Privacy Policy

Last updated: October 2, 2026

1. Who is responsible

Christian Staufer
Weißenburger Str. 22
81667 München
Germany
Email: chris@jnkdesign.de

2. What data we process and why

  • Account data (email address, password, username, display name, bio, optional location and links, optional profile picture, sign-up date). Your password is stored only as a hash by our authentication provider. Purpose: creating and running your account. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Profile picture (optional). Your browser shrinks the image to 256 × 256 pixels and our server re-encodes it, which removes metadata such as the location stored in photos. It is stored at Supabase and is visible to everyone together with your profile. Your browser loads it directly from our storage provider (Supabase), which therefore receives your IP address. It is deleted when you replace or remove it, when a moderator removes it, and when you delete your account. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Connected platforms (optional: Steam, Xbox and PlayStation). If you connect Steam, you sign in on Steam itself and we receive your public Steam ID. If you connect Xbox, you sign in on Microsoft’s own page and our server reads your Xbox ID, gamertag, game history and playtime from the Xbox services; we do not store your Microsoft login or any access token. At your request we fetch the games you own or have played, your playtime per game and when you last played, and store them privately: only you can see them, and only the games you choose to add appear on your profile. We use the playtime to suggest hours and platform when you write an entry and to suggest rating games. If you connect PlayStation, you enter your PSN ID and prove it is yours with a short code in your public About Me; our server then reads the public game history of your profile through a service account of ours (we never receive your PlayStation password or login). We never receive your Steam or Microsoft password. Disconnecting a platform deletes this data. Legal basis: contract (Art. 6(1)(b) GDPR) and your request when connecting.
  • Content you create (game statuses, ratings, likes, diary entries, reviews, lists, comments, favorites, follows, blocks, notifications). Purpose: providing the service. Legal basis: contract (Art. 6(1)(b) GDPR).
  • Safety data: reports (including notes you write when reporting), the moderation log and short-lived counters that limit how fast actions can be repeated (deleted after about two days). Purpose: protecting users and the service from abuse. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Technical data (IP address, browser information, time of access) in server logs of our hosting provider and of our own server. Purpose: delivering the website securely, fixing errors and defending against attacks. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). These logs are deleted automatically after at most 30 days.
  • Security check: when you sign up, sign in or reset your password, a Cloudflare Turnstile check runs to tell people from bots. Cloudflare receives technical data such as your IP address and browser signals. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
  • Emails that are needed for your account (confirmation, password reset) are sent by our authentication provider. We don’t send marketing emails.

You must be at least 16 years old to use POG (Pile of Games, “POG”). We store when you agreed to the Terms of Use and which version you agreed to.

3. Public information

Your username, display name, bio, location and links (if you add them), game activity, reviews, public lists, comments and follows are visible to everyone, including people who are not signed in, and may be found by search engines. Private lists are only visible to you. Don’t post anything you want to keep private.

4. Who receives data

  • IONOS SE (Germany): hosting of the website on a server in the EU (processes access data such as your IP address).
  • Supabase: database and authentication. Our database is hosted in the EU (Ireland).
  • Valve Corporation (Steam): only if you connect Steam. You sign in on Steam’s website, and our server fetches your game list from the Steam Web API (may be processed in the USA). POG is not affiliated with or endorsed by Valve.
  • Microsoft Corporation (Xbox): only if you connect Xbox. You sign in on Microsoft’s website, and our server fetches your game history from the Xbox services (may be processed in the USA). POG is not affiliated with or endorsed by Microsoft.
  • Sony Interactive Entertainment (PlayStation): only if you connect PlayStation. Our server reads the public parts of your PlayStation Network profile (PSN ID, About Me, game history and playtime), which may be processed outside the EU. POG is not affiliated with or endorsed by Sony.
  • YouTube (Google): game trailers are loaded from YouTube (privacy-enhanced mode, youtube-nocookie.com). If you have not allowed embedded content in our cookie notice, nothing is loaded from YouTube until you press the play button on a trailer. If you have allowed it, trailers are loaded when you open a game page. YouTube then receives your IP address and technical data and may set cookies or use browser storage; the legal basis is your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), given by your choice in the notice or by clicking play. You can change your choice at any time via “Cookie settings” in the footer. Data may be processed in the USA.
  • Twitch (Twitch Interactive, Inc.): on game pages we show which Twitch channels are live with that game. Our server asks Twitch for this list without personal data of our users. The Twitch player is handled like the YouTube trailers: it loads from Twitch only after you allowed embedded content or pressed play. Twitch then receives your IP address and technical data and may set cookies or use browser storage (legal basis: your consent, Art. 6(1)(a) GDPR, § 25(1) TDDDG). Data may be processed in the USA.
  • Amazon (amazon.de): game pages have a “Buy on Amazon” link. It is an affiliate link: if you buy after following it, we may earn a commission at no extra cost to you. Only when you click the link, your browser connects to Amazon, which then processes your data under its own privacy policy. As an Amazon Associate we earn from qualifying purchases.
  • Cloudflare, Inc.: security check (Turnstile) on the sign-up, sign-in and password reset pages (may process data in the USA).
  • IGDB (Twitch Interactive, Inc.): our servers fetch game information from IGDB without personal data of our users. Game cover images, screenshots and artwork are loaded directly from IGDB’s image servers by your browser. IGDB therefore receives your IP address and technical data such as your browser type (we ask your browser not to send the address of the page you are visiting). Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in showing game images; data may be processed in the USA.

Where data is processed outside the EU/EEA, this is based on an adequacy decision or on standard contractual clauses, as far as available for the provider.

5. Cookies

We only set cookies ourselves that are technically necessary. We don’t use cookies for analytics or advertising. Embedded content from YouTube and Twitch (see section 4) may set its own cookies, but only after your consent.

  • A session cookie from our authentication provider that keeps you signed in.
  • A cookie (gl_has_profile) that remembers that you have finished setting up your profile (30 days).
  • A cookie (gl_media) that remembers your choice about embedded content (180 days).

The security check on the sign-in pages may use technically necessary browser storage to work. Because these are necessary to provide the service you asked for, no consent is required for them (§ 25(2) TDDDG).

6. How long we keep data

We keep your data until you delete your account. Deleting your account under Account removes your profile and everything that belongs to it, such as games, diary entries, reviews, lists, likes, comments, follows and blocks. Reports you sent stay, but are no longer linked to your account. The moderation log stays to document moderation decisions. Technical backups may contain deleted data for a limited time. Server logs are deleted automatically after at most 30 days.

7. Your rights

You have the right to:

  • access your data and receive a copy: use “Download my data” under Account;
  • correct your data: edit your profile under your profile page;
  • have your data deleted: use “Delete account” under Account;
  • restrict processing, and object to processing based on legitimate interests (Art. 21 GDPR);
  • withdraw consent you have given, with effect for the future;
  • complain to a data protection supervisory authority.

For all requests write to chris@jnkdesign.de.

8. Changes

We update this policy when the website changes. The date at the top shows the current version.