Privacy policy

Who is responsible

Game Hangout is a private project. Responsible for personal data on this website and in the Game Hangout app (the "controller" under the GDPR) is:

Timo Schafarik
Lionstraße 15
95030 Hof
Germany

Email: hello@game-hangout.com

The short version

• The app runs on your PC. Your friends list, your worlds and your settings stay there. There is no Game Hangout account, no analytics and no tracking - not on the website, not in the app.
• In a hangout your PC talks directly to your friends' PCs, so the people in a hangout can see your IP address, as in most multiplayer games.
• If you connect your Discord or Steam account, we keep its id, your name there, the year the account was made and the name of your PC, so your friends can recognise you. Your friend link and the invite link to a hangout you host carry the id and the name too, so whoever has the link can read them. We never see your password, your email, your messages or your friends.
• When you ask for a game on the website, we keep a scrambled form of your IP address, so the same person cannot vote many times.

1. The website

Hosting

game-hangout.com is hosted by Vercel Inc. (USA); the website's server functions run in Frankfurt. When you open a page, your browser sends the usual technical data - your IP address, the address of the page, the time, the name of your browser - and Vercel processes it to deliver the page and to protect the site against attacks. We do not use it to find out who you are.

Links from the app: in a friend link, an invite link or a shared modpack, everything after the # never leaves your browser - it goes straight to the app. The part before it (for example the id and the name in /join/...?name=...) reaches Vercel like any page address. On a friend link's page, the Download button also copies that link to your clipboard, and the page says so: it stays on your computer, so the app can offer to save that friend when it starts for the first time.

Legal basis: our legitimate interest in a website that works and stays safe (Art. 6(1)(f) GDPR).

Fonts

The website's fonts come from the website itself. Your browser fetches nothing from Google or any other font service.

Asking for a game

On the home page you can ask for a game to be supported. We then store the game's name, the time, and a scrambled form of your IP address: a SHA-256 hash with a secret value mixed in, shortened - never the address itself. It lets us count every person once per game and limit requests to three a day. The data lies in a database run by Supabase (Supabase Pte. Ltd., Singapore) on servers in Frankfurt, and is kept as long as the list of requests exists.

Your browser also remembers which games you asked for (local storage on your device), so the ticks stay when you come back. That never leaves your browser.

Legal basis: a fair count and protection against abuse - our legitimate interest (Art. 6(1)(f) GDPR).

Cookies

The website sets no cookies, with two exceptions, each for ten minutes:

• While you connect an account (section 2), a cookie named __Host-gh_connect_discord or __Host-gh_connect_steam holds a random number together with what your app sent to start the connection - your app's public key, the name of your PC and the kind of account - signed by us, so that the login can only be finished in the browser that started it, and only for that app.
• While you log in at game-hangout.com/connect to see your devices, a cookie named __Host-gh_manage_discord or __Host-gh_manage_steam holds only a random number, for the same reason.

They are technically necessary for what you asked for (§ 25(2) no. 2 TDDDG).

2. Connecting your Discord or Steam account

Connecting is optional. When you press Connect Discord or Connect Steam in the app:

1. Your browser opens game-hangout.com with an address your app signed. It holds your app's public key, a second key your app uses for messages between friends, and the name of your PC (the computer name Windows gives it). Like every page address, it reaches Vercel and can appear in its request logs. We put what we need of it into a cookie (section 1) and send your browser on to Discord's or Steam's own login page. Your password goes only to them.
   • Discord asks you to allow Game Hangout to read your identity - Discord's permission called identify. Not your email, not your servers, not your messages, not your friends. Discord hands over your user id and your username with a few profile details, such as your avatar and your language; we read only the id and the username. The year the account was made follows from the id. The access token Discord hands us is used once, for exactly this, and then revoked - we never store it.
   • Steam ("Sign in through Steam") tells us only your Steam id, and hands us no token. Steam sends your browser back to us with the id in the page address, so that address reaches Vercel too. With the id we ask Steam's Web API for your public profile: we take your profile name and the year the account was made (Steam shows that only for a public profile; for a private one we keep no year). The rest of Steam's answer - your avatar, for example - is not kept.
2. After the login we write the waiting connection into the database at Supabase (servers in Frankfurt): your app's public key, the name of your PC, the account (its id, your name there, the year made) and a scrambled form of a one-time code that only your browser gets. Your app confirms it within ten minutes. Once your app has confirmed it, the account is taken out of the waiting connection at once. Confirmed or not, the waiting connection lapses after ten minutes and is deleted within a day after that - at the next connect anybody makes, or by the daily tidy.
3. When your app confirms, we store the connection: the account (Discord or Steam, its id, your name there, the year made), your app's public key, the name of your PC, and the dates of connecting and renewing. If your app was connected to another account of the same kind, that one is withdrawn (see below).
4. We sign a statement "this app belongs to this account" and send it to your app. The statement holds the account's id, your name there, the year made, your app's public key and its dates. Your app keeps it on your PC and shows it - the name, a tick and the year, and for Steam a link to your Steam profile - to the people you add as friends, so they can tell your friend link from a fake. The pages your friend link and your hangout's invite link open on game-hangout.com show the same to whoever opens the link. The account's id is in the statement too: whoever has one of these links can read it, and with a Discord or Steam id your profile there can be found.
5. A statement is good for 30 days. Before it runs out your app asks for a new one, signed with its own key - no login and no token involved; we note the date of the renewal. For Steam we read your profile name and the year again from your public profile at every renewal, as at the connect, and keep the new ones. For Discord nothing but a login reads your name, so a renewal keeps the name from your last connect, and a Discord connection is renewed for at most 90 days after that connect; then your app asks you to connect Discord again.
6. Your app hands the statement on to your friends' apps itself: in your friend link, in a friend request, and when your friends' apps and yours talk to each other. It does not pass through us. It also rides in the invite link to a hangout you host - and a friend in your hangout who has your statement puts it in the invite link they copy there, as it is about you as the host. In both links it sits after the #: the link's page reads and checks it in the visitor's own browser, and it never reaches us from there either.

When a connection is withdrawn - you disconnect, you remove a device, or your app is connected to another account of the same kind - we add it to a public list of withdrawn connections, so that your friends' apps stop showing the tick. The list holds a scrambled value per connection (a hash of the app's public key, the kind of account and the account id) and the time it was withdrawn - so that connecting again afterwards gets the tick back at once - and no names. The value is not secret from anybody who holds what it is made of. Your friend link and your hangout's invite link carry your app's public key and your account id, so whoever has one of them can compute the value and see whether and when that connection was withdrawn. Without them, the list does not say whose connection is on it.

Every app downloads the whole list about once a day, and again before it shows a friend request or a friend link with a tick when its copy is more than an hour old - every hour, while such a request waits for an answer. The whole list, every time, so we never learn whose tick it checks. The pages of friend links and invite links download the same whole list when they show a tick. A connection leaves the list when it is deleted, 32 days after it was withdrawn.

Your app lists the devices your account is connected to (their PC names and dates) and can remove one or disconnect itself. It also asks for that list by itself, when it starts and once a day, and remembers on your PC which devices it has seen, so that it can tell you when a device it has not seen before was connected to your account. At game-hangout.com/connect you can see and remove your devices too, after logging in with Discord or Steam, for example for a PC that is lost: we read your account id and name as above (Discord's token is revoked right away) and show you your devices. Nothing new is stored by looking.

Limits: an account can be connected to at most three devices at a time, and to at most ten different apps within 30 days. For the second we count the connections of the last 30 days, the withdrawn ones included. To stop abuse, the connect pages also count requests per scrambled IP address for one minute, in memory only.

What it is for: letting your friends recognise you. Legal basis: you ask us to connect your account (Art. 6(1)(b) GDPR). Keeping withdrawn connections on the list, the limits and the count of requests protect your friends and the service against misuse - our legitimate interest (Art. 6(1)(f) GDPR).

How long:

• A connection is kept as long as it is connected. One you never disconnect stays even when the PC or the app is gone - remove it under Your accounts on another device, or at game-hangout.com/connect.
• When you disconnect, remove a device or connect another account of the same kind, the connection is marked as withdrawn and deleted 32 days later. A statement runs for up to 30 days, and other apps need those days to learn that the old one no longer counts; the two days more are for a clock that is off.
• You can ask us at any time to delete it right away: hello@game-hangout.com. Then every connection of that account is deleted at once - the account id, your name, the app keys, the names of the PCs. Only the scrambled value of each connection and the time it ended stay on the list of withdrawn connections, for 32 days, so that your friends' apps stop showing a tick that would otherwise still run; then they are deleted too.

What happens on Discord's and Steam's own pages is governed by their privacy policies.

3. The app

The app is a program on your PC. It has no account with us and sends us no usage data. Your identity key, friends list, settings, worlds, modpacks and logs stay on your PC.

When the app starts before you have given it a name - normally the very first time - it looks at your clipboard for a friend link that a friend link's page put there. It only takes such a link, and only offers to save that friend; nothing else on the clipboard is kept, logged or sent anywhere. Once you have given it a name, it never looks there again.

For connected accounts it also keeps there: the statements for your own accounts, the devices it has seen them connected to, its copy of the list of withdrawn connections, and a short memory of accounts - for each friend on your list the Discord and Steam accounts their app showed (kind, id, the newest name, at most eight), and the same for your own. That memory lets the app warn you when one of those accounts turns up on another app, even after your friend or you disconnected it. A friend's memory goes when you remove the friend.

Connections between PCs

Hangouts are peer to peer, built on iroh:

• Relays run by n0, Inc. help two PCs find each other and carry the traffic when there is no direct path. They see your IP address. What passes through them is encrypted end to end; they cannot read it.
• Your app publishes its public id together with its relay - not your IP address - in n0's lookup service, so your friends' apps can find it.
• Once somebody has been let into a hangout, the PCs in it connect directly where they can. Everybody in the hangout can then see your IP address, and you theirs. Only let people in you trust.

Legal basis: without the relays and the lookup service two PCs cannot find each other, so they are part of what you use the app for (Art. 6(1)(b) GDPR).

Services the app contacts directly

Directly from your PC - we receive nothing, and the services' own privacy policies apply:

• GitHub (USA): once, shortly after the app starts, it asks whether there is a new version; the new version is downloaded only when you choose to install it.
• Valve / Steam: SteamCMD and dedicated servers, Steam Workshop pages and pictures.
• Modrinth: Minecraft mods.
• Mojang / Microsoft and FabricMC: Minecraft server files.
• The game servers you install and run.

Apart from the update check, only when you use the feature. Legal basis: the feature you use (Art. 6(1)(b) GDPR); for the update check, our legitimate interest in every copy of the app being current and safe - copies of the app work together properly only on the same version (Art. 6(1)(f) GDPR).

Through our website

A few questions about Steam go via game-hangout.com, so that our Steam Web API key stays on our server: Steam ids, profile names, Workshop item ids and search words. We pass them to Steam and the answer back to your app, and store nothing. To stop abuse, the website counts requests per scrambled IP address for one minute, in memory only. Answers - public data, such as Steam names - are cached by Vercel for up to a day.

Legal basis: the feature you use (Art. 6(1)(b) GDPR); the count of requests protects the service against misuse - our legitimate interest (Art. 6(1)(f) GDPR).

Connecting accounts, and the list of withdrawn connections every app downloads about once a day: see section 2.

4. Who processes data for us, and other services

On our behalf (processors):

• Vercel Inc., USA - hosting and the website's server functions.
• Supabase Pte. Ltd., Singapore - the database, on servers in Frankfurt.

On their own account - services you or your app deal with, each responsible for what it does with the data under its own privacy policy:

• Discord Inc., USA - the login, when you connect your Discord account.
• Valve Corporation, USA - the login and the public profile, when you connect your Steam account, and the Steam services the app uses (section 3).
• n0, Inc., USA - the relays and the lookup service (section 3).
• GitHub, Modrinth, Mojang / Microsoft and FabricMC - section 3.

Where data leaves the EU, the transfer rests on an adequacy decision of the European Commission - for a company in the USA, the EU-US Data Privacy Framework where the company is certified under it - and otherwise on the EU standard contractual clauses in the company's terms.

5. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or deleted (Art. 17), to restrict its processing (Art. 18), to receive it in a portable form (Art. 20), and to object to processing that rests on our legitimate interest (Art. 21). Write to hello@game-hangout.com.

You also have the right to complain to a data protection supervisory authority (Art. 77 GDPR), for example the one where you live.

We make no automated decisions about you and build no profiles.

6. Changes

When what the website or the app does with data changes, this page changes with it. The date at the top says when it last did.