Privacy Policy
This policy explains what personal information [LEGAL ENTITY NAME] (“Gamendar”, “we”) collects when you use gamendar.org, why, who we share it with, and the choices and rights you have. We are the “controller” of this information for GDPR purposes. Contact: [email protected].
Summary: we collect what we need to run a scheduling service for your groups. We don’t sell or “share” your personal information for advertising, we don’t use advertising or analytics trackers, and we use only the cookies needed to keep you signed in.
1. Information we collect
| Category | Examples | Source |
|---|---|---|
| Account details | Username, email address, password (stored only as a one-way Argon2 hash), country, acceptance of Terms | You |
| Age check | We ask your date of birth to confirm you meet the minimum age, but we don’t store it, only that the check passed | You |
| Profile | Profile picture (re-encoded, with location and other metadata removed) | You |
| Social sign-in | Provider account ID, and the email and display name the provider shares | Google, Apple, Discord, Facebook, Roblox, Twitch or X, if you use them |
| Security | Two-factor secret (encrypted), hashed recovery codes, sign-in sessions, IP address, browser user-agent, a log of security events such as sign-ins and password changes | You and your device |
| Groups and scheduling | Groups you’re in and your role, events, your availability, times and notes | You and your groups |
| Communications | Emails we send you, your notification preferences, messages you send to support | You and us |
| Billing (Group Admins who subscribe) | Subscription status, billing country and the last four digits/brand of your card as reported by Stripe. We never receive or store full card numbers. | Stripe |
We don’t collect precise location, contacts, or any sensitive personal information as defined by the CCPA/CPRA (other than account log-in credentials, which we use only to sign you in).
2. How we use it, and our legal bases (GDPR)
| Purpose | Legal basis |
|---|---|
| Create and run your account and groups; show your availability to members of your groups; send the notifications you or your Group Admins turn on | Performance of our contract with you (Art. 6(1)(b)) |
| Security: authentication, preventing fraud and abuse, rate limiting, account-activity notices | Legitimate interests in keeping the Service and accounts safe (Art. 6(1)(f)) |
| Billing and tax records | Contract, and legal obligation (Art. 6(1)(c)) |
| Service emails (verification, password reset, security notices, trial-ending reminders) | Contract and legitimate interests |
| Optional email notifications about your groups | Your consent, which you can withdraw any time with the unsubscribe link or in settings (Art. 6(1)(a)) |
| Complying with law and responding to lawful requests; enforcing our Terms | Legal obligation and legitimate interests |
We don’t use your information for automated decision-making that has legal or similarly significant effects, and we don’t use it to train AI models.
3. Who we share it with
- Members of your groups see your username, profile picture, role and availability/notes for that group’s events.
- Integrations your Group Admins connect (Discord, Slack, Microsoft Teams, Telegram) receive event details, usernames and availability summaries for that group. Those services handle data under their own privacy policies.
- Service providers (processors) who act on our instructions under data-processing agreements:
Provider Purpose Location [HOSTING PROVIDER] Servers and database [REGION] [EMAIL PROVIDER] Sending email [REGION] Stripe, Inc. Payments and subscriptions United States [CDN / DDOS PROVIDER, e.g. Cloudflare] Network security and delivery Global - Sign-in providers you choose learn that you signed in to Gamendar.
- Legal and safety: when required by law, or to protect the rights, property or safety of users or the public.
- Business transfers: to a successor in a merger, acquisition or sale of assets, under this policy.
We do not sell personal information and do not share it for cross-context behavioral advertising, and have not done so in the past 12 months.
4. How long we keep it
- Account, group and availability data: while your account exists. When you delete your account it is erased from our live systems immediately, and from backups within [BACKUP RETENTION, e.g. 30] days. Your username is kept on a list of retired names so it can’t be reused.
- Security log: 12 months. Notification delivery log: 90 days. Sent-email records: up to 30 days.
- Billing records: as long as tax law requires (typically [7] years), held by Stripe and us.
5. Security
We use TLS for all connections, hash passwords with Argon2id, encrypt two-factor secrets and integration webhook addresses at rest, store sign-in and invite tokens only as hashes, offer two-factor authentication, and log security-relevant events you can review on your profile. No method is perfectly secure, but we will notify you and the relevant authorities of a breach as the law requires.
6. Your rights
Depending on where you live, you may have the right to: access and get a copy of your data; correct it; delete it; port it; restrict or object to some processing; withdraw consent; and not be discriminated against for exercising these rights. You can download your data and delete your account yourself on your profile page. For anything else, email [email protected]. We will verify your identity (usually by asking you to confirm from your account email) and respond within 30 days (GDPR: one month; CCPA: 45 days), extendable where the law allows. You may use an authorized agent; we may ask for proof of their authority.
EEA, UK and Swiss residents
You may lodge a complaint with your local data-protection authority. Where we transfer your data outside the EEA/UK (for example to the United States), we rely on the EU–US Data Privacy Framework where the recipient is certified, or on Standard Contractual Clauses (and the UK Addendum). [IF GAMENDAR HAS NO EU/UK ESTABLISHMENT: our EU representative under Art. 27 GDPR is [EU REPRESENTATIVE NAME AND ADDRESS]; our UK representative is [UK REPRESENTATIVE NAME AND ADDRESS].]
California residents (CCPA/CPRA)
In the past 12 months we collected the categories in section 1: identifiers (username, email, IP address, account IDs), customer records (billing status), internet/electronic activity (sign-in and security logs), and account log-in credentials, for the business purposes in section 2 (providing the Service, security, and billing), from the sources listed, and disclosed them only to the recipients in section 3. We don’t sell or share personal information, don’t knowingly sell or share the information of consumers under 16, and don’t use or disclose sensitive personal information beyond what the CPRA permits. You have the rights to know, delete, correct, and to opt out of sale/sharing and limit use of sensitive information (though we don’t do either), and to non-discrimination. California’s “Shine the Light” law: we don’t disclose personal information to third parties for their direct marketing.
Other US states
Residents of states with consumer privacy laws (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon and others) have similar rights. If we deny your request, you may appeal by replying to our decision; if we deny the appeal you may contact your state Attorney General.
7. Your privacy choices
- Do Not Sell or Share My Personal Information: we don’t sell or share personal information, so there is nothing to opt out of. We honor Global Privacy Control (GPC) signals anyway.
- Email notifications: off by default; change them per group in the group’s My notifications tab, or use the unsubscribe link in any notification email.
- Integrations: ask your Group Admin, or leave the group, if you don’t want your availability posted to a connected app.
- Your data: download it or delete your account from your profile.
8. Children
Gamendar isn’t directed to children under 13 and we don’t knowingly collect personal information from children under 13 (or under the age of digital consent in their country, up to 16 in the EEA). Sign-up requires an age check. If you believe a child has given us personal information, contact [email protected] and we will delete it.
9. Cookies
We use only strictly necessary cookies. See the Cookie Policy.
10. Changes
We will post changes here and update the date above; for material changes we will notify you by email or in the app in advance.
11. Contact
[LEGAL ENTITY NAME] · [STREET ADDRESS, CITY, STATE ZIP, COUNTRY] · [email protected]
Privacy questions and requests: [email protected]. [IF REQUIRED: Data Protection Officer: [DPO NAME AND CONTACT].]