Privacy & cookies

Last updated September 5, 2026

This page explains exactly what PlayRadix stores about you, why, and how to get rid of it. It describes what the site actually does today — not what a template assumes a website does.

The short version

You can browse, search and compare prices without an account, and without being tracked.
There is no analytics, no advertising, and no third-party cookie on this site. Nothing about you is sold or shared for marketing.
If you make an account, we store what the account needs to work — and you can delete all of it yourself.
We never see a payment: buying happens on the store's own site, not here.

Who we are

PlayRadix is a personal, non-commercial project that compares PC game prices across stores. Downloading or deleting your data is self-service in your account settings; for anything those don't cover, write to privacy@playradix.com.

For GDPR purposes, the operator of PlayRadix is the data controller for the account data described below.

What we collect

Nothing in this section applies until you choose to create an account. Browsing the site anonymously creates no record of you beyond the preference cookies you set yourself and the ordinary server logs of our hosting providers.

Your account

A username, and an optional display name. An email address only if you register with one — signing in with Steam provides no email, and accounts made that way have none. If you set a password we store only an argon2id hash of it, never the password. If you sign in with Steam we store your Steam ID, and the profile name and avatar URL Steam publishes for it.

Keeping the account secure

Each active session is recorded with the browser's user-agent string and when it was last used, so you can see and revoke your own devices. Signing in from a browser and operating system we have not seen before is recorded — as a coarse fingerprint of the browser and OS family, never versions — together with the IP address of that sign-in, so we can tell you about it. Failed sign-in attempts are counted against an IP address to slow down guessing. Security events (sign-ins, password and two-factor changes, deletions) go to an append-only audit log. If you enable two-factor authentication its secret is encrypted at rest; backup codes are stored only as hashes. For a passkey we store only the public key — the private key never leaves your device.

What you build on the site

Your wishlist, your library of owned games, any collections you create, your price alerts and their thresholds, your notification preferences, and the in-app notifications you have been sent. These reference games by an id only — a game's title, art and price are fetched fresh from the catalog every time a page renders, never copied into your account.

If you import a Steam library

We ask Steam for the games on the account you signed in with, and store each matched game together with the playtime and last-played time Steam reports, exactly as reported. This runs only when you ask for it. If your Steam profile is private, Steam tells us nothing and we store nothing.

Your preferences

The theme and display currency you pick are stored in cookies so the page renders correctly on the first paint, and — if you are signed in — on your account too, so they follow you between devices.

What we do not collect

No analytics, tracking pixels, advertising identifiers, or third-party cookies.
No payment or card details. We never take a payment; the buy links lead to the store, which handles the purchase entirely.
No Steam password. Signing in with Steam happens on Steam's own site; we only receive the confirmed Steam ID.
No location data beyond what an IP address implies, and we do not build a location profile from it.
No profile is built from your browsing. We do not log which games you look at.

Searches that find nothing

When a search matches no game, the search text alone is sent to our catalog service so the game can be looked up and added — that is how the catalog grows toward what people actually search for. Nothing identifying travels with it: no account id, no IP address, no session. Your IP is used only on our own server, before that, to limit how many such reports one visitor can trigger.

Why we are allowed to hold it

Under the GDPR, each piece of the above rests on one of these grounds:

Performance of a contract — the account, wishlist, library, collections and price alerts exist because you asked for them, and cannot work without the data they hold.
Legitimate interests — keeping accounts secure and the service standing up: session records, sign-in throttling, the audit log, and new-device notices. We keep these minimal and, where a fingerprint is enough, we avoid storing the underlying detail.
Consent — the weekly deals email, which is off unless you turn it on, and which every message can unsubscribe you from in one click.
Your own choice — the theme and currency cookies exist to remember a preference you expressed.

Cookies

9 cookies, all of them either strictly necessary or a preference you set yourself. There are no analytics, advertising or third-party cookies on this site, which is why you are not being asked to consent to any. If that ever changes, a consent banner will appear before the cookie does.

Cookie	What it is for	How long it lasts
`session`	Keeps you signed in. Holds an opaque random token; the server stores only its SHA-256 hash, so a database leak cannot be replayed as a login.	30 days, renewed as you use the site; cleared on sign-out
`session_user`	Your username and display name, so the header can show who is signed in without a database lookup on every page. Never carries your role or email.	30 days
`session_verified`	A presence-only marker set just after your session was checked against the database, letting the next few page loads skip that check. Carries no data and grants no access.	60 seconds
`steam_auth_nonce`	Ties a “Sign in with Steam” round trip to the browser that started it, so someone else's login cannot be completed in your browser.	10 minutes
`webauthn_challenge`	A single-use challenge for registering or using a passkey.	5 minutes
`theme`	The light, dark or system appearance you chose.	1 year
`currency`	The display currency you chose.	1 year
`lens`	The platforms whose prices you chose to compare.	1 year
`display`	How much detail game cards show (compact or per-platform prices).	1 year

The first five are strictly necessary: without them you could not sign in or stay signed in. The last four exist only because you picked something and we are honouring it — clearing them simply restores the defaults.

Who else touches your data

We do not sell your data, and we do not share it for anyone's marketing. A small number of providers process it on our behalf so the service can run:

Neon — hosts the database your account lives in.
Vercel — hosts and serves this site, and as part of serving it processes ordinary request data, including your IP address.
Render — hosts the price-comparison catalog service. It holds no personal data at all: the catalog stores games, stores and prices, and the site never sends it anything about you.
Resend — sends transactional email, and so receives the address and the message. Email delivery is currently not configured in production, which means no email is sent at all today.
Valve (Steam) — only if you sign in with Steam or import your library, and only for what those actions need.
Our game data sources — IGDB/Twitch and the stores we compare — receive nothing about you. We read prices and game information from them; they are never told who is looking.

We would also disclose data where the law genuinely requires it. Nothing of that kind has ever been requested.

How long we keep it

Account data is kept until you delete your account. Deleting it removes your user record and everything hanging off it — sessions, any linked Steam account, wishlist, library, collections, alerts, notifications and preferences, passkeys, backup codes and known devices — in the same operation.
Security audit entries are the one exception: they survive account deletion with the link to you severed, keeping only the action, the time, and the username that performed it. A security record that any account holder could erase would not be a security record.
A scheduled job continuously deletes what has stopped being useful: expired sessions, email verification and password-reset tokens once used or expired, and sign-in throttling rows once their window has passed.
Your in-app notification list keeps the most recent 100 entries; older ones are deleted automatically.
A session expires 30 days after it was last used, and signing out deletes it immediately.

Your rights

Wherever you are, and in the terms the GDPR uses, you can:

See everything we hold about you and get a copy of it. Account settings has a one-click “Download my data” — no need to ask us.
Correct anything wrong — most of it you can edit directly in your account settings.
Have it all deleted. This is self-service: account settings will delete your account and its data outright, without asking us.
Object to, or ask us to restrict, processing that rests on our legitimate interests.
Take your data with you: the same “Download my data” export is machine-readable JSON.
Withdraw consent for the weekly digest at any time — every one of those emails has a one-click unsubscribe, and the setting is in your account.
Complain to your local data protection authority if you think we have got this wrong.

To exercise anything that is not already a button in your account, write to privacy@playradix.com. We will not ask you to justify the request, and we will answer within 30 days.

Public profiles

Your profile is private unless you deliberately make it public, and every section of it — wishlist, library, collections, playtime — is separately off until you turn it on. Having never touched those settings is treated as private, not as undecided. Public profiles are also marked so search engines do not index them.

How it is protected

Passwords are hashed with argon2id. Session tokens, email links and two-factor backup codes are stored only as hashes, so what is in the database cannot be used to sign in. Two-factor secrets are encrypted at rest. Passkeys store only a public key. All traffic is over HTTPS, and the account database is separate from the catalog, which has no user data in it at all.

Where it is processed

Our providers operate internationally and may process data outside your country. Where they do, they rely on the European Commission's standard contractual clauses or an equivalent safeguard.

Children

This site is not directed at children under 16, and we do not knowingly collect their data. If you believe a child has made an account, write to privacy@playradix.com and we will remove it.

Changes

If this policy changes in a way that affects what we collect or why, we will update the date at the top and, where the change is significant, tell account holders directly rather than relying on you to re-read this page.