Privacy Policy
Last updated: 13 October 2026
GameRecommenderMatch has no accounts, no logins and no passwords, and never asks for your name, email address or payment details in order to recommend you anything. It works by reading the parts of your Steam profile that you have already made public. The one exception is the contact form, where you choose to give a name and an address so you can be answered: that is covered in section 2.4. This page explains exactly what is read, what is stored, for how long, and how to have it deleted.
1. Who is responsible for your data
| Controller | Manuel Quiles Sánchez (individual) |
|---|---|
| [email protected] |
Use the contact form if you need legal details.
No Data Protection Officer has been appointed, as none is required under Article 37 GDPR for a project of this nature.
2. What data is processed
2.1 Data obtained from your Steam profile
When you submit a Steam profile, the site resolves it to a SteamID64 — the 17-digit public identifier Steam assigns to every account — and requests the following from Steam’s public Web API:
- Your games library: which games you own, total playtime per game, playtime in the last two weeks, and when each was last played.
- Achievements: your completion percentage in the games you have played most, and when you last unlocked one.
- Steam Replay: if your Steam Replay (Steam’s yearly review) is public, which games you played in each month of past years. Like the date of your latest achievement, it is used only to estimate when you last played a game, so the “Your games got bigger” section shows updates released after that. Steam gives the real last-played date to no one but the account owner. For the same reason, your playtime is compared with your previous visit: a game whose playtime grew was played since then.
- Wishlist: which games you have wishlisted, used to avoid recommending what you already want and to measure whether the suggestions match your taste.
- Display name and avatar: shown in the results header so you can see whose profile was loaded. These are sent to your browser and are never written to the database.
Under GDPR a SteamID64 is personal data, because it can be linked back to an identifiable person through their public Steam profile. It is therefore treated as personal data throughout this policy, even though it is a public identifier.
Only public profiles can be processed. If your Steam profile or its game details are set to private, Steam returns nothing and the tool cannot work — there is no way for this site to see private data.
2.2 Data generated by using the site
- Searches: which filters you applied, whether you used a seed game, your selected store country, how many results were returned, the match percentage of the best result, and the size of your library.
- Clicks on recommendations: which recommended game you opened, its position in the results grid and its match percentage.
- Feedback: the thumbs up or thumbs down you give a recommendation.
This is measured to find out whether the recommendations are actually any good — whether people click what the algorithm ranks first, and whether a change to the scoring made things better or worse. It sets no cookies and is not shared with anyone.
2.3 Technical data
- Server logs: the web server records the IP address, timestamp, requested address, response code and browser user-agent of each request. These logs exist to keep the service running and secure — diagnosing errors, and enforcing the per-IP rate limits that stop the service being abused.
- Cookies, analytics and session replay: covered separately in the Cookie Policy. Nothing non-essential is stored on your device, and no session recording takes place, unless you accept it in the cookie bar.
2.4 Data you send through the contact form
If, and only if, you use the contact form, the following is stored: the name, email address, subject and message you typed, the date and time you ticked the consent box, and the IP address and browser user-agent of the submission.
The name, subject and message are there so the message can be answered. The email address is used only to reply to you: it is never added to a mailing list, never used for marketing, and never passed to anyone. The consent timestamp exists so it can be shown, if it is ever disputed, that the policies were accepted. The IP address and user-agent are kept only to deal with abuse of the form, duplicate what the server logs already record, and are erased after 14 days.
The form is protected by Google reCAPTCHA v3, which decides whether a submission looks automated. Google receives the IP address and interaction signals of that submission, and the resulting score is stored with the message. The reCAPTCHA script is not loaded when the page opens; it is fetched only once you start filling the form in, so reading this site sends nothing to Google on its account. See section 6 and the Cookie Policy.
Nothing in the form is required to use the recommendation tool. Not using the form means none of this data exists, and you can always write directly to [email protected] instead.
2.5 What is never processed
No passwords, no Steam credentials, no postal address, no telephone number, no payment or card data, no private messages, no friends list, and no data from a private Steam profile. This site never asks you to log in to Steam, and it could not read a private profile even if you wanted it to. No email address is processed at all unless you send one yourself through the contact form or by writing to the address above.
3. Why, and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Generating your recommendations, which is the service you asked for | SteamID64, library, playtime, achievements, Steam Replay, wishlist | Performance of a service requested by you — Art. 6(1)(b) GDPR |
| Building anonymous statistics about games, such as how long players tend to spend in each one | Playtime per game, turned into totals with no SteamID64 attached | Legitimate interest (Art. 6(1)(f) GDPR) |
| Measuring and improving recommendation quality | Searches, clicks, feedback | Legitimate interest — Art. 6(1)(f) GDPR |
| Counting where visits come from, such as a search engine, a forum or a link someone shared | The domain of the site that linked here and any campaign tags in the
link (utm_source, utm_medium,
utm_campaign), and the country Cloudflare derives from your
connection, added to anonymous totals per ten minutes. No IP address,
identifier or cookie is stored with them |
Legitimate interest — Art. 6(1)(f) GDPR |
| Keeping the service available, secure and free of abuse | Server logs, IP address | Legitimate interest — Art. 6(1)(f) GDPR |
| Answering a message you sent through the contact form | Name, email address, subject, message | Your consent, and steps taken at your request — Art. 6(1)(a) and 6(1)(b) GDPR |
| Keeping the contact form free of automated abuse (Google reCAPTCHA v3, rate limiting, consent timestamp) | IP address, user-agent, reCAPTCHA score, consent timestamp | Legitimate interest, and a legal record of consent — Art. 6(1)(f) GDPR |
| Audience analytics and interface research (Google Analytics 4, Microsoft Clarity) | See the Cookie Policy | Your consent — Art. 6(1)(a) GDPR |
Where processing relies on legitimate interest, the interest is being able to tell whether the recommendation algorithm works, to publish anonymous statistics about games, and to protect the service from abuse. Search, click and feedback records keep their SteamID64 for 12 months because judging whether recommendations improve needs a full year of history, including Steam’s seasonal sales, when searching habits change. The data involved is limited, is not used to advertise to you, is never sold or shared, and is deleted or anonymized on the schedule below. You may object to this processing at any time — see section 7.
4. Where the data comes from
Profile data is not collected from you directly. It is retrieved from the Steam Web API, operated by Valve Corporation, using the public identifier you submit. This site has no relationship with Valve and no access beyond what any member of the public can see on your profile.
5. How long data is kept
| Data | Retention |
|---|---|
| Search and click records | The records are kept, but the SteamID64 is removed after 12 months. After that they are anonymous and can no longer be traced to anyone or linked to each other. |
| Library, playtime, achievement, Steam Replay and wishlist snapshots | 12 months from your last visit. They are kept so a returning visitor gets an instant result instead of a slow refetch from Steam. If you do not come back, they are deleted. Just before deletion, playtime is added to anonymous per-game totals (how many players fall into each playtime range for a game, and their combined hours), which contain no SteamID64 and cannot be traced back to you. |
| Thumbs up / thumbs down feedback | The rating itself is kept indefinitely as training data, but the SteamID64 is removed after 12 months. After that the rating is anonymous and can no longer be traced to anyone. |
| Contact form messages | 24 months. Kept so a conversation can be picked up again and so there is a record of what was asked and answered. You may ask for yours to be deleted sooner at any time. |
| IP address and user-agent stored with a contact message | 14 days, then erased from the message, which is kept without them. |
| Server logs | 14 days, then automatically deleted. |
| Anonymous daily statistics and per-game playtime totals | Kept indefinitely. They contain no identifiers of any kind and are no longer personal data. |
6. Who else sees the data
Your data is never sold, rented, or shared for advertising. It is not passed to any third party for their own purposes. It is handled by the following service providers, acting on instructions as data processors:
| Provider | Role | Location |
|---|---|---|
| OVH HISPANO S.L. C/ Alcalá 21, 5ª planta, 28014 Madrid, Spain |
Hosting. The database physically resides on their servers. | Gravelines, France (EU) |
| Cloudflare, Inc. | Content delivery, DDoS protection and bot filtering. Sees the IP address and request metadata of every visit. | United States, with global edge network |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 and Google Tag Manager. Only active if you accept analytics cookies. | European Union and United States |
| Google Ireland Ltd. / Google LLC | reCAPTCHA v3 on the contact form, to tell a person from a script. Only loaded once you begin filling that form in, and on no other page. | European Union and United States |
| Cloudflare, Inc. | Email Routing. Mail addressed to [email protected] is forwarded through Cloudflare to the operator’s own mailbox, so a message you send by email, or a reply sent to you, passes through it. | United States, with global edge network |
| Microsoft Ireland Operations Ltd. / Microsoft Corporation | Microsoft Clarity: anonymized heatmaps and session replay, used to find parts of the interface that confuse people. Text entered into fields is masked in the browser before transmission. It does not record or set cookies unless you accept analytics cookies, via the same Google Consent Mode signal used for Analytics. | European Union and United States |
International transfers
Cloudflare, Google and Microsoft may process data outside the European Economic Area, including in the United States. These transfers are covered by the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework. Google Analytics is only loaded if you consent, so declining in the cookie bar means no analytics data leaves the EU on your behalf.
7. Your rights
Under the GDPR and Spanish Organic Law 3/2018 (LOPDGDD) you have the right to:
- Access — obtain a copy of the data held about you.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted.
- Restriction — have processing limited.
- Objection — object to processing based on legitimate interest.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent at any time, without affecting the lawfulness of processing carried out beforehand.
To exercise any of these, use the contact form or email [email protected], and include the Steam profile link or SteamID64 concerned, so the right records can be located. Requests are answered within 30 days.
Because everything stored about your recommendations is keyed to the SteamID64, deletion is complete and immediate: every record tied to that identifier is removed. Anonymized search, click and feedback records, the anonymous daily statistics and the per-game playtime totals contain no identifier and so are unaffected by a deletion request — there is nothing in them to trace back to you.
A message you sent through the contact form is keyed to nothing but itself, so to have one deleted, say which one: the address you used and roughly when you wrote is enough. It is erased the same day, and in any case automatically after 24 months.
If you believe your data has been mishandled, you may lodge a complaint with the Spanish supervisory authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid — www.aepd.es.
8. Someone else’s profile
The tool accepts any public Steam profile, so it is technically possible to submit one that is not your own. Please only use it on your own profile, or on one you have permission to use. If data about you was submitted by someone else and you want it removed, email the address above and it will be deleted.
9. Automated processing
Recommendations are produced automatically, by comparing your public Steam data against that of other players and against game metadata. This is not automated decision-making with legal or similarly significant effects within the meaning of Article 22 GDPR: the output is a list of game suggestions, and nothing follows from it unless you choose to act on it. No profiling is used for advertising.
10. Children
This service is not directed at children under 14, the age of digital consent in Spain under Article 7 LOPDGDD. If you are under 14, please do not use the site. If you believe a child under 14 has had data processed here, contact the address above and it will be deleted.
11. Security
The site is served exclusively over HTTPS. The database is not publicly reachable, administrative access uses key-based authentication only, and per-IP rate limiting protects against bulk extraction. No system is perfectly secure, but the data held here is deliberately minimal: no credentials, no contact details and no payment information exist to be stolen.
12. Changes to this policy
This policy may be updated as the service changes. The date at the top of the page always shows the version in force. Substantial changes affecting your rights will be announced on the site.