Privacy

This page explains which data steamlense stores, why, and for how long. The short version: browsing needs no account and leaves no cookie. Everything beyond that — an account, the newsletter, the watchlist — is something you switch on yourself.

Who is responsible

Full details are in the imprint.

Visiting the site

You can read every public page without an account, and nothing is set in your browser while you do. There is no tracking cookie, no analytics service and no advertising network.

• Server log entries are written by the hosting provider: IP address, time, requested URL and browser identification. They are needed to deliver the page and to recognise abuse, and the provider keeps them for a short period only. Legal basis: Art. 6(1)(f) GDPR, our interest in a working and defensible server.
• A page-view counter. Game and tag pages increment a number. It records that a page was viewed and nothing about who viewed it — no IP address, no identifier, no session is stored alongside.
• Rate limiting and the login log. Repeated login attempts and API calls are counted per caller, identified by a SHA-256 hash of the IP address; the address itself is never written down. A failed login also records which address was tried, because locking an account after too many attempts is otherwise not possible. These entries are deleted automatically after 30 to 90 days. Legal basis: Art. 6(1)(f) GDPR.

Fonts and content from other servers

Fonts come from this server. Your IP address is not handed to a font CDN to render text. Game header images, screenshots and trailers are loaded straight from Valve's content servers (steamstatic.com, akamaihd.net); your browser contacts those hosts, so they see your IP address. Showing Steam media without that is not possible.

If you create an account

An account is voluntary and gives you the watchlist, price and release alerts, the weekly summary and API keys. We store:

• Your email address, which also identifies the account.
• Your password as a hash (bcrypt). The plain password is never stored.
• The time you confirmed your address and the time you agreed to this policy.
• A display name and avatar URL, if an account was created through a social login that supplied them.

Registration is only complete once you click the link in the confirmation mail. That step exists so nobody can register a stranger's address. Legal basis for all of the above: Art. 6(1)(b) GDPR — we cannot run the account without it.

Staying logged in

After a successful login your browser gets one cookie. It holds a random value; the server keeps only a SHA-256 hash of it, together with a coarse browser fingerprint and a hash of your IP address. A stolen cookie is therefore not enough on its own. This cookie is strictly necessary for the login and needs no consent (§ 25(2) TDDDG). Logging out deletes the session.

The administration area at /admin works the same way and is not open to visitors.

Watchlist and alerts

Games you put on the watchlist are stored with your account, together with the alert thresholds you set — a target price, a release date, a review count. When a threshold is met we send you a mail. The list says something about your interests, so it is visible to you alone and is deleted with the account.

The weekly summary

The newsletter works with double opt-in. We store your address, the date of the request, which form it came from, and the date you confirmed. The confirmation link is the proof of consent; without the click no mail goes out. Legal basis: Art. 6(1)(a) GDPR.

Every mail carries an unsubscribe link that works without logging in. After you unsubscribe, the address stays on file marked as unsubscribed, so a later request has to be confirmed again. Mails are sent from our own mailbox at the hosting provider; no newsletter service is involved, and there is no open or click tracking.

API keys

A key is shown to you once and stored as a hash. Alongside it we keep the time it was created, the time it was last used, and a request count for the plan's quota. Requests are counted per key, not per IP address. You can revoke a key at any time in your account.

Where the game data comes from

Publicly available data from Valve's Steam APIs and from SteamSpy. It describes games, not people. Developer and publisher names appear as Valve publishes them; where that name belongs to a one-person studio, it is public business information taken from the store page.

Who else processes the data

• Hosting and mail: ALL-INKL.COM – Neue Medien Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. Servers are in Germany, and a data processing agreement under Art. 28 GDPR is in place.

Nothing is sold, and nothing is passed on for advertising.

How long it is kept

• Server logs: short-term, set by the hosting provider.
• Account data: until you delete the account.
• Unconfirmed registrations and newsletter requests: the confirmation link expires, and the entry is of no further use after that.
• Newsletter addresses: until you unsubscribe, then only the fact that you did.
• Page-view counts: indefinitely, as they contain no personal data.

Your rights

Under the GDPR you can ask for access to your data (Art. 15), correction (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and a copy in a portable format (Art. 20). You can object to processing based on our legitimate interest (Art. 21), and you can withdraw consent to the newsletter at any time without giving reasons.

For any of these, write to team@steamlense.com.

Deleting your account needs no request: the button sits at the bottom of your account page. It removes your address, your password, your watchlist with its alerts, your API keys and your newsletter subscription straight away. What stays is the subscription history required for accounting, with your data stripped out of it, and the security log of login attempts, which is kept for 30 to 90 days and then deleted automatically.

You may also complain to a supervisory authority. For this site that is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 27, 91522 Ansbach, Germany.

No profiling

There is no automated decision-making and no profiling. Alerts fire on the threshold you set yourself, and the estimates on this site are calculated from Steam data about games — see how they are calculated.

This text describes the site as it is built, and it is kept in step with the code. It is not legal advice; if you operate this site commercially, have it reviewed.