Privacy Policy

At a glance

• We collect only the data needed to run GameFound and keep it secure.
• If you create an account we store your username, email, a salted password hash, and — if you add one — an avatar URL.
• If you sign in with Google, Facebook, Discord, or X, we receive the minimum profile fields they share for sign-in (id, email, name, picture).
• We do not sell your data. We do not run advertising or analytics trackers.
• You can access, correct, export, or delete your data at any time from Account Settings or by emailing us.
• This policy is governed by GDPR and Portuguese law.

This summary is for convenience only. The numbered sections below are authoritative.

1. Who we are and what this policy covers

GameFound, operator of game-found.com (the "Service"), is the data controller for the personal data described in this policy, within the meaning of Article 4(7) of Regulation (EU) 2016/679 (the "GDPR") and Law no. 58/2019 of 8 August (the Portuguese GDPR execution law).

This policy explains what personal data we collect about you when you use the Service, why we collect it, who we share it with, how long we keep it, and the rights you have under applicable data-protection law. It applies to the website, to signed-in account features, and to the Deals page. It does not apply to third-party sites you reach via an external link from GameFound — those sites have their own privacy policies.

For anything privacy-related: contact@game-found.com.

TODO: add the operator's registered postal address and, where applicable, VAT/NIPC number, as required by Article 13 GDPR and Article 10 of Decreto-Lei n.º 7/2004.

2. What personal data we collect

2.1 Data you give us directly when you create an account

• Username — chosen by you, shown as your public display name and used as a sign-in identifier.
• Email address — used for account recovery and as an alternative sign-in identifier.
• Password — never stored in plaintext. We store only a salted hash generated by ASP.NET Identity (PBKDF2 with HMAC-SHA-256). We cannot see or recover your password; the only way to reset it is through the Account Settings flow while you remain signed in.
• Avatar URL (optional) — an https link to an image you want to appear on your profile.

2.2 Data received when you sign in via a third-party identity provider

If you choose to sign in via Google, Facebook, Discord, or X, we receive from that provider only the minimum profile fields needed to complete authentication: a stable provider-issued user id, your email address, your display name, and — where available — your profile picture URL. We do not request friend lists, the ability to post on your behalf, or permissions beyond basic sign-in.

2.3 Data created by your use of the Service

• Library and Wishlist — the list of games you add, linked to your account by a stable identifier. Each entry records the game slug, the list (Library or Wishlist), and the timestamp of addition.
• Session token — a short-lived JWT issued when you sign in. Stored in your browser's localStorage under the key auth_token.
• Deletion-schedule flags — if you request account deletion, we store the scheduled deletion timestamp and an internal Hangfire job id so the cancel flow can drop the pending job. Both are cleared if you cancel.

2.4 Data we collect automatically

• Server access logs — for each request, our web server records the IP address, user-agent string, HTTP method, request path, response status, and request duration. These fields are standard operational telemetry used for debugging, security monitoring, and capacity planning.

2.5 Data from third parties

The Service displays game metadata from IGDB and deal pricing from IsThereAnyDeal. That data is about games, not about you. We do not purchase data about users from brokers or social networks, and we do not receive any user-behaviour data from IGDB or ITAD.

3. Why we use your data, and the legal basis

Article 6 GDPR requires each processing activity to rely on a specific legal basis. The table below maps each purpose to its basis.

We do not process your personal data for targeted advertising, behavioural profiling, or automated decision-making producing legal effects, within the meaning of Article 22 GDPR.

4. Who we share your data with

We do not sell your personal data. We do not trade it with advertising networks. We share it only with the following categories of recipients, and only to the extent strictly necessary:

• Identity providers (Google, Facebook, Discord, X) — when you sign in via one of them, the handshake happens between you and the provider; they return a token containing the profile fields described in §2.2. They act as independent controllers for the data they hold about you.
• Hosting and infrastructure providers — provide the servers, databases, and observability pipeline that run the Service. They act as processors under Article 28 GDPR on our behalf, bound by a written data-processing agreement.
• Public authorities — where we are required to disclose data by court order or by applicable law (e.g. a law-enforcement request with a valid legal basis). We push back on requests that are not proportionate or that lack a proper legal basis.

The Service does not transmit any personal data to IGDB, IsThereAnyDeal, or any retail store. Clicking a deal navigates you to the retailer via an ITAD-provided URL; once you leave GameFound you are on that retailer's site under their privacy policy.

TODO: list the specific infrastructure providers actually in use (e.g. Azure Container Apps in a given region, Elasticsearch/Kibana host, Postgres host) and the country in which each processes data. This is required by Article 13(1)(e) GDPR.

5. International transfers of personal data

GameFound is operated from Portugal. Some of our processors and all of our OAuth identity providers are established outside the European Economic Area, principally in the United States. Transfers of personal data to such countries take place only where one of the safeguards in Articles 44–46 GDPR is in place, which in practice means:

• an adequacy decision of the European Commission (e.g. the EU–US Data Privacy Framework) for recipients that have certified to it; or
• the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), supplemented where necessary by additional technical and organisational measures.

You may request a copy of the transfer safeguards applicable to a specific recipient by emailing contact@game-found.com.

6. Cookies and similar technologies

Under Law no. 41/2004 of 18 August (Portuguese transposition of the ePrivacy Directive 2002/58/EC), storing information on your device or accessing information already stored on it requires your prior consent, unless that storage or access is strictly necessary to provide the service you requested. We rely only on the strictly-necessary exception. A prior consent banner is therefore not required.

• Authentication (localStorage). When you sign in we store a JWT under the key auth_token so you stay signed in across page refreshes. Strictly necessary.
• OAuth handshake cookies. Set by the identity provider during sign-in, cleared when the handshake completes. Strictly necessary.

We do not use analytics cookies, advertising cookies, retargeting pixels, or any other cross-site tracker. If that ever changes we will, before activating any non-essential technology, update this policy and obtain your prior consent through a cookie banner as required by law.

7. How long we keep your data

TODO: confirm the actual log- and backup-retention windows against the deployed infrastructure configuration and update the numbers above to match reality.

8. Your rights

Under the GDPR and Law no. 58/2019 you have the following rights with respect to your personal data:

• Right of access (Article 15) — ask us whether we process data about you, and obtain a copy.
• Right to rectification (Article 16) — have inaccurate data corrected. You can do most corrections yourself from Account Settings.
• Right to erasure (Article 17, "right to be forgotten") — have your data deleted. You can initiate this yourself; see §9 for details on the 5-day grace window.
• Right to restriction of processing (Article 18) — ask us to pause certain processing while a dispute is resolved.
• Right to data portability (Article 20) — receive your data in a structured, commonly used, machine-readable format (JSON) and transmit it to another controller.
• Right to object (Article 21) — object to processing based on our legitimate interests (§3), including our security and abuse-prevention logging. We will stop that processing unless we can demonstrate compelling legitimate grounds that override your interests.
• Right to withdraw consent (Article 7(3)) — where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
• Right not to be subject to automated decisions (Article 22) — we do not make automated decisions that produce legal effects or similarly significantly affect you.
• Right to lodge a complaint (Article 77) with a supervisory authority — see §12.

9. How to exercise your rights

The fastest way to exercise most rights is directly from Account Settings, where you can edit your username, email, avatar, and password, or request account deletion.

For rights that require us to act (access, portability, restriction, objection) email contact@game-found.com. Please include enough detail for us to identify your account. We may ask you to verify your identity if the request cannot be authenticated from your live session alone.

We will respond within one month of receiving a valid request, extendable by a further two months for complex requests under Article 12(3) GDPR. If we refuse a request we will tell you why and how to escalate.

Account deletion — 5-day grace window. When you request deletion we schedule a Hangfire job to permanently remove your account after 5 days. You remain signed in during that window so you can cancel without data loss. After the 5 days elapse, your account, Library, Wishlist, display name, and avatar are permanently removed. Residual copies in rotating backups age out as described in §7.

10. How we protect your data

We apply technical and organisational measures appropriate to the risk under Article 32 GDPR, including:

• HTTPS/TLS for all traffic between your browser and the Service;
• Passwords stored only as salted PBKDF2 hashes, never in plaintext;
• JWTs signed with a secret that is never shipped to the client;
• Role separation between public-facing endpoints and operator-only endpoints, with authentication required for the latter;
• Secrets (API keys, connection strings) held in deployment secret stores, not in source control;
• Routine patching and dependency updates.

No online service can guarantee absolute security. If we become aware of a personal-data breach that presents a risk to your rights and freedoms, we will notify the supervisory authority within 72 hours and communicate the breach to you where required, in accordance with Articles 33 and 34 GDPR.

11. Children

Consistent with Article 8 GDPR as implemented by Law no. 58/2019 in Portugal, GameFound is not directed at children under 16. Users under 16 may browse public content only, and only with the permission of a parent or legal guardian. If you are a parent or guardian and become aware that your child has created an account, email us and we will delete it.

12. Complaints to a supervisory authority

You have the right to lodge a complaint with a data-protection supervisory authority, in particular in the Member State of your habitual residence, place of work, or of the alleged infringement. In Portugal the competent authority is the Comissão Nacional de Protecção de Dados (CNPD):

• Website: www.cnpd.pt
• Email: geral@cnpd.pt
• Address: Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal

Before escalating, we would appreciate the chance to address your concern — email contact@game-found.com.

13. Changes to this Policy

We may revise this Policy from time to time. We will update the "Version", "Effective", and "Last updated" line at the top of this page and maintain a dated revision history at §15. If a change is material — for example, a new category of data, a new purpose, a new recipient, or a new international transfer — we will give you reasonable advance notice through the Service or by email before it takes effect. Your continued use of the Service after the change takes effect constitutes acceptance. If you do not accept the change, you may delete your account.

14. Contact

Questions, rights requests, or complaints:

• Email: contact@game-found.com
• Website: game-found.com

TODO: if you appoint a Data Protection Officer (not strictly required for GameFound's current scale but a reasonable signal), publish the DPO's contact here per Article 37(7) GDPR.

15. Revision history