Privacy Policy

playedby.me is run by Håkon Fornes Medhus on a private server at his home in Norway, exposed to the internet through a Cloudflare tunnel. Nobody else has operational access to the server or the database.

When you use playedby.me, the following is stored about you:

• Account details: username, display name, email address, language preference, notification settings, and an avatar image if you upload one.
• Your password, stored as a bcrypt hash. It is never stored in plain text.
• Game history: playthroughs with platform, hours, dates, completion status, and free-text notes.
• Reviews and ratings you write.
• Lists, groups and who you follow.
• Comments and likes in the feed.
• Quiz results.
• Recommendations: games you have hidden, and a log of which recommendations were shown to you and what you did with them. The log is deleted after 90 days.
• Feedback you send from the app, with the page you sent it from.
• Push subscription (your browser's push endpoint and its keys), if you enable push notifications.
• Sign-in with Google or Discord, if you use it: your email address and the account ID at the provider, with the access tokens the provider issues. You choose your own username.
• Steam, if you connect your account: your Steam ID, Steam display name and profile picture, plus your game list with playtime and achievements. No Steam password or access keys are stored.
• PlayStation, if you connect your account: your public PSN ID, display name and profile picture, plus your game list with playtime and trophies. No secret is stored for your account.
• RetroAchievements, if you connect your account: your username, display name and profile picture, your game list and your achievements. Your API key is stored encrypted.

Everything is stored in a SQLite database on a private server in Norway, behind Cloudflare. The database is backed up every night, and the 14 most recent copies are kept. A copy is also taken before database updates. Backups are complete copies of the database and are treated with the same confidentiality as the database itself: only the person running the service has access. Deleted data can remain in older backups until they are rotated out. Copies of the database used for development are first cleaned of login sessions, push subscriptions and stored keys for connected game accounts.

playedby.me never sells data, shows no ads, and sends no marketing email. These third parties are nonetheless involved in running the service:

• IGDB (Internet Game Database): game covers and screenshots are loaded directly from IGDB's image servers in your browser. IGDB then sees your IP address, as with any ordinary image loading on the web.
• Steam: if you connect your Steam account, you sign in with Steam (OpenID), and the server fetches your game list, playtime and achievements from the Steam API. Steam then sees that playedby.me is asking about your profile.
• PlayStation: if you enter your PSN ID, the server fetches your game list, playtime and trophies from Sony using a dedicated service account. This only works when your game history is set to public in the PlayStation privacy settings. Sony sees that playedby.me is asking about your profile.
• RetroAchievements: if you connect your account, your username and API key are sent there to fetch your games and achievements.
• Google and Discord: if you use them to sign in, the provider sees that you are signing in to playedby.me.
• Other game sources: HowLongToBeat, RAWG, IsThereAnyDeal, ProtonDB and Twitch provide playtime, ratings, prices and viewer numbers. The server asks about the game, not about you. Viewer numbers from Twitch are stored for at most 24 hours.
• Resend: sends transactional email (email verification, password reset, email change confirmation). Resend processes your email address for this.
• Cloudflare: all traffic to the service passes through Cloudflare's network. Registration may additionally be protected by Cloudflare Turnstile (captcha).

The service counts usage in aggregate form: visits per page per day, and active users per day as a single total. The numbers are stored locally in the service's own database, without user IDs, IP addresses or other identifiers, and cannot be traced back to you. No third party is involved, and no cookies are used for this.

Login uses an httpOnly session cookie with a 90-day lifetime, and your language preference is stored in a separate cookie. There are no tracking or advertising cookies.

Your profile, with your library (including ratings and hours), lists, stats, Wrapped and profile picture, is visible to everyone by default, including people who are not signed in. Under Privacy in settings you can choose Groups only. Then only people who share at least one group with you can see it. Your feed activity and group content such as quiz results are only shown to people who share a group with you, whatever you choose. Administrators can view profiles and journals to operate the service. Notes you publish yourself as a public review appear on the game page for everyone with your username, rating, platform, hours and dates, and can be made private again. Other notes are visible to you and your groups. An aggregate playedby.me rating may be public once at least three people share their ratings. Sharing is on by default and can be turned off under Privacy in settings.

You can export your content as JSON or CSV from the settings at any time, and you can delete your account in the same place. Deletion removes your account, game history, reviews, likes, quiz results, notifications, and connected game accounts with their keys. If you disconnect a game account without deleting your account, the connection and key are deleted, while the games already imported stay. Comments you have written in other people's threads are anonymized rather than deleted, so the thread still makes sense to the others.

If you have questions about your data, get in touch (see below).

This policy may be updated as the service changes. Significant changes are mentioned in the service's update log.

Questions about privacy or your data go to [email protected]. The data controller is Håkon Fornes Medhus, who runs the service.