Privacy Policy

playedby.me is run by Håkon Fornes Medhus on a private server at his home in Norway, exposed to the internet through a Cloudflare tunnel. Nobody else has operational access to the server or the database.

When you use playedby.me, the following is stored about you:

• Account details: username, display name, email address, language preference, notification settings, and an avatar image if you upload one.
• Your password, stored as a bcrypt hash. It is never stored in plain text.
• Game history: playthroughs with platform, hours, dates, completion status, and free-text notes.
• Reviews and ratings you write.
• Comments and likes in the feed.
• Quiz results.
• Push subscription (your browser's push endpoint and its keys), if you enable push notifications.
• Steam link, if you connect your Steam account: your Steam ID, Steam display name and profile picture, plus your game list with playtime and achievements. No Steam password or access keys are stored.

Everything is stored in a SQLite database on a private server in Norway, behind Cloudflare. The database is backed up regularly. Backups are complete copies of the database and are treated with the same confidentiality as the database itself: only the person running the service has access.

playedby.me never sells data, shows no ads, and sends no marketing email. These third parties are nonetheless involved in running the service:

• IGDB (Internet Game Database): game covers and screenshots are loaded directly from IGDB's image servers in your browser. IGDB then sees your IP address, as with any ordinary image loading on the web.
• Steam: if you connect your Steam account, you sign in with Steam (OpenID), and the server fetches your game list, playtime and achievements from the Steam API. Steam then sees that playedby.me is asking about your profile.
• Resend: sends transactional email (email verification, password reset, email change confirmation). Resend processes your email address for this.
• Cloudflare: all traffic to the service passes through Cloudflare's network. Registration may additionally be protected by Cloudflare Turnstile (captcha).
• Sentry: if error tracking is enabled, technical error reports are sent there. The reports concern bugs in the app, not your content.

The service counts usage in aggregate form: visits per page per day, and active users per day as a single total. The numbers are stored locally in the service's own database, without user IDs, IP addresses or other identifiers, and cannot be traced back to you. No third party is involved, and no cookies are used for this.

Login uses an httpOnly session cookie with a 90-day lifetime, and your language preference is stored in a separate cookie. There are no tracking or advertising cookies.

playedby.me is a group-based community behind a login. You can see profiles, game libraries, reviews, and activity from people who share at least one group with you. Administrators can view profiles to operate the service. Visitors who are not signed in cannot see an individual's content. An aggregate playedby.me rating may be public once at least three people share their ratings. Sharing is on by default and can be turned off under Privacy in settings.

You can export all of your content as JSON from the settings at any time, and you can delete your account in the same place. Deletion removes your account, game history, reviews, likes, quiz results, and notifications. Comments you have written in other people's threads are anonymized rather than deleted, so the thread still makes sense to the others.

If you have questions about your data, get in touch (see below).

This policy may be updated as the service changes. Significant changes are mentioned in the service's update log.

Questions about privacy or your data go to [email protected]. The data controller is Håkon Fornes Medhus, who runs the service.