Privacy Policy

This Privacy Policy explains what information Collected Games, the website at collected.games and its related services (the “Service”), collects when you use it, how we use that information, and the choices you have. Collected Games is operated by Maxwell Anderson (“we,” “us,” or “our”), who is responsible for the personal information described here. By creating an account or using the Service, you agree to the practices described here.

1. Information we collect

• Account details. When you register, we store your email address and a securely hashed version of your password — we never store your password in plain text. If you sign in with Google or Twitch, we receive your email address and basic profile information from that provider in place of a password; we do not retain their OAuth tokens after sign-in and do not access any other data held by those accounts.
• Your collection. The games in your library — added by hand, brought in by a file import, or synced from a game account you connect, such as Steam — and the details recorded about them: status (owned or wishlist), play state (playing, completed, or backlog), platform, your personal rating, and hours played, along with the dates these entries are created and updated. Where a connected library reports playtime, we store it as the hours played on the matching entry.
• Activity record. The dates (not the times) on which you use the Service, and whether it was on the site or through an agent you connected. We keep at most one entry a day for each of the two, not the pages you visit or the requests you make. We also keep a dated record of each change to your collection: whether it was an add, an edit or a removal, and whether it came from you or your agent, an import, or a connected library. The record never says which game changed. And we note when you first added a game, and when an agent first made a change for you.
• Preferences. Settings such as your light/dark theme choice, stored so your experience is consistent across devices.
• API access tokens. If you create personal access tokens for the REST or MCP API, we store them (hashed) so your programmatic requests can be authenticated.
• Connected agents. If you connect an AI assistant or other agent through our REST or MCP API, we store what it saves to your account, such as a taste profile or a list of recommendations, and we keep two records of what it does. An activity log notes each change it makes: the kind of change, the title of the game it touched, a one-line summary (such as the status and platform it set), the agent’s name, how many games were involved, and when. Your account page uses it to show when your agent last worked for you. A connection record for each MCP conversation notes which of your connections it came through, the name the agent’s app gives itself, the first tool it used, how many requests, tool calls and changes it made, and when the conversation started and was last active. Neither record holds the content of the agent’s requests, your conversation with the agent, your IP address or your browser user-agent.
• Technical and security data. Like most websites, our servers automatically record standard request information (such as IP address and browser user-agent) in logs, and we record failed sign-in attempts to protect accounts against brute-force attacks (rate limiting and lockout).

2. How we use your information

• To create and operate your account and authenticate you.
• To store, display, and let you manage your game collection, including keeping it up to date with a game library you choose to connect.
• To support recommendations: Collected Games does not generate recommendations on its own servers. If you choose to connect your own LLM agent through our API, your collection and ratings, and your account’s name and email address (so the agent knows whose account it is working in), are made available to your agent so it can suggest games to play next; the Service itself does not send your data to any AI provider.
• To understand, in aggregate, whether the Service is useful: for example, how many people come back in the weeks after they sign up. We use the activity and change records for this, and only in counts across all accounts.
• To send essential account email, such as password resets.
• To keep the Service secure and reliable, including preventing abuse and diagnosing problems.
• To understand how the Service is used, such as which features and agent tools people rely on, so we can improve it.

We do not sell your personal information, and we do not use it for advertising or third-party tracking.

3. Third-party services

Collected Games relies on a small number of providers to deliver the Service, and links out to the stores where a game can be bought. We share only the data each one needs:

• Google — only if you choose “Continue with Google” to sign in. Google handles that authentication; we receive your email and basic profile.
• Twitch — only if you choose “Continue with Twitch” to sign in. Twitch handles that authentication; we receive your email, Twitch username, and display name. We never see your Twitch password and request no access to your channel, chat, or viewing activity.
• Steam (Valve) — only if you connect a Steam account. Signing in through Steam sends you to Valve’s OpenID service, which confirms who you are and returns your public SteamID64; we store that identifier to keep the two accounts linked. We never see your Steam password. While the account stays connected, we send that SteamID64 to Valve’s Web API to read the games you own and the playtime Steam has recorded for them — when you connect, when you choose “Sync now,” and then on a recurring schedule (about once a week) — and we add or update entries in your collection from what comes back. If you switch wishlist syncing on, the same request pattern also reads your Steam wishlist and mirrors it into your collection, which means an item you remove on Steam is removed here too. We send Valve nothing about your Collected Games account other than that identifier, and you can turn syncing off or disconnect Steam at any time from your connected accounts page.
• Retailers — only if you follow a store link from a game page. Those links either go through a redirect on our own site, which sends you on to the store (Amazon, eBay, Steam, the PlayStation Store, and others), or point at the store directly. Either way the store learns at most that you arrived from collected.games — our address only, never which page you were reading, because both shapes are sent with a strict-origin-when-cross-origin referrer policy while our own pages keep the same-origin one described below. Where we take part in a store’s affiliate programme, the link also carries our affiliate identifier so the store can credit the referral to us; it identifies us, not you, and we send the store nothing about your account or your collection. What the store does once you arrive is covered by that store’s own privacy policy, not this one — any cookies it sets are set on its domain rather than ours, and our own cookie practice is unchanged (see section 4).
• Hosting and email providers — operate the infrastructure that runs the Service and delivers transactional email on our behalf.

Our catalog is built from public data sources: game data and cover art from IGDB.com, critic scores, compilation contents and media formats from Wikidata, and public storefront details from Steam. We collect that information on our own servers, and we send nothing about you or your account when we do.

Cover art is the exception, because we deliberately never copy publisher artwork onto our servers: every cover you see is loaded straight from IGDB’s image service at images.igdb.com. So whenever a page shows cover art, your browser fetches those images from IGDB directly, which discloses your IP address and browser user-agent to IGDB — and that happens whether or not you are signed in. Those requests carry nothing about your account, and because our pages are served with a same-origin referrer policy they also tell IGDB nothing about which page you were looking at.

4. Cookies and local storage

We use a session cookie to keep you signed in and a CSRF cookie to protect form submissions — both are required for the site to function. Your theme preference is stored in your browser’s local storage. We do not use advertising or cross-site tracking cookies. Following a store link takes you to another company’s site, where that company may set its own cookies on its own domain under its own policy; that is outside the Service and does not change what we set here.

5. Data retention and deletion

We keep your account and collection data for as long as your account is active. You can delete your account at any time from your account page. Deletion takes effect after a 14-day grace window, during which signing in cancels it; after that your profile and collection data are permanently removed from our live database. Copies made before then remain in our encrypted backups until those backups expire, up to 13 months after deletion. We keep backups only to recover the Service from a failure, and we never use them to bring back a deleted account. To keep that promise when we do restore one, we keep a record of each deleted account’s internal number and sign-up date, with nothing else about you, for those same 13 months. Your agent’s activity log is part of that account data: we keep it until you delete your account. MCP connection records are deleted 90 days after the conversation was last active. Routine server logs are retained only for a limited period for security and troubleshooting.

6. Your choices and rights

You can review and update your account details and collection at any time while signed in, and you can delete your account as described above. Depending on where you live, you may have additional rights to access, correct, export, or delete your personal information. To make such a request, contact us at the address below.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will take reasonable steps to notify you through the Service.

9. Contact

Questions about this policy or your data? Contact us at support@collected.games.