Privacy Policy

LootPick is for people aged 13 and over. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and you believe your child under 13 has an account, email us and we will delete it and the data behind it.

Using LootPick as a guest

You can use LootPick without signing up. In guest mode nothing is sent to our database, your lists stay on your device, and we hold no account for you. Clearing app data or changing device loses them. This section describes what happens once you create an account.

Your account

Accounts are handled by Clerk, our authentication provider. When you sign up we receive your email address, and if you sign in with Google, the name and profile picture attached to that Google account. Clerk holds your password. We never see it.

What you create in the app

Stored in our database at Supabase, tied to your account:

• Games on your wishlist and in your backlog, and the status you give them
• Price and score alerts you set, and their targets
• Purchases you log, including price, store, platform, date and hours played
• Ratings and written reviews you post, and whether you marked a review as containing spoilers
• Your username, which is shown next to your ratings and reviews
• Your profile: display name, bio, gaming handles you choose to add, and your currency preference
• Your subscription tier and app settings

Steam sync, if you use it

Connecting Steam is optional. If you connect it, we store your Steam ID and the handle you entered. Through the public Steam web API we read your owned games with total hours played, when you last played and hours in the last two weeks, and your wishlist, so we can match them into your lists. When you open a game page we also read your achievements for that one game, and we keep the unlocked count and the total on your copy of the game. This only works for data your Steam privacy settings make public: profile, game details and wishlist. We do not post anything, change anything, or read your friends list, chat or private data. Steam does not tell us what you paid, so imported games have no price until you add one. You can disconnect at any time in Settings. Disconnecting removes the link and stops new reads. Games already imported stay in your Loot until you delete them.

Subscriptions and purchases

Payments in the mobile app run through Google Play. Payments on the website run through Stripe, using RevenueCat Web Billing. We never receive, see or store your card number or billing address. RevenueCat, our subscription provider, tells us which plan you are on and whether it is active, so the app knows what to unlock. It holds an anonymous purchase identifier linked to your account.

Ratings and reviews are public. When you rate a game or write a review, anyone who opens that game page can see your username, your score out of 10, your review text, when you posted it, and whether you marked it as containing spoilers. This includes visitors who are not signed in. Your email address, account id and Loot contents are never shown.

LootPick also shows anonymous totals on a game page: how many people have it in their Picks or Loot and the average rating. Reviews are limited to 200 characters and are checked automatically for profanity before they post. Changing a game back to Not played, removing your last copy of a game from your Loot, or deleting your account removes the review and rating.

Free accounts see ads served by Google AdMob. To do that, Google collects your device advertising identifier, your approximate location derived from your IP address, and information about your device.

Ads are the one part of LootPick where a third party uses data for its own purposes rather than simply working on our behalf. We think you should know that plainly.

• In the EEA, the UK and Switzerland we show a consent prompt before any personalised advertising. Choose non-personalised and Google receives far less.
• Anywhere else, you can reset or delete your advertising ID in your device settings at any time.
• Ad-Free and Premium subscribers see no ads, and the advertising SDK does not run for them at all.

On the website, once we switch advertising on, free visitors may see ads served by Google AdSense, which uses cookies to show and measure them. Website ads are not running yet. We also use Google Analytics to count visits. On the website we ask every visitor, in every country, before loading either one, using the cookie notice: nothing from Google for analytics or advertising loads until you accept, and you can change or withdraw your choice at any time under Cookie settings in the footer. Ad-Free and Premium accounts see no ads on the website, and the AdSense script does not load for them.

If you allow push notifications in the LootPick app, OneSignal stores a push token, and the device name and platform, so a message can reach your phone. We keep that token linked to your account. We use it to tell you when a price you are watching drops or reaches your target, when a game you track is released, and when a free game appears, following the notification settings you choose in the app. Push notifications come from the mobile app only; the website does not send them. You can choose email alerts instead. Turn notifications off in the app or in your device settings and the token stops being used. Uninstalling the app does not delete the token, but deleting your account removes it from our database. OneSignal keeps its own copy under its own retention period.

We use PostHog to see which parts of the app people actually use and where they get stuck. It records a defined set of events, such as opening the app, adding a game, setting an alert or opening a store link, along with device type, operating system version and app version, and a random identifier for your installation.

You can turn this off. Profile, then Preferences, then Share usage data. Analytics never includes your name, email or the contents of your lists.

Brevo sends our email: account emails, subscription receipts and, if you asked for it, launch and product news. Marketing email always carries an unsubscribe link, and unsubscribing does not affect account email you need to receive.

The LootPick website is hosted by Netlify. Sign-in uses cookies set by Clerk. The site also stores small settings in your browser, such as your theme, your currency, an official-stores-only preference and, in guest mode, your picks. These stay in your browser and are not sent to us. Clearing your browser data removes them.

Google Analytics and Google AdSense may set their own cookies. We ask for your choice first, in every country: neither loads, and no analytics or advertising cookie is set, until you accept in the cookie notice. Your choice is saved in your browser (local storage key lp_consent), and you can change or withdraw it at any time under Cookie settings in the footer. Rejecting does not affect your access to LootPick. Our hosting provider and our services also keep ordinary server logs, such as your IP address and the pages requested, for security and troubleshooting.

Prices, review scores, artwork and release dates come from IGDB, CheapShark, IsThereAnyDeal, GamerPower and the Steam Web API. That flows towards you, not away from you. Nothing about your account is sent to them.

Store links may pass through a partner service before reaching the store, and can carry affiliate tracking that earns a commission for us or for that partner. Following one tells that partner and that store you clicked, as any link does. The price you pay is identical. We do not adjust scores or rankings based on commission, and the Buy Now Score is calculated the same way regardless of whether a link earns us anything.

Games metadata is powered by IGDB.com

Where the UK and EU GDPR applies, our legal bases are:

• Performing our contract with you, for your account, your tracked games, your alerts and your subscription. Without this data there is no product.
• Your consent, for personalised advertising, push notifications, marketing email and Steam sync. Withdraw any of them at any time, in the app or your device settings.
• Our legitimate interests, for analytics, security and fraud prevention, balanced against your privacy. This is why analytics stays coarse and event based rather than recording everything you tap.

If you are in the UAE, the Federal Personal Data Protection Law gives you equivalent rights, listed below.

We do not sell your personal information, and we do not share it for cross context behavioural advertising beyond the AdMob activity described above. The companies listed here process data on our instructions as our service providers, apart from Google's advertising business, which acts for itself.

• Clerk, accounts and sign-in
• Supabase, database and storage
• RevenueCat, subscription status, and Stripe, card payments on the website
• Netlify, website hosting
• Google Analytics and Google AdSense, website analytics and ads
• Google AdMob and Google Play, advertising and payments
• OneSignal, push notifications
• PostHog, product analytics
• Brevo, email

We will also disclose information if the law requires it, or to protect our rights, our users or the security of the service.

We operate from the United Arab Emirates and our providers process data on servers in the United States and the European Union. Where personal data leaves the UK or EEA, our providers rely on the European Commission's standard contractual clauses or an equivalent safeguard.

• Account and app data: until you delete your account, then removed from our live systems. Backups are cleared on their own schedule, and provider records follow the provider's retention.
• Subscription records: retained after deletion where tax and accounting law requires it, without the rest of your profile attached.
• Analytics events: retained by PostHog for up to 12 months.
• Email records: until you unsubscribe or your account is deleted.

In the app: Profile, then Delete Account. On the website: Settings, then Danger zone, then Delete account, which asks you to type DELETE and to confirm with a code we email you. It removes your wishlist, backlog, alerts, purchases and hours, ratings and reviews, email history, profile and Steam connection from our live systems, and then your sign-in. It cannot be undone. Backups are cleared on their own schedule, and records held by our processors follow their own retention periods. Email us if you want a processor asked to delete its copy sooner.

If you cannot reach the app, email play@lootpick.quest from the address on the account and we will delete it within 30 days.

If you have a website subscription, deleting your account cancels it and it stays active until the end of the period you paid for. A subscription bought through the App Store or Google Play cannot be cancelled by us: cancel it in that store, or it keeps billing after the account is gone. If someone deletes an account through another route, such as a support request, we remove the same data automatically.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can also withdraw consent at any time and complain to your data protection authority.

If you are in California, you have the right to know, delete, correct and opt out of sale or sharing. We do not sell personal information. We will not treat you differently for exercising any of these rights.

Most of this is faster to do yourself. Ads, notifications, marketing email, Steam sync and account deletion are all switches inside the app. For anything else, email us and we will respond within 30 days.

Traffic between the app and our services is encrypted in transit. Database access is restricted by row level security, so your rows are readable only by your account. No system is perfect, and we do not claim otherwise. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

When this policy changes we update the effective date at the top. If a change is significant, for example a new category of data or a new advertising practice, we will tell you in the app or by email before it takes effect, and update our Google Play data disclosures at the same time.