Privacy Policy
Last updated: 8 September 2026
GameRecommenderMatch has no accounts, no logins and no passwords, and never asks for your name, email address or payment details. It works by reading the parts of your Steam profile that you have already made public. This page explains exactly what is read, what is stored, for how long, and how to have it deleted.
1. Who is responsible for your data
| Controller | Manuel Quiles Sánchez (individual) |
|---|---|
| NIF | 74378979S |
| Address | Calle San Crispín 1, 03320 Torrellano, Alicante, Spain |
| [email protected] |
No Data Protection Officer has been appointed, as none is required under Article 37 GDPR for a project of this nature.
2. What data is processed
2.1 Data obtained from your Steam profile
When you submit a Steam profile, the site resolves it to a SteamID64 — the 17-digit public identifier Steam assigns to every account — and requests the following from Steam’s public Web API:
- Your games library: which games you own, total playtime per game, playtime in the last two weeks, and when each was last played.
- Achievements: your completion percentage in the games you have played most.
- Wishlist: which games you have wishlisted, used to avoid recommending what you already want and to measure whether the suggestions match your taste.
- Display name and avatar: shown in the results header so you can see whose profile was loaded. These are sent to your browser and are never written to the database.
Under GDPR a SteamID64 is personal data, because it can be linked back to an identifiable person through their public Steam profile. It is therefore treated as personal data throughout this policy, even though it is a public identifier.
Only public profiles can be processed. If your Steam profile or its game details are set to private, Steam returns nothing and the tool cannot work — there is no way for this site to see private data.
2.2 Data generated by using the site
- Searches: which filters you applied, whether you used a seed game, your selected store country, how many results were returned, the match percentage of the best result, and the size of your library.
- Clicks on recommendations: which recommended game you opened, its position in the results grid and its match percentage.
- Feedback: the thumbs up or thumbs down you give a recommendation.
This is measured to find out whether the recommendations are actually any good — whether people click what the algorithm ranks first, and whether a change to the scoring made things better or worse. It sets no cookies and is not shared with anyone.
2.3 Technical data
- Server logs: the web server records the IP address, timestamp, requested address, response code and browser user-agent of each request. These logs exist to keep the service running and secure — diagnosing errors, and enforcing the per-IP rate limits that stop the service being abused.
- Cookies, analytics and session replay: covered separately in the Cookie Policy. Nothing non-essential is stored on your device, and no session recording takes place, unless you accept it in the cookie banner.
2.4 What is never processed
No passwords, no Steam credentials, no email address, no postal address, no telephone number, no payment or card data, no private messages, no friends list, and no data from a private Steam profile. This site never asks you to log in to Steam, and it could not read a private profile even if you wanted it to.
3. Why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Generating your recommendations, which is the service you asked for | SteamID64, library, playtime, achievements, wishlist | Performance of a service requested by you — Art. 6(1)(b) GDPR |
| Measuring and improving recommendation quality | Searches, clicks, feedback | Legitimate interest — Art. 6(1)(f) GDPR |
| Keeping the service available, secure and free of abuse | Server logs, IP address | Legitimate interest — Art. 6(1)(f) GDPR |
| Audience analytics and interface research (Google Analytics 4, Microsoft Clarity) | See the Cookie Policy | Your consent — Art. 6(1)(a) GDPR |
Where processing relies on legitimate interest, the interest is being able to tell whether the recommendation algorithm works and to protect the service from abuse. The data involved is limited, is not used to advertise to you, is never sold or shared, and is deleted on the schedule below. You may object to this processing at any time — see section 7.
4. Where the data comes from
Profile data is not collected from you directly. It is retrieved from the Steam Web API, operated by Valve Corporation, using the public identifier you submit. This site has no relationship with Valve and no access beyond what any member of the public can see on your profile.
5. How long data is kept
| Data | Retention |
|---|---|
| Search and click records | 90 days. They are then aggregated into daily totals that contain no SteamID64 and cannot be linked to any individual, and the detailed records are deleted. |
| Library, playtime, achievement and wishlist snapshots | 12 months from your last visit. They are kept so a returning visitor gets an instant result instead of a slow refetch from Steam. If you do not come back, they are deleted. |
| Thumbs up / thumbs down feedback | The rating itself is kept indefinitely as training data, but the SteamID64 is removed after 90 days. After that the rating is anonymous and can no longer be traced to anyone. |
| Server logs | 14 days, then automatically deleted. |
| Anonymous daily statistics | Kept indefinitely. They contain no identifiers of any kind and are no longer personal data. |
6. Who else sees the data
Your data is never sold, rented, or shared for advertising. It is not passed to any third party for their own purposes. It is handled by the following service providers, acting on instructions as data processors:
| Provider | Role | Location |
|---|---|---|
| OVH HISPANO S.L. C/ Alcalá 21, 5ª planta, 28014 Madrid, Spain |
Hosting. The database physically resides on their servers. | Gravelines, France (EU) |
| Cloudflare, Inc. | Content delivery, DDoS protection and bot filtering. Sees the IP address and request metadata of every visit. | United States, with global edge network |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 and Google Tag Manager. Only active if you accept analytics cookies. | European Union and United States |
| Microsoft Ireland Operations Ltd. / Microsoft Corporation | Microsoft Clarity: anonymised heatmaps and session replay, used to find parts of the interface that confuse people. Text entered into fields is masked in the browser before transmission. The script is not even loaded unless you accept analytics cookies. | European Union and United States |
International transfers
Cloudflare, Google and Microsoft may process data outside the European Economic Area, including in the United States. These transfers are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Google Analytics is only loaded if you consent, so declining the cookie banner means no analytics data leaves the EU on your behalf.
7. Your rights
Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD) you have the right to:
- Access — obtain a copy of the data held about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Restriction — have processing limited.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these, email [email protected] and include the Steam profile link or SteamID64 concerned, so the right records can be located. Requests are answered within 30 days.
Because everything stored is keyed to the SteamID64, deletion is complete and immediate: every record tied to that identifier is removed. The anonymous daily statistics contain no identifier and so are unaffected by a deletion request — there is nothing in them to trace back to you.
If you believe your data has been mishandled, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
8. Someone else’s profile
The tool accepts any public Steam profile, so it is technically possible to submit one that is not your own. Please only use it on your own profile, or on one you have permission to use. If data about you was submitted by someone else and you want it removed, email the address above and it will be deleted.
9. Automated processing
Recommendations are produced automatically, by comparing your public Steam data against that of other players and against game metadata. This is not automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR: the output is a list of game suggestions, and nothing follows from it unless you choose to act on it. No profiling is used for advertising.
10. Children
This service is not directed at children under 14, the age of digital consent in Spain under Article 7 LOPDGDD. If you are under 14, please do not use the site. If you believe a child under 14 has had data processed here, contact the address above and it will be deleted.
11. Security
The site is served exclusively over HTTPS. The database is not publicly reachable, administrative access uses key-based authentication only, and per-IP rate limiting protects against bulk extraction. No system is perfectly secure, but the data held here is deliberately minimal: no credentials, no contact details and no payment information exist to be stolen.
12. Changes to this policy
This policy may be updated as the service changes. The date at the top of the page always shows the version in force. Substantial changes affecting your rights will be announced on the site.