Privacy Policy

Firetale is a social game journal at firetale.net. For data protection purposes, Firetale is the data controller for the information described here. You can reach us at info@firetale.net.

When you create an account

• Your email address and a password, or a Google account if you sign in with Google. Passwords are hashed by our authentication provider and are never visible to us.
• A username, and optionally a display name, bio, avatar and banner image.

When you use Firetale

• The games you log, along with any status, score, review, platform, dates, replays and spoiler flags you record.
• Lists you create, posts, comments, likes, reposts, bookmarks and poll votes.
• Follows, blocks and mutes.
• Direct messages and community chat messages, including any images you attach.
• Reports you submit about other people’s content.

Generated from your activity

• A taste profile (“Gamer DNA”) derived from the games you rate: genre lean, how niche your taste runs, completion rate, era lean and scoring tendency.
• Similarity scores between your ratings and other members’, used for player suggestions.

If you choose to connect or import

• Your Steam ID and owned games list, if you link Steam. We use Steam’s OpenID sign-in, so we never see your Steam password.
• The contents of any Backloggd or Firetale export file you upload, for as long as the import job needs it.

Technical

• Standard server logs from our hosting provider, which include IP addresses, for security and debugging.
• A web push subscription, only if you turn on push notifications.

We do not run advertising trackers. We use Google Analytics to understand which pages people use, but only if you allow it in the cookie choice; you can turn it off on the Cookie Notice page.

• To run your account and show you your library, feed and messages. This is necessary to provide the service you signed up for.
• To make recommendations: matching you with players whose ratings resemble yours, and suggesting games. This is our legitimate interest in making the product useful, and you can make your profile private at any time.
• To keep the site safe: handling reports, blocks and bans. Legitimate interest.
• To send you notifications you have asked for, including release reminders and web push. You control these in settings.

Firetale is a social site, so a lot of what you record is public by design: your profile, logs, ratings, reviews, lists and posts can be read by anyone, including people without an account, and may appear in search engines.

• Setting your profile to private hides your activity from people who do not follow you.
• Individual lists can be made private.
• Direct messages are private to the participants and are protected at the database level.
• Your email address is never shown to other members.

When you delete a message it disappears for everyone straight away. The text itself is erased 30 days later. Messages that have been reported are kept for up to 180 days so a complaint can still be looked into, and we keep them longer where the law requires it.

We may access message content where necessary to investigate safety or abuse issues. Access is restricted and recorded.

Firetale runs on Vercel with a Supabase database, both hosted in Frankfurt, Germany. Your data stays in the EU. Uploaded images are held in Supabase Storage and served through a CDN.

We do not sell your data. We share it only with the services needed to run Firetale:

• Vercel: hosting.
• Supabase: database, authentication, file storage and realtime messaging.
• Google: if you choose to sign in with Google, and Google Analytics if you allow it.
• Hostinger: sending email, such as the weekly digest and message alerts.
• Steam: only if you choose to link your Steam account.

Game metadata and artwork come from IGDB. We send them no personal information about you.

There is one further situation in which we may hand over your information, and it is important enough to have its own section below.

We may disclose your information to courts, regulators, law enforcement or other authorities where the law requires it. No online service can promise otherwise, and we would rather say so here than leave you to assume it.

We may disclose information where we are satisfied that it is necessary to:

• comply with a court order, warrant, subpoena or other legally binding request, or with a legal obligation we are subject to;
• respond to a lawful request from a law enforcement agency or a regulator, including a data protection authority;
• establish, exercise or defend a legal claim, including one brought by or against us;
• detect, prevent or address fraud, security incidents, or serious abuse of the service; or
• prevent a risk of death or serious physical harm to any person, including you, where waiting for a formal process would be too slow.

Under UK and EU data protection law our legal basis for this is compliance with a legal obligation, or our legitimate interests in protecting our rights, our members and the public.

What we actually hold

A request can only ever reach what exists. That is: your account email address and sign-in method, your username and profile, everything you have logged, rated, reviewed, listed or posted, your direct and community messages and any images attached to them, your follows, blocks, mutes and reports, and server logs containing IP addresses. Passwords are hashed by our authentication provider and we cannot read them.

How we handle a request

• We check that it is valid and properly served, and that the authority making it has jurisdiction over us. Our data sits in the EU, and requests from outside the UK or EU will normally need to come through the appropriate international channel.
• We disclose only the specific data the request covers. We push back on requests that are overly broad, vague, or that ask for more than the stated purpose needs, and we refuse ones that are not legally valid.
• We will tell you if your account is the subject of a request, so that you can seek advice or challenge it, unless we are legally prohibited from doing so, or there is a genuine emergency, or telling you would be counterproductive, for example where the account itself is the source of the harm.
• We keep a record of what we disclosed and to whom.

Requests should go to info@firetale.net, on official letterhead, stating the legal basis, the exact accounts concerned and the date range covered.

If the site changes hands

If Firetale is ever sold, merged or transferred, your data would move with it as part of the transaction. The buyer would be bound by this policy until they told you otherwise, and we would tell you before anything changed.

We keep your data for as long as your account exists. Delete your account and it goes: your profile, logs, reviews, lists, posts, messages and images are removed along with it, and the deletion cascades through our database rather than leaving orphaned records.

Three caveats worth stating plainly. Messages you sent to other people may remain visible in their conversation view. Server logs and database backups persist for a short period before rotating out. And where we are under a legal obligation to preserve specific data (for example after a request of the kind described in Legal requests and disclosure), we keep only what we are required to keep, for only as long as we are required to keep it.

If you are in the UK or EU, you have the right to access your data, correct it, delete it, object to processing, and request a portable copy. Two of these you can exercise yourself, immediately:

• Export: download your full library as CSV from Settings.
• Delete: delete your account from Settings. It is immediate and cannot be undone.

For anything else, email info@firetale.net and we will respond within 30 days. If you think we have handled your data badly, you can complain to your national data protection authority.

Firetale is not intended for children under 13, and under 16 in some countries without parental consent. We do not knowingly collect data from children. If you believe a child has created an account, email us and we will remove it.

If we change this policy in a way that materially affects you, we will say so on the site rather than quietly updating the date at the top.