Privacy policy

This site is run by The Gaming Marketplace (“we”, “us”). We are responsible for the personal information described in this policy. You can reach us about anything privacy-related at tgmarket2024@gmail.com.

When you visit the site (everyone)

• Technical request data. Like almost every website, our web server records each request: your IP address, the page address you asked for (including anything you typed into search), the time, your browser’s user-agent string and the referring page. This includes the addresses of one-time links we email you, which contain a single-use code; those links expire once used or after an hour. We use this to keep the site running, investigate errors and protect it against abuse.
• Rate-limit data. To stop automated abuse, we briefly hold IP addresses in memory to count requests. If an address goes over a limit, we note the IP address and the page or action in our server logs.
• We don’t use analytics, advertising, tracking pixels or third-party scripts, and we don’t build profiles of visitors.

When you create and use an account

• Email address: to sign you in, confirm your account, and send password-reset and email-change messages. We don’t send marketing email.
• Username: you choose one when you sign up. Usernames are public: anyone can check whether a username is taken, you can sign in with it, and it may be shown to other visitors next to features you use on the site. Don’t use your real name, or anything else you want to keep private, as your username. We also keep the date you last changed it, so we can apply the limit on changes.
• Password: stored only in hashed form by our authentication provider (see below). We never see or store it in readable form. When you choose a password, our provider checks it against a public list of passwords exposed in data breaches. That check uses only a short, anonymous fragment of a hash of your password, never the password itself.
• Two-factor authentication (optional): if you turn it on, our authentication provider stores the secret key your authenticator app uses, so it can check your codes. We also give you ten one-time recovery codes. We show them to you once and store only a scrambled (hashed) version. That lets us check a code you enter, but nobody, including us, can read your codes back from what we store.
• Saved games: the games you add to Your Games and the date you added each one. Your list is private: only you can see it when signed in, and we use it only to show it to you.
• Subscription status: whether your account has a paid plan, the date it was granted and, if it has one, the date it ends. It is set automatically from your Patreon membership if you have linked one, or by hand from our records of who has subscribed, and we use it only to decide which version of the site your account sees and to show your plan on your account page. We keep it for as long as you have an account.
• Patreon membership (optional): if you link a Patreon account, we receive from Patreon your Patreon user id, your membership id for our page, your membership status, whether your last payment went through, the dates of your last and next payment, which of our tiers you have and whether it is a free trial. We use it only to decide whether your account gets paid access and to show the status on your account page. We don’t ask Patreon for your email address and don’t receive your payment details. Patreon’s notifications to us may include your name and email address; we don’t keep them. We don’t keep anything about patrons who haven’t linked an account.
• Account records: when your account was created and confirmed, and your active sign-in sessions.

We use account information only to provide your account and keep it secure. We don’t sell it, rent it, or use it for advertising.

We use a small number of cookies, all of them strictly necessary for signing in. They’re only set if you use the sign-in, sign-up, password-reset or account pages. If you just browse, we set no cookies at all. We don’t use analytics, advertising or third-party cookies. All of our cookies are “HTTP-only” (scripts on the page can’t read them), are sent only to thegamingmarketplace.com over a secure connection, and are not shared with anyone. Because they’re essential to a feature you asked for, we don’t ask for cookie consent. Blocking them only means you can’t sign in.

Signing out deletes the sign-in cookies.

Game images: the game artwork on our pages is loaded by your browser directly from Steam’s image servers (run by Valve Corporation and its content delivery network). So Valve receives your IP address and browser information when the images load. It isn’t sent the address of the page you’re on, though the images requested show which games were displayed. Valve’s own privacy policy covers that.

• Web server logs (IP address, page address, browser): up to 30 days, then deleted automatically. They may be deleted sooner if the logs reach their size limit.
• Application logs (which contain an IP address only when a rate limit was hit): up to 30 days. They may be deleted sooner if the logs reach their size limit.
• In-memory rate-limit counters: minutes to hours. They’re never written to disk and are cleared whenever the server restarts.
• Patreon link data: kept while your account is linked. Unlinking on your account page, or deleting your account, removes it. The temporary codes that start a link are deleted after use or after 10 minutes.
• Account information: for as long as you have an account. When you ask us to delete your account (see “Your rights and choices”), we delete your email, username, password hash, saved games, subscription status, Patreon link data, two-factor settings and recovery codes, along with the security records tied to your account, within 30 days.
• Our authentication and email providers keep their own short-lived system logs, which may retain records for a limited period under their retention policies, even after your account is deleted.
• Emails we send are kept by Resend, our email provider, for a limited period under its own retention policy. Our emails don’t use open or click tracking.

We don’t sell your personal information or share it with anyone for their own use. These service providers help us run the site and process data on our behalf, under their own terms and security measures:

• Supabase (database and authentication): stores your account information and our game data, and runs sign-in and two-factor checks. Our servers talk to Supabase directly and your browser never does, so Supabase doesn’t get your IP address or browser details from us. Hosted in the United States (AWS us-east-1, Virginia).
• Resend (email delivery): sends our confirmation, password-reset and email-change emails, so it receives your email address and the content of those messages.
• Amazon Web Services (hosting): our web server and its logs run on AWS in the United States (Virginia).
• Patreon (membership and payments, only if you link an account): when you link, you sign in on Patreon’s site and Patreon tells us the membership details described above. Patreon handles your payment under its own privacy policy, as an independent provider and not on our behalf.
• Have I Been Pwned (password safety check, through Supabase): receives only an anonymous fragment of a password hash, as described above.

Other third parties: when your browser loads game artwork, it connects to Valve/Steam (see “Cookies” above). When you click a news headline, you go to the publisher’s site, which learns that you came from thegamingmarketplace.com (but not which page), and its own privacy policy applies there. Our domain’s DNS is hosted by Hostinger, which doesn’t see the pages you visit.

We may disclose information if the law requires it, or to protect the site and its users from fraud or abuse.

• The whole site is served over HTTPS only.
• Passwords are stored only as hashes by our authentication provider. Our application never logs passwords, two-factor codes, recovery codes or sign-in tokens.
• Optional two-factor authentication with an authenticator app. Recovery codes are stored only as keyed hashes, and each one works once.
• Sign-in cookies are HTTP-only and limited to our site. Sign-in attempts are rate-limited, and sign-in and password-reset responses don’t reveal whether an email address has an account.
• Our application logs never contain your email address, username or password.

No system is perfectly secure. If we learn of a breach that affects your information, we’ll tell you as the law requires, using your account email.

On your account page you can see and change your email address, username and password, see your plan, link or unlink Patreon, and turn two-factor authentication on or off. Unlinking doesn’t cancel your Patreon membership. On Your Games you can see and remove the games you’ve saved.

To get a copy of your account information, correct it, or delete your account, email tgmarket2024@gmail.com from the address on your account. There’s no self-service delete button yet. We’ll confirm the request really comes from you, then act on it within 30 days. Deleting your account permanently removes your sign-in details, username, saved games, subscription status, Patreon link data, two-factor settings, recovery codes and the security records tied to your account.

If you’re in the European Economic Area or the United Kingdom, the GDPR and UK GDPR give you rights to access, correct and delete your personal data, to restrict or object to how we process it, and to data portability. We rely on two legal bases: providing the account you asked for (contract), and our legitimate interest in keeping the site secure and working (server logs and rate limits). You can also complain to your local data protection authority.

If you’re in California, or another US state with a consumer privacy law, you have the right to know what personal information we collect, to have it deleted or corrected, and not to be discriminated against for using these rights. We don’t sell or “share” personal information as those laws define it, and we don’t use it for targeted advertising.

We don’t track you across other sites, so there’s nothing for “Do Not Track” or Global Privacy Control requests to switch off.

Anyone can browse the site, but accounts aren’t intended for children under 16. If you’re under that age, please don’t create an account. If you believe a child has created one, email tgmarket2024@gmail.com and we’ll delete it.

We and our service providers process data in the United States: our hosting is on AWS in Virginia, our database and authentication provider (Supabase) runs in us-east-1, our email provider (Resend) is US-based, and Patreon, if you link an account, is US-based. If you use the site from outside the US, your information is transferred to and processed in the US, where privacy laws may differ from yours. Where the law requires it, we rely on our providers’ standard safeguards for these transfers, such as Standard Contractual Clauses.

We’ll update this policy when the site changes how it handles information, for example when we add new features or service providers. The “Last updated” date at the top shows when it last changed. If a change is significant, we’ll email account holders before it takes effect.

Questions, requests or complaints about privacy: tgmarket2024@gmail.com.