and every setting; your ratings, verdicts, library, head-to-head votes and every vote you cast; your sessions; your uploaded pictures; your Google, Steam, Twitch and YouTube links and the imported Steam library; your XP history and the notifications addressed to you.

Left behind, without you attached to it: comments, chat messages and wall entries. The account reference on each is set to nothing, so they show as written by a deleted account and can never be traced back to you — but the words stay. This is the one place the policy chooses the other people over you, and it is worth saying why: a thread where half the messages vanished is unreadable for everyone who was in it, and a wall chart is advice the next player is relying on. If a specific thing you wrote needs to be gone as well, ask before you delete the account, while we can still tell which posts are yours.

Also left behind: moderation reports and actions involving you, with your identifier cleared the same way, and the aggregate scores your ratings already contributed to — a published fingerprint is an average of hundreds of numbers and holds none of them individually.

Backups are the honest exception. A database backup taken before you deleted your account still contains it until that backup ages out, in the ordinary rotation. Nothing is restored from one except to recover the whole database from a failure.

Locked out and unable to reach Settings? Write to sharedwork37@gmail.com from the address on the account and we will do it for you.

Getting a copy, and other rights

Most of what we hold about you is already on screen: your profile, your library, your ratings and your settings are readable in the app whenever you want them. For the rest — or for a copy in one file — write to sharedwork37@gmail.com from the address on your account. We will send a machine-readable export of your account row, your content and your linked accounts within 30 days.

You can also ask us to correct something, to delete something specific, or to explain where a particular piece of data came from. If you are in the UK, the EU or somewhere with comparable law, the rights those give you — access, correction, erasure, portability, objection — apply here, and you can complain to your national data protection authority if we handle a request badly. We would rather you told us first.

Children

Accounts are for people aged 13 and over, or older where local law requires it. If you believe a child has made an account here, write to sharedwork37@gmail.com and it will be removed.

When this changes

Changes move the date at the top of this page. A change to what we collect, who it goes to, or how long it is kept will be announced on the site as well — not published quietly and dated. Questions about any of it go to sharedwork37@gmail.com.