Privacy Policy

This Privacy Policy explains how Savepoint (“we”, “us”, “controller”) processes personal data when you use www.savepoint.life, our APIs, and related apps (the “Service”). It is written to meet the EU General Data Protection Regulation (GDPR) and the ePrivacy rules for cookies.

Controller contact: savepoint62@gmail.com. If we appoint an EU representative or Data Protection Officer, we will update this page.

1. Personal data we process

Account & profile

• Email, username, display name, hashed password (if you use password login)
• Bio, avatar, banner, and privacy preferences
• Identifiers from sign-in providers you choose (Google, Discord, Microsoft / Xbox, Steam where enabled)
• Passkey / WebAuthn credentials you register

Activity & social

• Library entries, ratings, reviews, comments, lists, follows, friends
• Reports you submit; moderation-related records
• Notification preferences and in-app notifications
• Forum posts and votes where you participate

Messages

Friend direct messages are end-to-end encrypted on supported clients. We store ciphertext and delivery metadata (conversation membership, timestamps). We do not store message plaintext when encryption works as designed. Device keys stay on your devices (with optional sealed backup for multi-device sync).

Connected libraries

If you link Steam, PlayStation (PSN), Xbox, or another supported source, we process game ownership, playtime, and (for PSN) trophy progress to sync your library. PSN linking uses a short-lived NPSSO you paste once; we store an encrypted refresh token and do not keep the NPSSO.

Technical & security data

• IP address and user-agent used for security, abuse prevention, session integrity, and (sampled) first-party traffic logs
• Server logs needed to operate and debug the Service

2. Purposes & legal bases (GDPR Art. 6)

• Contract (Art. 6(1)(b)) — create and run your account, authenticate you, provide library sync, social features, messaging, and settings you request
• Legitimate interests (Art. 6(1)(f)) — secure the Service, prevent spam/abuse, moderate content, improve reliability, and keep short-lived traffic logs for operations (balanced against your rights)
• Consent (Art. 6(1)(a)) — optional features that require it (for example non-essential cookies or marketing, if we ever add them — we will ask first)
• Legal obligation (Art. 6(1)(c)) — respond to lawful requests and keep records where the law requires

3. Cookies & similar technologies

We use strictly necessary session cookies (and similar storage) so you can sign in and stay signed in. These are required to provide the authenticated Service and do not require consent under the ePrivacy Directive.

We do not currently use third-party advertising or analytics cookies. If that changes, we will present a consent choice before setting non-essential cookies. See our on-site cookie notice for a short summary.

4. Processors & recipients

We use service providers that process data on our instructions:

We may also share data with other users according to your privacy settings, or with authorities when required by law or to protect users and the Service. We do not sell your personal data.

5. International transfers

Some providers process data outside the EEA (for example in the United States). Where GDPR applies, we rely on appropriate safeguards such as the providers’ Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms, plus the technical measures described in this Policy.

6. Retention

• Account & content — kept while your account is active; deleted when you delete your account (or we delete it for violations), subject to short backup/cache windows
• Traffic logs (IP, path, user-agent) — automatically purged after 90 days
• Security / ban records — kept as long as needed to enforce bans and protect the Service
• Transactional email logs — retained by the email provider under their policies for delivery troubleshooting

7. Your rights (EEA / UK)

Where GDPR (or UK GDPR) applies, you may:

• Access and port your data — download a copy from Settings → Your data & privacy, or email us
• Rectify inaccurate data — edit profile/settings, or contact us
• Erase your account — Settings → Delete account, or email us
• Restrict or object to certain processing based on legitimate interests
• Withdraw consent where processing is based on consent (without affecting prior lawful processing)
• Lodge a complaint with your local supervisory authority (for example your EU member-state DPA)

We will respond to requests without undue delay and within one month where required by law. We may need to verify your identity first.

8. Children

Savepoint is not directed at children under 16 in the EEA (or the higher digital-consent age in your country, if applicable). If you believe a minor has created an account, contact us and we will take appropriate steps, including deletion.

9. Security

We use industry-standard measures including HTTPS, hashed passwords, encrypted tokens for linked platforms, access controls, and moderation tooling. No method of transmission or storage is 100% secure.

10. Automated decisions

We do not make solely automated decisions that produce legal or similarly significant effects about you. Automated image checks may flag uploads for moderation.

11. Changes

We may update this Policy from time to time. We will revise the “Last updated” date when we do. Material changes may also be announced in-product where appropriate.

12. Contact

Privacy and data-protection requests: savepoint62@gmail.com. See also our Terms of Service.