1. Who we are
SeeMyBacklog is operated by an independent developer (“we”, “us”, “our”). We are the controller of the personal information described in this policy.
Contact: velocityapps@protonmail.com. We do not publish a postal address. If a formal request needs one, email us and we will provide the details your local law requires.
2. The short version
- We collect what you need to use the app: sign-in details, the games you track, and the platform identifiers you connect.
- A guest library stays in your browser. We do not receive it.
- Analytics and advertising cookies stay off until you accept them. You can change your choice at any time.
- We do not sell your personal information.
- You can delete your account and its data from inside the app.
- To ask a question or exercise a right, email us at the address in section 13.
3. What we collect
3.1 Account and sign-in
If you create an account, Firebase Authentication stores your email address and a password hash. We never see your password in plain text. If you continue with Google, Firebase Authentication stores the name, email address, profile photo and Google account identifier that Google provides. We also receive a user identifier (UID) that links your records.
Your email address stays with Firebase Authentication. We do not copy it into our application database.
3.2 Your library
We store your library and watch list in Google Cloud Firestore under your UID. That includes game titles, status, genre, catalog estimates, hours played, ratings, reviews, start and finish dates, platforms, cover and screenshot URLs, Steam app ids, and the dates you added or tracked a title.
A guest library is different. It lives in your browser’s local storage and is never sent to us.
3.3 Imports and platform accounts
- Steam. Your Steam ID is sent to our server and on to Valve’s Steam Web API to read your owned games. If you connect Steam, we store the Steam ID with your library.
- Xbox. Your gamertag is sent to our server and on to OpenXBL to read your titles. If you connect Xbox, we store the gamertag with your library.
- PlayStation. The NPSSO token you paste is sent to our server and on to Sony’s PlayStation Network to read your titles. We do not store the token.
Titles, and playtime where the platform reports it, are added to your library.
3.4 Messages you send us
The feedback form sends your email address, subject and message through Netlify Forms. If you email us directly, we receive whatever you include in that email.
3.5 Information collected automatically
- Analytics, only with consent. Firebase Analytics records events such as log in, sign up, add a game and change status. An event can include your UID when you are signed in, the game title, the sign-in method, and standard device and usage information. Google may derive an approximate location from your IP address.
- Advertising, only with consent. Google AdSense may set cookies and collect device identifiers, IP address and browsing information to serve and measure ads.
- Server logs. Our host and API providers may record your IP address, the time of a request and error details for security and debugging.
- Essential storage. See section 5.
4. How we use it and why
We use personal information for these purposes, on these legal bases:
- To provide the service (account, sync across devices, imports, watch list, release alerts): performance of a contract with you.
- To keep it secure and working (debugging, abuse prevention, service improvement): our legitimate interests.
- Analytics and advertising: your consent.
- To comply with the law and respond to lawful requests: a legal obligation.
- To answer your messages: performance of a contract or our legitimate interests.
Where we rely on consent, you can withdraw it at any time. Withdrawing does not affect processing that already took place.
7. International transfers
We and our providers may process information in the United States and other countries. Where the law requires safeguards, we rely on mechanisms such as the European Commission’s Standard Contractual Clauses, an adequacy decision, or the EU-US Data Privacy Framework where a provider is certified. You can ask us for more information about the safeguards that apply.
8. How long we keep it
- Account, library, watch list, platform identifiers and push subscriptions: until you delete your account or remove the item.
- Deleting your account: we do not keep backups. Deleting your account removes your Firestore document and your sign-in account immediately.
- Analytics: for the retention period set in Google Analytics, which is 14 months by default.
- Advertising: as described in Google’s policies.
- Feedback: while we handle it and for a reasonable record afterwards.
- Server logs: for the retention period used by our host.
- Guest data: until you clear it or your browser storage.
9. Your rights
Depending on where you live, you may have some or all of these rights:
- European Economic Area and UK (GDPR and UK GDPR): access, correct, delete, restrict, port, object, withdraw consent, and complain to your supervisory authority.
- California (CCPA and CPRA): know, delete, correct, opt out of sale or sharing, limit the use of sensitive personal information (we do not collect it), and be free from discrimination. You may use an authorized agent. We do not sell personal information. Personalized advertising may count as “sharing” under the CPRA; reject it in the consent banner or through Global Privacy Control.
- Brazil (LGPD), Canada (PIPEDA), Australia (Privacy Act and APPs), and India(DPDP Act): access, correction, deletion and grievance rights as those laws provide.
To exercise a right, email velocityapps@protonmail.com. We may need to verify your identity first. We respond within the time the law requires.
10. Children
SeeMyBacklog is for people aged 13 and older. We do not knowingly collect information from children under 13. If you believe a child under 13 has given us information, email us and we will delete it. In the EEA or UK, if local law sets a higher age for consent to online services, a parent or guardian must give permission.
11. Security
We use HTTPS, Firebase Authentication and Firebase security rules, and we restrict administrative access. No system is completely secure. Keep your password private and use a unique one for this account.
12. Changes to this policy
We may update this policy. When we do, we change the date at the top. For significant changes, we will tell you in the app or by email before they take effect.
13. Contact us
Questions, requests or complaints about privacy can go to velocityapps@protonmail.com. If you are in the EEA or UK, you also have the right to contact your local supervisory authority.