Privacy policy

GameLens runs GameLens and is the controller of your personal data. For any question about your data, write to [email protected].

• Browsing without an account. Every public page works without signing up. Like any web server, ours receives your IP address, browser type, the page you asked for and the time of the request. We use this only to deliver the site, keep it secure and fix errors. Our web server logs keep a shortened IP address and the page address without its query string.
• Sessions. While you use the site, its session record in our database holds your IP address, browser (User-Agent) and the time of your last activity, so we can keep you signed in and spot misuse.
• Account. If you register, we store your name, email address and a hashed password (we never see the password itself), plus passkeys and two-factor authentication settings if you turn them on. Repeated failed sign-ins are counted briefly per email and IP address to stop password guessing.
• Sign-in with Steam or Google (optional). If you sign in through Steam, Valve tells us your SteamID, and we read your profile name and avatar with the Steam Web API; Steam gives us no email or password. If you sign in with Google, Google tells us your Google account ID, name, email address (and whether it is verified) and profile picture. We store the provider, that ID, the name and the avatar link, use them only to sign you in, and delete them when you disconnect the account (Settings → Profile) or delete your GameLens account. We never receive your Steam or Google password.
• Game data. Player counts, prices, reviews and other figures come from public sources: Steam Web API, Steam Store and IsThereAnyDeal. They describe games, not people; we do not collect data about Steam users, except in the opt-in case below.
• Your Steam library, only if you opt in (Settings → Profile, under the linked Steam account; off by default). We then read, with the Steam Web API and your SteamID, the games you own with your playtime and last launch, and for games with achievements which ones you unlocked and when. This works only if your Steam game details are public. We use it only for anonymous totals on game pages (for example median playtime and the share of players with every achievement), shown only when at least 5 GameLens players count for that game; no name, avatar or library is ever shown. The data is refreshed about once a day. Switching the option off, disconnecting Steam or deleting your account deletes it at once. Legal basis: your consent, which you can withdraw at any time.

GameLens itself sets only what the site needs to work or what you chose:

• gamelens-session (2 hours) and XSRF-TOKEN keep you signed in and protect forms from forgery; remember_web_* (up to 400 days) only if you tick “Remember me”;
• gl_consent (6 months) stores your cookie choice;
• locale (1 year) remembers the language; appearance and sidebar_state remember the theme and the sidebar position; in local storage, appearance and gamelens.currency keep the theme and the currency you picked.

Cloudflare, which protects the site, may set __cf_bm and cf_clearance to tell people from bots. These cookies are necessary and do not require consent. Statistics and advertising cookies (below) are set only after you allow them. You can delete or block cookies in your browser at any time; the site may then forget your choices.

On your first visit a banner asks whether you allow statistics (Google Analytics) and, where the site shows ads, personalised advertising. “Reject all” is as easy as “Accept all”. Until you choose, nothing from Google Analytics is loaded and Google tags run in Consent Mode with all storage denied. You can change or withdraw your choice at any time with the “Privacy settings” link at the bottom of every page; withdrawing removes the Google Analytics cookies. If your browser sends a Global Privacy Control signal, we treat it as an objection to personalised ads.

Only if you allow statistics, we use Google Analytics 4 to count visits and learn which pages are useful. It then sets the _ga and _ga_* cookies (up to 2 years) and sends Google your IP address (Google does not store it), device and browser details and the pages you view. Sign-in, registration, password reset and account pages are never measured. Google signals and ad personalisation are turned off for our property, and Google keeps the data for the retention period we set (at most 14 months).

Learn more in How Google uses information from sites that use its services.

GameLens is free to use; advertising pays for the servers and the data. Ads are served by Google AdSense. Google and its partners use cookies and similar technologies to show ads, limit how often you see the same ad and measure results, and may show personalised ads based on your visits to this and other websites.

In the European Economic Area, the United Kingdom and Switzerland, Google’s consent message (a certified IAB TCF consent platform) asks for your consent first; elsewhere our banner does. Without consent, Google shows only non-personalised ads. You can change your choice at any time with “Privacy settings” at the bottom of every page.

You can manage ad personalisation in Google’s My Ad Center or turn off other vendors’ cookies at aboutads.info. How Google uses advertising data: Advertising at Google.

Where the GDPR or similar laws apply, we rely on:

• your consent for statistics, for personalised ads and for their cookies;
• the performance of a contract for your account and its settings;
• our legitimate interests for running the site securely, server logs, protection against password guessing and non-personalised ads that keep the service free.

• Our hosting provider, which stores the site and its database.
• Cloudflare, Inc., which passes all traffic to the site and protects it from attacks; it sees your IP address, browser and the pages you request.
• Valve (Steam) and its content delivery network: game images on our pages load from Steam servers, which receive your IP address and browser details.
• Valve (Steam) and Google, only if you choose to sign in with them: your browser opens their sign-in page, and they confirm to us who you are.
• Google, for statistics and advertising, only as described above.

Cloudflare, Valve and Google may process data outside your country, including in the United States, under the EU–U.S. Data Privacy Framework and standard contractual clauses. We do not sell your personal data for money.

Under California law (CCPA/CPRA) and similar laws in other US states, letting Google use online identifiers and browsing activity for personalised (cross-context behavioural) advertising can count as “sharing” personal information. You can opt out at any time with the “Do not sell or share my personal information” link at the bottom of every page, or by sending a Global Privacy Control signal. We will not treat you differently for using your rights.

• Account data: until you delete your account (Settings → Profile → Delete account). Your sessions and password reset requests are deleted with it.
• Sessions: until two hours after your last activity, or until you sign out.
• Password reset links: valid for 60 minutes; expired requests are deleted every hour.
• Server logs: 14 days, with shortened IP addresses.
• Your cookie choice: 6 months, then we ask again. Other cookies: for the periods above, or until you delete them.

Depending on where you live (for example under the GDPR, UK GDPR, LGPD or the CCPA), you can ask us to give you access to your data, correct or delete it, give you a copy, restrict or object to its processing, and you can withdraw consent at any time without affecting earlier processing.

Signed in, you can do much of this yourself in Settings → Profile: “Download my data” gives you a copy of your account data (JSON), and “Delete account” erases it. For anything else write to [email protected]; we reply within one month.

You also have the right to complain to the data protection authority where you live.

GameLens is not aimed at children under 16, and we do not knowingly collect their data: to create an account you confirm that you are at least 16. If you believe a child has given us personal data, write to us and we will delete it.

We update this policy when the site or the services we use change. The date at the top shows the current version; we will announce significant changes on the site.