Privacy & cookies

What we store

Your account: a username, a hash of your password (never the password itself) and your email address, which is used only to recover the account and to confirm it is yours.

What you choose to add: an avatar link, your country, favourite and pinned games and achievements, and your groups.

Linked accounts: your RetroAchievements username and Web API key, and your Steam ID and display name, so your progress can be fetched. The API key never leaves our server.

Security records: the IP address (and username, for sign-ins) of failed sign-ins, sign-ups and password reset requests, kept for one day to stop abuse.

Why

To provide the service you signed up for, to keep it secure, and — only if you accept — to measure visits with Google Analytics.

Cookies and local storage

Necessary, no consent needed: a session cookie that keeps you signed in, and local storage for your language, theme and cookie choice.

Analytics, only if you accept: Google Analytics cookies (_ga, _ga_*), which last up to two years. Google is told the page path, never the rest of the address. You can withdraw consent at any time from "Cookie settings" at the bottom of the page: analytics stops at once and its cookies are deleted.

Who else handles it

Vercel hosts the site, Resend sends our emails, Google provides analytics (only with your consent), and RetroAchievements and Steam receive the requests needed to show your data. Some of them are in the United States; those transfers rely on the EU–US Data Privacy Framework or the European Commission’s standard contractual clauses.

Administration

The site’s administrator can see your account details (username, email, country and linked accounts) and can correct them, link or unlink your RetroAchievements and Steam accounts, or delete the account: to give you support, to act on your requests, or when the terms of use are broken. Each of those actions is recorded with who did it and when, and the record is kept for a year.

If the email on your account changes, whoever changes it, the old address gets a notice.

How long

Account data stays until the account is deleted, and everything linked to it goes with it. Password reset links expire after an hour, security records after a day.

Your rights

You can access, correct, export or delete your data, object to or restrict how it is used, and withdraw consent. Most of it can be edited from your account page, where you can also delete your account; for anything else, write to us.

If you think your data has not been handled properly, you can complain to the Spanish Data Protection Agency (aepd.es).