Privacy Policy

What we collect

Your quiz

Your 10 swipes (pass, like or love), the taste profile and player type we work out from them, and the games we recommend. We keep every finished quiz, with or without an email, to improve our picks and to see how the site is doing.

Your email address, if you leave it

Plus your choices: Friday picks or “Just now”, and where you play (PC, laptop or Steam Deck) if you answer that question. We also keep a list of the games we’ve emailed you, so we never send the same one twice.

Your Steam library, only if you connect it

Sign-in happens on Steam’s own site, so we never see your password. Steam tells us your public SteamID, profile name and avatar. If your game details are public, we also receive the games you own, your wishlist and your playtime. We use them to skip games you already have and to learn what you like to play.

How you found us

The page you landed on, the site that sent you, any campaign tags in the link (UTM parameters) and your device type (desktop, tablet or phone).

Messages you send us

If you use the contact form, we receive your email address, your name if you give it, and your message. They arrive in our team inbox by email.

Anonymous counts and security

We count steps like “visited”, “started the quiz” and “finished the quiz” as hourly totals with no identifiers attached. To stop spam and abuse, we rate-limit requests using a one-way hash of your IP address. We never store the address itself, and those hashes are deleted within a day. Our hosting provider keeps standard server logs (such as IP address and browser type) for a short time for security and debugging.

Analytics and ad measurement

We use Google Analytics to see how people use addwl: pages viewed, each quiz step (including your reaction to each game), clicks through to Steam and signups. We use the Meta Pixel and Meta’s Conversions API to measure our ads on Facebook and Instagram and to show them to people who are likely to enjoy addwl. Meta learns when you start or finish the quiz, click through to Steam, sign up or send us a message. Both services receive your IP address, browser details and the page you’re on, and set their own cookies. When you leave your email, we also send Meta a one-way hash of it (never the address itself), so Meta can tell which ad brought you. We never send your email to Google.

We use the X Pixel and X Conversion API to measure visits from X ads and selected Act of Skull actions: starting play, completing training, seeing the full-game offer, opening Gumroad, verifying access and continuing play. X receives the ad click ID when available, IP address and browser details. Our server conversion reports use the game page URL without query parameters and contain no email, phone number, license key, save data or game error details. A verified unlock may be free or a restored key; it is not reported as a paid purchase. X tracking follows your cookie choice and Global Privacy Control.

In Act of Skull, Google Analytics also receives game loading, tutorial progress, upgrade purchases using virtual currency, run results, play duration and campaign milestones. Saves and detailed run journals stay on your device; we do not upload them. You can change your cookie choice under Save → Cookie settings in the game.

When analytics is allowed, we also store Act of Skull statistics in our database: random browser and session IDs, device category, active playtime, how far you have progressed in the game, and counts of game actions, full-game popup views, Gumroad clicks, verified unlocks and continued play. These reports contain no email, license key, save data or raw IP address. They help us measure visitors and improve the game and its full-game access flow.

When analytics is allowed, game error reports also include a shortened error message and call stack, game version, screen, recent action names, browser family and version, operating system and screen size. We remove common email, credential and URL-query patterns from diagnostic text before storage. Reports do not include form inputs or save contents. These details help us find and fix crashes.

If your device’s time zone is in the EU, EEA or UK, none of this loads until you accept it in our cookie banner. Anywhere else it’s on by default. Either way, you can switch it off under “Cookie settings” at the bottom of every page.

How we use it

• To show you your pick and your matches, and to email them to you.
• To send your Friday picks, if you chose them.
• To improve our recommendations and understand which parts of the site work.
• To measure our ads and show them to people who might like addwl.
• To answer your messages.
• To keep addwl secure and free of spam.

We don’t sell or rent your personal data. The only data we pass to Google, Meta and X is the analytics and ad measurement described above. If you’re in the EU, EEA or UK: we rely on your consent for emails, for linking Steam and for analytics and ad cookies. You can withdraw it any time by unsubscribing, disconnecting or switching the cookies off under “Cookie settings”. Quiz stats, security and improving the service rely on our legitimate interest in running addwl.

Cookies and browser storage

Google Analytics and the Meta and X pixels set their own cookies (such as _ga, _fbp and _twclid) to tell visits apart and to measure ads. In the EU, EEA and UK they’re set only after you accept them. Besides those, your browser keeps a few small things for addwl:

• a random access key (local storage) that keeps your unlocked matches available when you come back;
• your cookie choice (local storage), so we don’t ask again for six months;
• an X ad click ID (local storage), kept for up to 30 days when advertising tracking is allowed and cleared when you opt out;
• Act of Skull progress (local storage) and its detailed run journal (IndexedDB), with export controls in the game;
• an Act of Skull analytics browser ID (local storage), used for up to 180 days when analytics is allowed and removed when you switch analytics off in the game;
• where you came from and which quiz steps were already counted (session storage, cleared when you close the tab);
• a short-lived cookie while you sign in with Steam, which expires after 10 minutes.

Game art is loaded from Steam’s image servers, so Valve can see your IP address when your browser loads those images, as with any site that shows Steam art.

To change your choice, use “Cookie settings” at the bottom of any page. Switching the cookies off also deletes the ones already set. You can also block cookies in your browser settings or install Google’s Analytics opt-out add-on. If your browser sends a Global Privacy Control signal, we don’t load the Meta or X pixels or send their server conversion events.

Who processes data for us

We use a few trusted providers, and each of them only processes data to run its part of addwl:

• Vercel hosts the website.
• Supabase hosts our database, in the United States.
• Resend delivers our emails.
• Valve (Steam) handles Steam sign-in and provides library data, only if you connect Steam.

Google (Google Analytics), Meta (Meta Pixel and Conversions API) and X (X Pixel and Conversion API) receive the analytics and ad measurement data described above, and also use it under their own privacy policies: Google, Meta, X.

Your data is processed in the United States. When you click through to a game, you’re on Steam, and Steam’s own privacy policy applies there.

How long we keep it

• Email and preferences: until you ask us to delete them. When you unsubscribe, we keep your address marked as unsubscribed so we don’t email you again.
• Steam data: until you disconnect Steam. We delete it right away when you do.
• Quiz results: kept to improve our picks. If you ask us to delete your data, we delete your email, and your quiz results stay only as anonymous answers that aren’t linked to you.
• Messages: kept in our inbox for as long as we need them to help you.

Your choices and rights

• Unsubscribe with one click from any email we send.
• Disconnect Steam from your results page. Your library data is deleted immediately.
• Switch off analytics and ad cookies under “Cookie settings” at the bottom of any page.
• Access, correct or delete your data, or get a copy of it: send us a privacy request. We reply within 30 days.

Depending on where you live (for example under the GDPR in the EU and UK, or the CCPA in California), you may also have the right to object to or restrict how we use your data, and to complain to your local data protection authority. We don’t sell personal information. Using the Meta and X pixels to measure and target ads may count as “sharing” under the CCPA. To opt out, switch the cookies off under “Cookie settings” or turn on Global Privacy Control in your browser, and we’ll stop sending your data to Meta and X.

Children

addwl isn’t meant for children under 13, and we don’t knowingly collect their data. If you think a child has given us their email, let us know and we’ll delete it.

Changes

If we change this policy, we’ll update this page and the date at the top. If a change is significant and you’re subscribed, we’ll tell you by email.

Contact

Questions about your data? Use the contact form and choose “Privacy request”.