Privacy
Privacy Policy
What we collect, when we collect it, where it is stored, and how to get it deleted.
Last updated October 15, 2026
The short version
- We collect what you give us and what you ask us to import from services you connect.
- We fetch your Steam data only when you ask. Signing in with Steam or connecting it is that request: it imports your library and refreshes it every six hours until you switch that off on the Connections page. You can also press Import, or ask us to re-run an import for you. Never on our own initiative for someone who did not ask.
- We do not sell your data. We do not serve ads.
- Everything we store, including Steam data, is stored in the United States.
- To delete your account, email hancock.trey@gmail.com. There is no delete button yet.
Who we are
RolledCredits (rolledcredits.gg) is a solo project. In this policy, “we” means RolledCredits. For anything about your data, email hancock.trey@gmail.com.
What we collect, by source
Data about you comes from two places: what you give us, and what you ask us to fetch from a service you connect. We fetch from a connected service only when you ask us to: when you connect it, sign in with it, press Import or Refresh import, ask us to re-run an import for you, or ask us to load one game’s achievements, and every six hours for a Steam, GOG or RetroAchievements library you have told us to update automatically. For Steam, signing in or connecting is that request: it asks us to import your library and to refresh it every six hours, and the switch on the Connections page ends it. Connecting GOG is the same request, ended by the same switch. For RetroAchievements you switch the refresh on yourself. We never fetch your data on a schedule you did not ask for, and never on our own initiative for a member who did not ask.
Your account
- Profile
- Your username, display name, optional bio, profile picture, and whether your profile is public. A picture you upload is stored in our database.
- Email address
- Stored if you sign up with email or add one later. We use it to confirm the address, reset your password, send notices about your account, and send the weekly roundup unless you switch it off. The roundup says who messaged you and how many times, never what they said; who commented on or replied to your activity, without their words; how many likes you got; reviews of games you added, including a curator’s note; and site news. It is never shown on your profile.
- Email settings
- Which emails you have switched off, the day and time of day you want the weekly roundup, and when we last sent you one, so the next covers only what came after. Saving those settings also stores your timezone name as your browser reports it (for example America/Chicago), so the roundup arrives at that time where you are. The link in any notification email lets you change or stop them without signing in.
- Adding an email
- An address you add in Settings joins your account only once you confirm it. Until then it is kept with the confirmation link, which stops working after 24 hours.
- Password
- Stored only as an Argon2id hash, so we cannot read it. An account that signs in with Steam alone has no password.
- Sign-in sessions
- Signing in gives your browser a random token. We store only its SHA-256 hash, and the session ends after 30 days.
- Sign-in history
- The time of each sign-in and which method it used (Steam, a password, or a link we emailed you), plus the last time your browser asked us for a page, kept to a 15-minute resolution. It tells us whether the site is being used and whether people come back. Neither one records your IP address or which browser you use, and only site admins can see it.
- Confirmation and reset links
- One-time tokens. As with sessions, we store only the SHA-256 hash.
- What you add
- Shelves, ratings, reviews, journal entries, lists, playtime logs, follows, blocks, and the reports you file.
- Home discovery
- Which discovery cards Home has shown you and on which days, so a card you have seen on two days can take a week off, and any card or kind of card you marked Not interested or Show fewer like this. The record of a card is deleted once it has not been shown to you for 30 days; your Not interested and Show fewer choices stay until you undo them. Separately, we keep daily site-wide totals of how many discovery cards of each kind were shown, clicked, followed from and dismissed. Those totals never record who did it.
- Site usage
- Daily site-wide totals of how many times each kind of page was opened (Home, game pages, profiles, lists and so on) and how many times each kind of thing was done (games shelved, ratings, journal entries, likes, follows, imports started and the like), split only into signed-in and signed-out. They are counted on our own server, with no cookie and no third-party script, and they never record who did it, which game, list or profile it was, your IP address or your browser. Each day’s totals are deleted after 400 days. Separately, for each game we keep a daily total of how many times its page was opened, split only into signed-in and signed-out, for 90 days, shown only to that game’s makers and our staff.
- Messages
- Private messages you send and receive, when each was sent, whether you have read a conversation, and whether you accepted or declined a message request. A message you unsend disappears for both of you, but we keep its text so that a report about it can still be reviewed.
- Files you upload
- If you import an export from another tracker (currently Grouvee), we keep the file’s contents with the import job so it can be retried.
- Abuse limits
- To slow down abuse we count requests by IP address, or by account when you are signed in. These counters are deleted automatically within a few hours.
- Launch and beta lists
- Before signups opened, some people left an email address to hear about the launch, and some were invited to the beta by email or Steam ID. We still hold those records. Email hancock.trey@gmail.com and we will remove yours.
Steam
- When we fetch it
- Only when you ask. Signing in with Steam or connecting Steam to your account is that request: it imports your library, and refreshes it every six hours as well, until you switch Update automatically off on the Connections page or disconnect Steam. Signing in again does not switch it back on once you have turned it off; switching it on again is a new request. You can also press Import, or ask us to re-run an import for you. We never fetch Steam data on a schedule you did not ask for, and never on our own initiative for someone who did not ask. We can only see what your Steam privacy settings make public.
- What we store
- Your SteamID64, the public account number Steam gives you.
- Your persona name, avatar URL and profile URL. We refresh them each time you sign in with Steam.
- The games you own: each game’s app ID and name.
- For each game, your total playtime in minutes (playtime_forever) and when you last played it (rtime_last_played).
- For games you have played, the API name of each achievement you have unlocked and when you unlocked it.
- A record of each import: when it ran, how many games it covered, and any error it hit.
- Whether Update automatically is on for Steam, and since when. Signing in with Steam or connecting it turns it on; you can turn it off on the Connections page.
- What we do with it
- We use it to build your library: your games appear on your shelves, placed on a shelf such as Backlog, Played or 100%ed according to your playtime and achievements, and your playtime and achievements show on those games. If you create your account with Steam, we also start your display name and profile picture from your persona name and avatar; you can change both. We do not use Steam data for marketing or to send you unsolicited messages.
- What we never see
- Your Steam password. Sign-in happens on Steam’s own site, which tells us only your SteamID.
- Where it is stored
- Only in the United States. See Where your data is stored.
IGDB (via Twitch)
- What we fetch
- Game information only: titles, summaries, release dates, genres, game modes (single player, multiplayer and so on), platforms, and links to cover art and screenshots. IGDB is a game database owned by Twitch, and we reach it through a Twitch developer account.
- What we store
- That game information, in our own database, refreshed on a schedule so ordinary pages never call IGDB. The images themselves are not copied: they load from IGDB’s servers when a page shows them.
- What IGDB receives
- Game titles and Steam app IDs when we look games up, and your search text if you use Add a game to find one we do not have yet. Never your name, email or account.
RetroAchievements
- What you give us
- Your RetroAchievements username. We check that it exists. We never ask for your RetroAchievements password or API key.
- When we fetch it
- When you press Import or ask us to re-run an import for you, and every six hours if you switch on Update automatically on the Connections page. It starts off.
- What we store
- Your username and, for each game you have played, your achievement unlocks (which ones and when), how many you have earned out of the total, whether RetroAchievements shows you as having beaten or mastered it, and your playtime when it reports one. If you switch on Update automatically, we also store that you did and when.
GOG
- What you give us
- Your GOG username. We look it up once to find your profile and check that it exists. We read only what your public GOG profile shows anyone, so we never ask for your GOG password.
- When we fetch it
- When you connect it (which also switches on Update automatically), when you press Import, when you ask us to re-run an import for you, and every six hours while Update automatically is on.
- What we fetch
- Your public GOG profile’s games list, and the achievements page of each game you have played, the same pages anyone can open on gog.com. No images.
- What we store
- Your GOG username, GOG user number and avatar link. For each game: your playtime, when you last played it, and which achievements you have unlocked and when. A game we cannot match to one in our catalog is kept in a list for you to resolve or dismiss. If Update automatically is on, we also store that you asked and when.
PlayStation, Xbox and Nintendo Switch
- What you give us
- A one-time credential from that service that lets us read your account. We exchange it for a longer-lived token, store only that token, encrypted (AES-256-GCM), and never keep the original. We never see or store your PlayStation, Microsoft or Nintendo password.
- What we store about the account
- PlayStation: your account ID, online ID, avatar link, and whether you have PlayStation Plus.
- Xbox: your Xbox user ID, gamertag, avatar link and gamerscore.
- Nintendo Switch: your Nintendo account ID, nickname and country.
- What we fetch and store
- For each game, your playtime, when you first and last played it where the service reports that, and the trophies or achievements you have earned out of the total. A title we cannot match to a game in our catalog is kept in a list for you to resolve or dismiss.
- When we fetch it
- When you connect the account, press Import, or ask us to re-run an import for you or to load a game’s trophies or achievements.
Exophase
- What you give us
- Your Exophase username. We look it up once to find your profile and check that it exists. Exophase profiles are public, so we never ask for your Exophase password.
- When we fetch it
- When you connect it, when you press Refresh import (at most once a day), or when you ask us to re-run an import for you. Never on a schedule.
- What we fetch
- Your public Exophase profile page and the list of games it shows, the same pages anyone can open on exophase.com. Nothing for individual achievements, and no images.
- What we store
- Your username and Exophase player number. For each game on a platform you have not connected here directly: its title, platform, your playtime, when you first and last played it, and how many achievements you have earned out of the total. Games on platforms you connected here directly, and games you hid on Exophase, are skipped. A title we cannot match to a game in our catalog is kept in a list for you to resolve or dismiss.
Who else handles your data
We do not sell your data. We do not serve ads, and we do not share your data with anyone for advertising. Three service providers process data for us:
Our service providers
- Render
- Hosts the website, the background worker that runs imports, and the Postgres database where everything above is stored.
- Cloudflare
- Provides DNS and sits in front of the site, so it sees each request, including your IP address. Its Turnstile check confirms you are not a bot before you sign in, sign up or reset a password; we send Cloudflare the check’s response and your IP address to verify it.
- Resend
- Sends our email: address confirmations, password resets, notices about your account, and the weekly roundup. It receives your email address and the message.
Render and Cloudflare may also keep ordinary request logs, such as IP addresses and the pages requested, for their own operations and security.
The services you connect (Steam, GOG, RetroAchievements, PlayStation, Xbox, Nintendo and Exophase) receive what they need to look up your data, such as your SteamID, your GOG, RetroAchievements or Exophase username, or the token you gave us. Each has its own privacy policy, and we do not control what they do with the data they already hold.
Cover art, screenshots, some profile pictures and the Sign in through Steam button load straight from the sites that host them, such as IGDB, Steam and RetroAchievements, so those sites can see your IP address when your browser fetches an image.
Where your data is stored
Everything we store about you, including Steam data, is stored in the United States, on servers hosted by Render. Our web servers and background worker run in Render’s Oregon region. We store Steam data only in the United States.
Cloudflare sits in front of the site, so requests pass through its network on the way to us. Email goes out through Resend, which receives only the address and the message.
What other people can see
You choose in Settings whether your profile is public. If it is public, anyone can see your shelves, ratings and reviews, and search engines can list it. If it is private, only signed-in members can see it, and search engines are asked to stay away. Either way, something you publish, such as a review or a public list, shows your display name and username wherever it appears. Journal entries have their own audience setting.
What you import, including Steam data, becomes part of your library, so it appears wherever your profile shows your library, playtime and achievements. Your email address is never shown on your profile.
A private message can be read by you and the person you sent it to, and nobody else on the site. If one of you reports a message, our moderators see that message so they can act on the report. They do not otherwise read conversations.
Keeping and deleting your data
We keep your account and your library until you delete them. Three things expire on their own: sign-in sessions end after 30 days, the abuse-limit counters are cleared within a few hours, and Home’s record of a discovery card is deleted 30 days after the card was last shown to you.
- Disconnecting a service
On the Connections page you can disconnect Steam, GOG, RetroAchievements, PlayStation, Xbox, Nintendo or Exophase whenever you like. Disconnecting deletes the connection itself: for Steam, your SteamID and the saved persona name, avatar and profile URL; for the others, the account details and any stored token. It does not delete what you already imported. Your games, playtime and achievements stay in your library, because your library is your journal, and we stop fetching anything new.
If Steam is your only way to sign in, the Disconnect Steam button appears once you have added an email address and a password, so you cannot lock yourself out.
- Deleting your account
There is no delete button yet, so this is done by hand. Email hancock.trey@gmail.com from the address on your account. If your account has no email address, such as an account that signs in with Steam alone, include your username and we will work out a way to confirm it is you.
We will delete your account and the personal data attached to it: your profile, sign-in details and sign-in history, connected accounts and stored tokens, and your library, logs, reviews, journal entries, lists, messages, follows, blocks and Home discovery history, including everything imported from Steam. Records that other people rely on, such as moderation reports and the edit history of catalog entries, may be kept in a form that no longer identifies you. Our host also keeps short-lived database backups, so a deleted account can linger there until they expire.
- Anything else
- Most of what we hold is visible and editable in the app: your profile, shelves and connections. For any other question about your data, email us.
Children
RolledCredits is not for children under 13, and we do not knowingly collect their information. If you think a child under 13 has an account, email hancock.trey@gmail.com and we will delete it.
Changes and contact
When we change this policy we update the date at the top. Questions, requests and complaints about privacy go to hancock.trey@gmail.com. The rules for using the site are in the Terms of Service.