Privacy Policy

1. Data Controller

The data controller pursuant to Art. 4(7) GDPR is the person named in the legal notice (Impressum). For privacy-related questions, please contact the email address listed there.

2. Overview of Data Processing

We only process personal data to the extent necessary to provide and improve Coilr. We do not sell, rent, or share personal data with third parties for marketing purposes. We do not use third-party advertising or tracking scripts. To improve our service, we use Vercel Web Analytics (see section 5).

3. Data We Collect

When you sign in via Steam, we receive and store the following data through Steam's OpenID and Web API:

• Steam profile data: Steam ID, display name, avatar URL, profile URL, country code, account creation date, Steam level
• Game library: Owned games, playtime per game, recently played titles
• Achievements: Unlock status and timestamps per game
• Playtime snapshots: A timestamped snapshot of your playtime per game is saved with each sync
• User settings: Display preferences, visibility settings, sync interval
• Wishlist: When you open the release calendar while signed in, we fetch your public Steam wishlist (the game IDs only) to mark those games on the calendar and to build your personal calendar feed. It is cached for at most a day, is not visible to anyone else, and is deleted with your account. If your wishlist is private on Steam, nothing is fetched.
• Invites: When you open the invite page we create a short, random invite code for your account. If you came to Coilr through somebody else’s invite link, we record once, at account creation, who invited you — so that they can be credited for it. That value is never changed afterwards, is not visible to anyone else, and the only thing the inviting person ever sees is a total count. You are never shown who invited you, and nothing at all is stored for visitors without an account. No cookie is involved.
• Signup origin: Once, when the account is created, we store which website you came to us from (the hostname only, e.g. „reddit.com“ or „direct“ – never the full URL or a search query) and which Coilr page you opened first (e.g. „/game/730“). These two values help us understand how people find Coilr. They are recorded only at signup, never changed afterwards, and nothing at all is stored for visitors without an account. No cookie is involved.

In addition, we store content you enter yourself on Coilr. This does not come from Steam but from you, and all of it is optional:

• Finished games: Which games you marked as finished, and the date you gave. These marks appear in the analysis on your profile and are visible to others if your profile is public; they are never used in platform-wide statistics.
• Game ratings: Your own score from 0 to 100 per game. Only anonymous per-game averages are published, never your individual score.
• Completion times: How long a game took you, per category (main story, main story with side content, 100%). Likewise published only as anonymous aggregates.
• Manually added games: Non-Steam games you enter yourself, with a name and a playtime. They are visible only to you and never enter platform-wide statistics.
• Price watchlist: Games you set a price alert for, with your target price and the store region you chose.
• Teammate profile: If you use the teammates board, your weekly availability (in UTC), the games you picked for it, and your connect requests and blocks. There is no free text there.
• Feedback: If you write to us through the feedback form, your message and the category you chose.
• Discord bot: When someone with the “Manage Server” permission sets up alerts through the Coilr bot (/alerts), we store the Discord server ID, the channel ID, the chosen game, which alerts were requested and the Discord user ID of the person who set them up. The other commands (such as /players) store nothing; Discord sends us only what the reply needs. Entries are deleted as soon as they are removed with /alerts remove or the bot may no longer post in the channel. Discord’s own privacy policy covers its processing.
• Twitch extension: When someone connects their Twitch channel through the Coilr extension, we store the Twitch channel ID together with the Steam ID of the connected account. While the connection exists, we regularly ask Steam which game is running, and the panel under the stream shows every viewer that game, the hours in it, the most played games, and the Steam account’s name and avatar. Hidden games and adult games never appear. The connection can be removed at any time in the extension’s settings on Twitch or at coilr.org/twitch/connect; after that nothing is shown or polled. Twitch’s own privacy policy covers its processing.
• “Coilr for Steam” browser extension: When someone with the extension installed opens a game’s page in the Steam store, it sends that game’s number (its Steam app ID) to coilr.org to show the game’s player counts and price history. Nothing else is sent: no Steam ID, no cookie, no other pages visited. Coilr does not store these requests or link them to anyone; as with any page view, our host processes the IP address to deliver the response (see section 6). The extension can be removed from the browser at any time.

4. Legal Basis for Processing (Art. 6 GDPR)

• Art. 6(1)(a), Consent: By signing in via Steam, you consent to the processing of your Steam profile and game data for the purposes described.
• Art. 6(1)(b), Contract performance: Processing is necessary to provide the service you requested (dashboard, charts, analytics).
• Art. 6(1)(f), Legitimate interest: Aggregated, anonymized statistics are produced for the platform stats page. No individual data is disclosed.

5. Cookies

Coilr uses the following cookies:

We do not use advertising cookies or third-party cookies. The cookies listed above are technically necessary for operating the website and do not require consent under § 25(2) TTDSG.

Vercel Web Analytics: We use Vercel Web Analytics to collect anonymized usage statistics (page views, referrer, country, OS, browser). Vercel Analytics is cookie-free and does not store personal data. IP addresses are processed by Vercel for geolocation but are not retained. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our service). More information: Vercel Analytics Privacy.

6. Hosting

This website is hosted by Vercel Inc., 440 N Baxter St, Suite 200, Coppell, TX 75019, USA. When you visit our website, Vercel processes your IP address and request metadata to deliver pages. Vercel may transfer data to the USA. The transfer is secured by EU Standard Contractual Clauses (SCCs). More information in Vercel's privacy policy.

Our database is hosted by Turso (ChiselStrike Inc.). Data processing is subject to their Data Processing Agreement (DPA) and EU Standard Contractual Clauses.

7. Third-Party Services

Steam Web API (Valve Corporation): During sign-in or sync, we make server-side requests to the Steam API to retrieve your public profile and game data. Your Steam ID is transmitted to Valve. For Steam's processing, Valve's privacy policy applies: store.steampowered.com/privacy_agreement.

8. Your Rights Under GDPR

You have the following rights under the GDPR. To exercise them, contact us at the email listed in the legal notice or use the self-service options in your account settings:

• Right of access (Art. 15): You can download all your data as JSON or CSV via account settings → export data.
• Right to rectification (Art. 16): Use “refresh profile” in settings to update your data from Steam.
• Right to erasure (Art. 17): You can delete all your data via account settings → danger zone, or selectively remove snapshots/games.
• Right to restriction (Art. 18): Contact us to restrict the processing of your data.
• Right to data portability (Art. 20): Use the export function to download your data in a machine-readable format.
• Right to object (Art. 21): You may object to processing based on legitimate interests. Contact us.
• Right to withdraw consent: You may withdraw consent at any time by deleting your account. This does not affect the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence.

9. Data Retention

Your data is stored as long as your account exists. When you delete your account, all associated data (profile, games, snapshots, achievements, settings, hidden games, all the content you entered yourself under section 3, push subscriptions and session history) is permanently and irrevocably removed from our database. All notifications stop with it.

10. Data Security

All connections to Coilr are encrypted via TLS/HTTPS. Your session is stored in an encrypted, HTTP-only cookie that cannot be read by client-side JavaScript. We do not store passwords, and authentication is handled exclusively through Steam's OpenID.

11. Minors

Coilr is not directed at children under 16. We do not knowingly collect data from minors under 16. If you believe a minor has submitted personal data to us, please contact us and we will delete that data.

12. What We Don't Do

• We never see your Steam password, authentication is handled via Steam's OpenID
• We do not sell, share, or monetize your data
• We do not track you with advertising scripts or personalized tracking
• We do not modify anything on your Steam account, access is read-only
• We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR

13. Disclaimer

All data obtained via the Steam Web API is provided “as is” and “with all faults.” Coilr makes no warranty as to the accuracy, completeness, or reliability of displayed Steam data. Use is at your own risk. Valve, Steam, and the Steam logo are trademarks of Valve Corporation. Coilr is not affiliated with or endorsed by Valve.

14. Advertising & Sponsorship

Coilr may introduce sponsors or advertising in the future to cover operating costs. Should this happen, the following principles will always apply:

• Your privacy comes first: we will never sell, share, or disclose personal data to advertisers
• No third-party tracking scripts, fingerprinting, or behavioral profiling will be used for advertising
• Advertising and sponsorship will be clearly labeled and never disguised as user content
• Existing features will not be locked behind ads or sponsorship paywalls

Revenue will never take priority over your trust. If our monetization approach changes, this page will be updated before changes take effect. If non-essential cookies are introduced for advertising, we will obtain your explicit consent beforehand.

15. Push Notifications

If you enable notifications, we store the subscription your browser provides: the endpoint URL of your browser's push service and two cryptographic keys (p256dh and auth) required for encrypted delivery. These are linked to your Steam ID. We also record the occasion of each notification already sent — the calendar week for a weekly recap, the game and hour mark for a milestone — so the same message is never sent twice. We also store which kinds of notification you have switched off in settings.

The legal basis is your explicit consent under Art. 6(1)(a) GDPR, given by turning the switch on and accepting your browser's permission prompt. It is entirely optional and is never a condition of using Coilr.

• We send only messages about your own play data, in two kinds: a weekly recap on Sunday with your playtime for the previous seven days, and a note when you pass an hour mark in a game. A week with no playtime stays silent.
• Each kind can be switched off individually in settings without ending the others. New kinds will be described here before any are sent.
• Milestone notifications are only delivered during daytime hours. We use the country code Steam provides on your profile to estimate your approximate local time; no more precise location is collected or stored.
• We send no advertising, no offers and no third-party content.
• Your browser's push service (e.g. Google, Mozilla or Apple) relays the message. Its contents are end-to-end encrypted in transit.
• You can withdraw consent at any time using the same switch in settings, or in your browser's notification settings. The subscription is deleted immediately.
• Deleting your account deletes the subscription with it, and no further notifications are sent.

16. Changes to This Privacy Policy

We may update this privacy policy from time to time. Material changes will be highlighted on this page with an updated date. Continued use of Coilr after changes constitutes acceptance of the updated privacy policy.