Privacy Policy
Version 1.0 · Effective 2026-02-01
Who is responsible for your data
GLYPH is operated by FOUNDER INPUT REQUIRED — registered company or sole-trader name (FOUNDER INPUT REQUIRED — company registration number), FOUNDER INPUT REQUIRED — registered postal address, FOUNDER INPUT REQUIRED — country of establishment (EU/EEA). We are the data controller for the personal data described here.
Privacy questions and data requests: FOUNDER INPUT REQUIRED — privacy@yourdomain. We have not appointed a Data Protection Officer; privacy requests are handled by the address above.
What we process, why, and for how long
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Account and authentication | Email address, hashed password (handled by the authentication provider), account timestamps | Contract — we cannot provide an account without it | Until you delete your account |
| Public profile | Username, display name, avatar URL, bio | Contract — your profile is part of the service | Until you change or delete it, or delete your account |
| Gaming Passport (library, statuses, ratings, favourites, playthroughs) | Games you add, progress and intent status, 1–10 ratings, favourites, platform ownership | Contract — this is the core of the product | Until you remove the entry or delete your account |
| Steam connection and library import (optional) | SteamID, public Steam profile fields, owned games, playtime, last-played timestamps | Consent — you choose to connect Steam and can disconnect at any time | Until you disconnect Steam and/or delete your account |
| Gaming DNA and Predicted Rating | Derived taste profile computed from your own ratings and game metadata | Contract — the taste features you asked for | Recomputed from your ratings; deleted with your account |
| Legal acceptance records | Which version of the Terms you accepted and when | Legal obligation / legitimate interest — proving agreement to terms | For the life of the account |
Your public profile
Your username, display name, avatar and bio are readable by anyone using GLYPH — that is intentional, because GLYPH is a social gaming identity. Your email address, ratings-level account settings and connected-account credentials are never public. Do not put anything in your bio that you would not want publicly visible.
Steam connection
Connecting Steam is entirely optional and based on your consent. We use Steam OpenID, so you never give GLYPH your Steam password. If you connect, we store your SteamID, public Steam profile fields, and your owned games with playtime, so we can match them to games in our catalogue. You can disconnect Steam at any time; disconnecting stops further imports and marks the imported records as no longer asserting current ownership.
Analytics and tracking
We do not currently run any third-party analytics, advertising or tracking service: no Google Analytics, no Google Tag Manager, no PostHog, no tracking pixels. If we introduce product analytics in future, it will load only after you turn optional analytics on in Cookie settings.
Who else processes your data
- Supabase (via Lovable Cloud) — Database, authentication and server hosting. Data involved: Account email, profile, Passport data, Steam link records. FOUNDER INPUT REQUIRED — confirm hosting region and signed data processing agreement.
- Twitch / IGDB — Video game metadata provider. Data involved: Game search terms and game IDs only. Requests are made server-side; no account identifiers are sent.. Called only from server code using server-only credentials.
- Valve (Steam Web API + Steam OpenID) — Optional Steam account linking and library import. Data involved: Your SteamID, public Steam profile fields and owned-game/playtime data — only if you choose to connect Steam.. Called only from server code using a server-only API key.
We do not sell your personal data and we do not share it for advertising purposes. International transfer details for our hosting provider must be confirmed with that provider's current documentation.
Your rights under the GDPR
You have the right to access, rectify, erase, restrict and object to processing of your personal data, and the right to data portability. Where processing is based on consent, you may withdraw consent at any time.
- Access and portability: download a machine-readable copy of your GLYPH data from your account page.
- Erasure: delete your account from your account page. This permanently removes your profile, Passport, ratings, Gaming DNA and Steam import records.
- Rectification: edit your profile and Passport entries directly in the product, or contact us.
- Consent withdrawal: use Cookie settings, or disconnect Steam.
You can also contact us at FOUNDER INPUT REQUIRED — privacy@yourdomain. If you believe we have handled your data improperly you may lodge a complaint with your local supervisory authority; ours is FOUNDER INPUT REQUIRED — lead EU data protection authority.
Security
Access to your data is enforced at the database level: every table holding personal data restricts reads and writes to the owning account. Provider credentials (game metadata and Steam API keys) exist only in server-side code and are never exposed to the browser. No service can guarantee absolute security, but we handle reports promptly — email FOUNDER INPUT REQUIRED — security@yourdomain.
Children
GLYPH is not intended for children below the age of digital consent in their country. If you believe a child has created an account, contact FOUNDER INPUT REQUIRED — privacy@yourdomain.
Changes to this policy
We will update the version and effective date at the top of this page when this policy changes, and we will tell you in-product about material changes.