Privacy Policy

This Privacy Policy explains what information Collected, the website at collected.games and its related services (the “Service”), collects when you use it, how we use that information, and the choices you have. Collected is operated by Maxwell Anderson (“we,” “us,” or “our”), who is responsible for the personal information described here. By creating an account or using the Service, you agree to the practices described here.

1. Information we collect

• Account details. When you register, we store your email address and a securely hashed version of your password — we never store your password in plain text. If you sign in with Google or Twitch, we receive your email address and basic profile information from that provider in place of a password; we do not retain their OAuth tokens after sign-in and do not access any other data held by those accounts.
• Your collection. The games in your library — added by hand, brought in by a file import, or synced from a game account you connect, such as Steam — and the details recorded about them: status (owned or wishlist), play state (playing, completed, or backlog), platform, your personal rating, and hours played, along with the dates these entries are created and updated. Where a connected library reports playtime, we store it as the hours played on the matching entry.
• Preferences. Settings such as your light/dark theme choice, stored so your experience is consistent across devices.
• API access tokens. If you create personal access tokens for the REST or MCP API, we store them (hashed) so your programmatic requests can be authenticated.
• Technical and security data. Like most websites, our servers automatically record standard request information (such as IP address and browser user-agent) in logs, and we record failed sign-in attempts to protect accounts against brute-force attacks (rate limiting and lockout).

2. How we use your information

• To create and operate your account and authenticate you.
• To store, display, and let you manage your game collection, including keeping it up to date with a game library you choose to connect.
• To support recommendations: Collected does not generate recommendations on its own servers. If you choose to connect your own LLM agent through our API, your collection and ratings are made available to your agent so it can suggest games to play next; the Service itself does not send your data to any AI provider.
• To send essential account email, such as password resets.
• To keep the Service secure and reliable, including preventing abuse and diagnosing problems.

We do not sell your personal information, and we do not use it for advertising or third-party tracking.

3. Third-party services

Collected relies on a small number of providers to deliver the Service. We share only the data each provider needs:

• Google — only if you choose “Continue with Google” to sign in. Google handles that authentication; we receive your email and basic profile.
• Twitch — only if you choose “Continue with Twitch” to sign in. Twitch handles that authentication; we receive your email, Twitch username, and display name. We never see your Twitch password and request no access to your channel, chat, or viewing activity.
• Steam (Valve) — only if you connect a Steam account. Signing in through Steam sends you to Valve’s OpenID service, which confirms who you are and returns your public SteamID64; we store that identifier to keep the two accounts linked. We never see your Steam password. While the account stays connected, we send that SteamID64 to Valve’s Web API to read the games you own and the playtime Steam has recorded for them — when you connect, when you choose “Sync now,” and then on a recurring schedule (about once a week) — and we add or update entries in your collection from what comes back. If you switch wishlist syncing on, the same request pattern also reads your Steam wishlist and mirrors it into your collection, which means an item you remove on Steam is removed here too. We send Valve nothing about your Collected account other than that identifier, and you can turn syncing off or disconnect Steam at any time from your connected accounts page.
• Hosting and email providers — operate the infrastructure that runs the Service and delivers transactional email on our behalf.

Our catalog is built from public data sources: game data and cover art from IGDB.com, critic scores, compilation contents and media formats from Wikidata, and public storefront details from Steam. We collect that information on our own servers, and we send nothing about you or your account when we do.

Cover art is the exception, because we deliberately never copy publisher artwork onto our servers: every cover you see is loaded straight from IGDB’s image service at images.igdb.com. So whenever a page shows cover art, your browser fetches those images from IGDB directly, which discloses your IP address and browser user-agent to IGDB — and that happens whether or not you are signed in. Those requests carry nothing about your account, and because we set a same-origin referrer policy they also tell IGDB nothing about which page you were looking at.

4. Cookies and local storage

We use a session cookie to keep you signed in and a CSRF cookie to protect form submissions — both are required for the site to function. Your theme preference is stored in your browser’s local storage. We do not use advertising or cross-site tracking cookies.

5. Data retention and deletion

We keep your account and collection data for as long as your account is active. You can delete your account at any time from your account page; deleting your account permanently removes your profile and collection data from our database. Routine server logs are retained only for a limited period for security and troubleshooting.

6. Your choices and rights

You can review and update your account details and collection at any time while signed in, and you can delete your account as described above. Depending on where you live, you may have additional rights to access, correct, export, or delete your personal information. To make such a request, contact us at the address below.

7. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us personal information, please contact us and we will delete it.

8. Changes to this policy

We may update this policy from time to time. When we do, we will revise the “Last updated” date above, and for material changes we will take reasonable steps to notify you through the Service.

9. Contact

Questions about this policy or your data? Contact us at support@collected.games.