Draft — pending legal review. This document was drafted by the engineering team to unblock App Store / Play Store submission and is not a substitute for review by a lawyer. This document is a draft pending legal review.
Privacy Policy
Last updated: October 4, 2026
This Privacy Policy explains what data SaveState collects, why, and the controls you have over it.
1. Data We Collect
| Category | Examples | Why |
|---|---|---|
| Account | Email, username, avatar, password (hashed by our auth provider) | Create and secure your account |
| Profile | Preferred platform, gaming rig (GPU/CPU/RAM), avatar frame, profile background, bio | Personalize your profile |
| Activity | Reviews, ratings, lists, comments, likes, follows, hours played, backlog status | Core app functionality |
| Connected accounts | Steam ID and library (if you link Steam) | Import your play history |
| Notifications | Push token (via OneSignal), in-app notification preferences | Notify you about activity |
| Subscription | Premium status, subscription expiry (via RevenueCat/App Store/Play Store) | Manage Premium features |
| Device/usage | Basic diagnostic and advertising identifiers (free tier only) | Ads (AdMob), crash diagnostics |
We do not collect more than what's listed above, and we do not sell your personal data.
2. Legal Basis (EU/UK users)
We process your data based on: performance of a contract (running your account), legitimate interest (app functionality, fraud prevention), and consent (personalized ads, marketing emails, where applicable).
3. Third-Party Services
SaveState uses these third-party processors:
- Supabase — database, authentication, file storage
- IGDB / Twitch — game metadata (titles, covers, ratings)
- Google AdMob — advertising (free tier only)
- RevenueCat — subscription management
- OneSignal — push notifications
- Steam Web API — optional library import, only if you connect your Steam account
- Resend — delivery of account emails (sign-up confirmation, password reset)
- Google and Apple — sign-in, only if you choose to sign in with them
- Cloudflare — hosting and DNS for savestateapp.com
Each of these providers processes data under their own privacy policy in addition to this one.
4. Advertising & Consent
If you are in the European Economic Area or UK, you will be shown a consent prompt (via Google's User Messaging Platform) before any personalized advertising is served. You can opt out of ad personalization at any time from your device's ad settings. On iOS, we request App Tracking Transparency permission before accessing the advertising identifier for cross-app tracking.
5. Data Retention & Account Deletion
When you delete your account (Settings → Delete Account), we:
- Permanently remove your login credentials (email, password) from our authentication system — you can never sign back in.
- Delete data unique to you that isn't shown to others: your linked Steam account and any verification requests you submitted.
- Anonymize, rather than delete, your public profile, reviews, ratings, lists, and comments — your username is replaced with a generic "deleted_user" identifier and your avatar/customizations are removed. We do this so that other users' comments, likes, and replies that reference your content don't break or disappear — the content itself stays attributed to an anonymous placeholder instead of a real identity.
This is a deliberate design choice, not an oversight: full hard-deletion of every row referencing your account would silently delete other users' replies, likes, and list favorites too. If you'd like your review/list text itself removed rather than anonymized, contact us at legal@savestateapp.com and we'll handle it manually.
6. Your Rights
Depending on your location (GDPR, LGPD, CCPA, etc.), you may have the right to: access the personal data we hold about you, request a copy of it (Settings → Export My Data gives you a JSON download immediately, no request needed), correct inaccurate data, request deletion (see Section 5), and object to certain processing (e.g., ads).
7. Children's Privacy
SaveState is not directed at children under 13, and we do not knowingly collect data from them. If you believe a child under 13 has created an account, contact us and we will remove it.
8. Security
We use industry-standard measures (encryption in transit, hashed passwords, row-level database access control) to protect your data. No system is 100% secure, and we cannot guarantee absolute security.
9. International Transfers
Your data may be processed in countries other than your own, including the United States, by our service providers listed above.
10. Changes to This Policy
We'll notify you in-app of material changes to this policy.
11. Contact
Questions or requests about your data? Contact legal@savestateapp.com.