Privacy policy

This policy explains what personal data GameCalendar collects, why, how long we keep it, who else receives it, and the rights you have. It covers the website and any account you create on it.

The short version

You can browse the calendar without an account. We then keep only what is needed to serve the pages and keep the site safe.
With an account we store your email address, your settings and the lists you build. We use them only to run the features you use.
Your profile and tier lists are private unless you choose to make them public. Public ones can be seen by anyone.
We show no ads and never sell your data or share it for advertising. We count visits with a cookieless analytics tool that runs on our own server and stores no IP address and no profile of you.
We email you only to confirm your address, reset your password or warn you about your account's security. We never send newsletters or marketing.
You can download your data in Settings → Account and delete your account in Settings at any time.

Who is responsible

The controller responsible for your data is [Operator name], [Postal address]. For anything about your data, write to [email protected].

Our representative in the European Union under Article 27 GDPR is [EU representative: name and address].

What we collect and why

Data	Why	Legal basis	How long
Your account: email address, username, display name, password (stored only as a bcrypt hash), language, time zone and settings	To run your account	Contract (Art. 6(1)(b) GDPR)	Until you delete your account. Deletion takes effect 30 days after you ask; signing in before then cancels it.
Your acceptance of these terms: which version you accepted and when	To be able to show that you agreed to the terms of use and this policy	Legitimate interest in proving the agreement (Art. 6(1)(f) GDPR)	Until you delete your account
Sign-in with Google, Discord, Steam or Twitch: your account ID there, the email address it shares and a link to its profile picture	To let you sign in with that service	Contract	Until you disconnect the service in Settings → Connections or delete your account
Sign-in records: IP address, browser and device, time of sign-in and of last activity	To keep your account secure	Legitimate interest in security (Art. 6(1)(f) GDPR)	The IP address is erased after 90 days. The record is deleted when you sign out, or after 13 months at the latest.
Your Steam library and wishlist	Only when you connect Steam and ask us to import them, to mark the games you own and want	Contract	They stay on your account as your own lists until you remove them or delete your account
What you build: watchlist, wishlist, followed franchises and companies, platforms and genres, tier lists, calendar presets, countdown and brand settings, uploaded avatar and logos	To provide the features you use	Contract	Until you delete them or your account
Public profile and public tier lists	To show them to anyone, when you switch them on	Contract (your choice to publish)	Until you make them private or delete them
Notifications on the site	To tell you about the games and events you follow	Contract	Read notifications are deleted after 90 days
Push notifications: the address your browser's push service gives us, its encryption keys and your browser	To send the alerts you turned on	Consent (Art. 6(1)(a) GDPR). Turn push off in Settings → Notifications or in your browser at any time.	Until you turn push off or your browser ends the subscription
Server logs: IP address, page requested, time and browser	To keep the site running and safe, and to find errors	Legitimate interest in security and operation	[Server log retention, e.g. 14 days]
Visit statistics: pages visited, referring site, country, browser, device type and an anonymous identifier that changes daily. Your IP address is used only to derive the country and is not stored, and no cookie is set.	To see which pages are used and to improve the site	Legitimate interest in improving the site (Art. 6(1)(f) GDPR). The tool runs on our own server and shares nothing with third parties.	Kept as anonymous statistics that are not linked to your account

You don't have to give us any of this, but without an email address or a sign-in service we can't create an account for you. We make no automated decisions about you that have legal or similarly significant effects.

Data we receive from other services

When you sign in with Google, Discord, Steam or Twitch, that service sends us your account ID there and, depending on the service, your email address, display name and profile picture. Steam data about your games is fetched only when you ask for it. We tell you here which Steam data we keep: your Steam ID, the games you own and your wishlist. It is stored on our servers in [Country of the servers].

When you disconnect a service in Settings → Connections, we delete the account ID, email address and picture link it gave us. If you remove our access on the service's side instead, tell us at [email protected] and we will delete them too. We never pass data from these services to advertisers or data brokers.

Who else receives data

[Hosting provider] hosts our servers in [Country of the servers] and processes all data on our behalf.
[Email delivery provider] delivers our account emails.
Your browser's push service delivers push notifications: Google for Chrome, Microsoft for Edge, Mozilla for Firefox, Apple for Safari. The messages are encrypted, but the service sees when they are sent and how large they are.
Anyone can see a profile or tier list you make public.

We don't sell personal data and don't share it with anyone for advertising.

Content loaded from other servers

Some files on our pages come straight from other companies' servers, so your browser sends them your IP address and browser details when it loads them:

fonts from Google Fonts (Google);
game covers and screenshots from IGDB (Twitch) and Steam (Valve);
article images from Wowhead, Icy Veins and Warcraft Tavern on the WoW Forever news page;
trailer thumbnails from YouTube (Google);
profile pictures from the sign-in services you connected.

The YouTube player loads only when you press play, except on a game's countdown page, which plays trailers automatically, and on an event's page, which shows the event's stream. Once it loads, YouTube can store data on your device. GameCalendar uses YouTube API Services; see the Google Privacy Policy and the YouTube Terms of Service.

Some of these companies are based outside the European Union, mainly in the United States. Where they receive personal data from us, we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework where the company is certified under it, or on the Commission's standard contractual clauses.

Cookies and storage on your device

We use only the cookies and browser storage the site needs to work: to keep you signed in (up to 13 months if you tick "Keep me signed in"), to protect forms, and to remember choices such as your language, time zone and layout. A copy of pages you visited is also kept so the site opens faster and works offline.

None of this is used for advertising, analytics or tracking across sites, so we don't ask for consent. You can delete it all in your browser's settings. "Do Not Track" signals change nothing here, because we don't track you across other sites.

Your rights

Under the GDPR you have the right to:

get a copy of your data: download it in Settings → Account, or ask us;
correct it: most of it you can edit yourself in Settings;
have it deleted: delete your account in Settings, or ask us;
restrict how we use it, and receive it in a portable format;
object to processing we base on legitimate interest;
withdraw consent at any time, for example by turning off push notifications, without affecting what happened before.

Write to [email protected]. We answer within one month. Deleted data may survive in backups for a short time, where nobody uses it until it is overwritten. You can also complain to a data protection authority, in particular the one where you live or work.

Age

GameCalendar accounts are for people aged 16 or over. We don't knowingly collect data from younger children. If we learn that we have, we delete it.

Security

Passwords are stored only as bcrypt hashes, the sign-in cookie can't be read by scripts, and we keep the data we hold to what the features need.

Changes to this policy

If we change this policy in a way that matters to you, we will announce it on the site at least 30 days before the change takes effect. The date at the top shows the current version.

Contact

[Operator name], [Postal address], [email protected].