What we keep, and why

Who we are

The Games Wall (thegameswall.com) is run by the business below. We decide what happens to the personal information described here, which makes us its controller under UK data protection law. For questions, or to ask us to do anything with your information, write to:

What we keep

Your account

Your email address. If you sign in with Google, also the name and picture Google shares. The sign-in service records when you sign in and the IP address you signed in from, to keep accounts safe. We need these to let you sign in and to show your plots and posts as yours (to provide the service you asked for).

That you passed the age check

Before you make an account we ask the month and year you were born. Our server checks it and keeps only the date the check was passed. Your birthday is never stored. If the answer shows you’re under 16, we delete the account straight away, here and at Clerk. We do this to keep under-16s off the site (our legitimate interest).

What you add to the wall

Your game’s name, store links, description and picture, your plots, your votes for the Guest Spot, and any team board posts, including the contact details you choose to put on a post. Games, plots and posts are public, because that’s what they’re for. Vote counts are public too; each vote is stored with your account’s ID number, not your name or email.

What you post on the feed

Your profile (handle, name, bio and picture), your posts, replies and reposts, the pictures and clips in them, and the games you tag. These are public, like a profile and posts on any social site. Who you follow is public too, and so is how many people like and repost each post. Which posts you liked and which games you follow are only shown to you. If you report a post, we keep the report and the reason with your account’s ID number; only we see it. We need all this to run the feed you chose to use (to provide the service you asked for).

Hearts and comments on games

When you love a game, we store the heart with your account’s ID number. Everyone sees how many hearts a game has, but only you see which games you’ve loved. A comment on a game shows your handle, name and picture, and is public. If you report a comment, we keep the report and the reason with your account’s ID number; only we see it. We need these to run the hearts and comments you chose to use (to provide the service you asked for).

What you like to play

The kinds of games you pick after signing up, like Roguelike or Puzzle, and the genres you say a post is about. Your picks are only shown to you, and we only use them to choose the posts on your For you tab. A post’s genres are public, like the post. We need your picks to run the For you tab you asked for (to provide the service you asked for).

Ads on the feed

Some posts on the feed are ads, which game developers book. Everyone sees the same ads: we don’t choose them using anything about you. To tell each advertiser how their ad did, we count its views and clicks. If you’re signed in, we note your account’s ID number against each ad you see, so you’re only counted once, and delete that a week after the ad ends. If you’re not signed in, we only count the view or click. So the same person isn’t counted twice, we also keep a note of your account’s ID number, or part of your IP address if you’re not signed in, for half an hour. It’s scrambled with a secret key before it’s stored, so it can’t be turned back into who you are, and it’s cleared out of our database within a day. Advertisers only see totals, never who saw or clicked their ad (our legitimate interest in counting fairly what advertisers booked).

Security records

Like any website, our hosting records requests to the site, including IP addresses, to keep it running and stop abuse. To stop anyone overloading the site, we also count each address’s requests for a few minutes, and how much each account posts, likes and books. Vercel keeps the count of requests. The rest is kept in our database under a scrambled form of the address or account, which can’t be turned back into it, and is cleared out within a day (our legitimate interest in keeping the site safe and working).

Emails and reports

If you email us or report something, we keep your message, your email address and what we did about it. If you send a copyright notice, or reply to one, we pass a copy to the person it concerns, as the copyright page explains. We need this to deal with your message and to keep a record in case of a dispute (our legitimate interests, and the law on copyright notices).

We don’t sell your information. The ads on the feed aren’t targeted at you, and we don’t use analytics, tracking pixels, or anything that records your screen.

What stays in your browser

The only cookies are the ones that keep you signed in. Clerk, our sign-in service, sets them (named __session, __client_uat and __client) when you sign in, and they go with each request to us and to Clerk. They’re needed for signing in, so we don’t ask first, and there are none for advertising or analytics.

The site also keeps these few things in your browser’s storage, each for something you’re using:

• games you save, and the games you’ve opened and how many times, for your saved list and your trail;
• where to take you back to after signing in, and a plot you picked before signing in;
• your age check answer, until our server has checked it (an hour at most), and after an answer under 16, a note that keeps the sign-up form closed on this browser for a day.

None of this storage is sent to us. Clearing this site’s data in your browser removes all of it, and signs you out.

Who else sees it

These companies handle information for us, only to run the parts of the site listed:

Clerk

Our sign-in service. It keeps your email address (and what Google shares, if you use Google), sends the sign-in codes, and records when and from where you sign in. The sign-in window loads from Clerk, so it sees your IP address. It uses Cloudflare to tell people from bots when you sign up.

Google

Only if you choose to sign in with Google. Clerk passes that sign-in to us.

Supabase

Our database. It stores your account’s ID number, your age check, and everything you add. Your browser talks to it directly, so it sees your IP address.

ImageKit

Stores the pictures and clips you post on the feed, and sends them to the people who see your posts. Your browser uploads them to ImageKit directly, and loads them from it, so it sees your IP address.

Vercel

Hosts the site and sees the requests your browser makes to it, including your IP address.

The stores whose pictures we show

Game pictures load straight from the store they came from: Valve (Steam), Microsoft (Xbox), Sony (PlayStation), Nintendo, Apple (App Store) and Google (Google Play). As with any picture on the web, your browser asks their servers for it, so they see your IP address and that the picture is on this site. We send them nothing about you.

When you add a game, our server reads its Steam, store or Kickstarter page. That sends them the link, and nothing about you.

Some of these companies handle data outside the UK, including in the United States. When they do, they protect it as UK law requires, using the UK’s adequacy regulations (such as the UK-US data bridge) or the UK’s approved contract terms.

We may also share information with the police, courts, Ofcom or other authorities when the law requires it, or when it is needed to deal with illegal content or to protect someone from serious harm. We only share what is needed.

How long we keep it

• Your account, what you’ve added, and the kinds of games you like, until you delete it or ask us to. When you change what you like, the old picks are gone.
• Your hearts and comments on games, until you delete them or your account. Deleting a comment takes it down for everyone.
• Team board posts come down after 30 days. We keep them, hidden, until you delete them or your account.
• Which ads your account has seen, until a week after each ad ends. The totals it adds to are kept, with nothing about who.
• The scrambled counts in our database, cleared out within a day.
• Hosting records for the short time our host keeps them.
• Emails and reports, for as long as we need to deal with them, and then for up to two years in case of a dispute.

Your rights

You can ask for a copy of what we hold about you. You can ask us to correct it, delete it, stop using it, or send it to you in a format another service can read. You can also object to us using it where we rely on our legitimate interest. Email us from the address on your account and we’ll reply within a month. To delete your account, ask us the same way.

The age check is automatic, and an answer under 16 closes the sign-up. Posts and comments that several people report are hidden automatically until we’ve looked at them. We make no other decisions about you by computer alone that have a legal or similarly significant effect. If you think either got it wrong, email us and a person will look again.

You don’t have to give us any of this information. But we can’t make you an account without an email address or a Google sign-in, or without the age check.

If you’re unhappy with how we’ve handled your information, you can complain to us using the details at the top of this notice. We’ll acknowledge your complaint within 30 days, look into it, and tell you what we found. You can also complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

Keeping it safe

We use the security measures of the services listed above, and only people who need to see your information to run the site can see it. No system is perfectly secure. If something goes wrong with your information in a way that puts you at risk, we’ll tell you, and the Information Commissioner’s Office, as the law requires.

Children

You must be 16 or older to have an account. Anyone can look around without one. If you think a child under 16 has an account, email us and we’ll delete it.

Changes

When this notice changes, the date at the top changes too. If it’s a change that matters to you, we’ll say so on the site first.