Privacy Policy

1. Accountability and contact

Kristian van Doran, operating The Gaming Inbox is responsible for personal information handled by The Gaming Inbox and currently acts as its Privacy Officer. Questions, access or correction requests, deletion requests, consent withdrawals, and privacy complaints can be sent to privacy@thegaminginbox.com.

We will verify a requester’s identity before providing access to or changing account information. We aim to acknowledge privacy requests promptly and respond within the period required by applicable law.

2. Information we collect

• Account and access information: email address, sign-in method, account identifiers, approval status, password hash and salt (never the plain password), verification and security records.
• Twitch information, when you use Twitch sign-in: Twitch user ID, username, display name, email address, and profile image made available through the authorized login flow.
• Profile and community information: display name, username, biography, profile image, follows, reactions, reposts, reports, moderation history, Top 3, tier lists, ratings, reviews, spoiler choices, library status, and other activity you submit.
• Taste and usage information: swipes, selected genres and platforms, games viewed or searched, recommendation signals, notification preferences, tutorial progress, and feature interactions.
• Technical and security information: session and locale cookies, browser storage preferences, push-notification endpoint and encryption keys, request logs, device or browser information, and IP-derived or similar security signals used to prevent abuse.
• Beta and support information: access-request email, review status, messages you send us, and information needed to respond or investigate an issue.

3. What is public

Your email address, password information, private security records, raw swipe history, and notification settings are not displayed publicly.

Your display name, username, profile image, biography, highest enabled badge, public ratings and reviews, selected game statuses, Top 3, tier lists, follows, reactions, reposts, and related activity may be visible to approved members and may appear in a share image or link preview when you or another member uses a sharing feature. Do not include private information in public fields.

4. Why we use the information

• Provide and secure accounts, verify beta access, authenticate members, and prevent fraud or abuse.
• Operate profiles, libraries, social feeds, reviews, tier lists, sharing, notifications, reminders, sale alerts, support, and moderation.
• Personalize discovery, swipe decks, suggested members, and other recommendations based on actions you choose to take.
• Maintain, debug, measure, and improve the Service and protect its availability and integrity.
• Meet contractual, legal, safety, accounting, and enforcement obligations and establish, exercise, or defend legal claims.
• Send marketing only if it is introduced and we have a lawful basis and any required consent.

5. Recommendations, profiling, and automated review

If you enable personalized recommendations, the Service uses ratings, swipes, saves, follows, selected genres, systems, and lists to infer gaming preferences and personalize discovery, list ideas, or suggested members. You can turn personalization off at any time in the Privacy Centre. These inferences are not used for targeted advertising.

Automated rules may filter game catalogue results or flag reviews and other content for moderation. They do not make decisions that produce legal or similarly significant effects about you. Account bans and other significant moderation actions remain reviewable by the site owner. You may contact us to ask about or contest a decision.

6. How information is obtained

Most information comes directly from you or from your activity in the Service. If you choose Twitch sign-in, account information comes from Twitch with your authorization. Technical information is generated when you connect. Other members may provide information when they follow, react to, repost, or report content.

Game metadata and artwork come from IGDB and other game-data sources, and are not treated as personal information about members.

7. Service providers and disclosures

We do not sell personal information. We disclose only what is reasonably necessary to operate the Service, follow your instructions, protect members, complete a business transfer subject to appropriate safeguards, or comply with law.

• Cloudflare and the Sites hosting service: hosting, content delivery, database, file storage, security, and encrypted recovery storage.
• Twitch: optional account authentication and authorization; IGDB: game metadata and artwork.
• Resend and email-delivery providers: sign-in codes, account, security, and requested notification messages.
• Browser or operating-system push services: delivery of notifications you enable.
• YouTube: privacy-enhanced video playback only after you choose to play an available trailer.
• OpenAI: translation of game descriptions supplied by the game-data service; member reviews, account profiles, and private account data are not sent for this purpose.
• CheapShark, Frankfurter, and external retailers: deal links and currency information. A retailer receives information under its own policy when you choose to leave the Service.
• Authorities, advisers, or affected parties when reasonably necessary to comply with law, protect safety or rights, investigate abuse, or respond to a valid legal process.

8. Processing outside Québec

Some providers may process or store information elsewhere in Canada, the United States, or other countries, where it may be subject to local law. Before entrusting personal information outside Québec, we must assess relevant privacy factors and use written contractual or other safeguards that provide adequate protection.

9. Retention and deletion

We keep personal information only as long as reasonably needed for the purposes described above, legal obligations, dispute resolution, security, and recovery. Live account and community information is generally kept while the account is active. Short-lived sign-in and verification records expire automatically.

During beta, encrypted recovery snapshots are scheduled as seven daily, four weekly, and twelve monthly recovery points. Deleted information may remain in protected backups until the applicable recovery point rotates out, and will not be restored to active use except for disaster recovery.

Account reset removes the live member profile and associated social data covered by that tool. Beta eligibility, credential, fraud-prevention, audit, or legal records may remain where necessary. Contact the Privacy Officer for full deletion or a clear explanation of information that must be retained.

10. Security

We use measures appropriate to the information handled, including encrypted transport, secure session cookies, salted password hashing, restricted administrative tools, access controls, moderation logs, and encrypted off-site recovery copies. No internet service is completely secure, so we cannot guarantee that an incident will never occur.

If a confidentiality incident creates a risk of serious injury, we will take reasonable steps to reduce harm and provide notices and reports required by law.

11. Your choices and rights

• Access personal information we hold about you and learn how it has been used or disclosed, subject to lawful exceptions.
• Correct incomplete or inaccurate information.
• Withdraw consent where processing depends on consent, understanding that some features may then stop working.
• Change profile, notification, language, theme, and sharing choices through available controls.
• Use the in-site Privacy Centre to request access, correction, export, de-indexing, deletion, consent withdrawal, or submit a privacy complaint. You may also contact the Privacy Officer by email.
• Request deletion, de-indexing, or an explanation of an automated or moderation decision where applicable law provides that right.
• Complain to the Privacy Officer and, if unresolved, to the Commission d’accès à l’information du Québec or another competent privacy regulator.

12. Children

The Service is not intended for children under 14 and we do not knowingly collect their personal information. If you believe a child under 14 has provided information, contact the Privacy Officer so the account can be investigated and appropriate action taken.

13. Changes to this Policy

We will update this Policy when practices or legal requirements change. Material changes will be highlighted through the Service or sent to the account email where required. New consent will be requested if information is to be used for a materially new purpose that requires it.