Privacy

The data controller is RetroLoot. To exercise your rights, or for any question, write to privacy@retroloot.app.

For the account: your email address, a username and — unless you sign in with Google or Apple — a password, which we store only as a hash and cannot read.

For the service: your collection and wanted list, meaning which games you own or are looking for, in what condition and with what notes. This is the data the product exists for.

To keep it running: server logs (IP address, browser, page requested) and, if you turn on notifications, your device push token. There are no profiling cookies and no third-party analytics.

To provide the service you asked for: without an email address and a collection there is no account and no tracker. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

To run your Plus subscription and meet the tax obligations that come with it, if you subscribe. Legal basis: contract and legal obligation (Art. 6(1)(b) and 6(1)(c)).

To keep the service up and secure, on our legitimate interest in not having it fall over or be abused (Art. 6(1)(f)).

Nobody for their own purposes: we do not sell or share data. We do rely on suppliers who process it on our behalf, as processors: the server host, Resend for transactional email, RevenueCat together with Apple and Google for subscriptions. The camera is not among them: the barcode is decoded on the phone, and what leaves it is the string of digits — never an image.

The stores handle payment directly: your card never passes through us and we never see its number.

Market prices come from PriceCharting and covers from public archives. Those are inbound feeds; none of your data goes out through them.

For as long as you keep the account. When you delete it we delete the account, the collection and the wanted list; server logs expire by themselves within twelve months, and invoices are kept for the period the law requires.

You can ask us for access, correction, erasure, restriction and portability, and object to processing based on legitimate interest. Write to privacy@retroloot.app: we answer within thirty days.

If you think we are getting it wrong you can complain to the supervisory authority in your country of residence.

One cookie, strictly functional, which keeps your session open after you sign in. It does not profile, does not follow you, and does not need your consent because without it you could not stay signed in.

The service is not aimed at anyone under 16. If we find an account belonging to a child we delete it.

If we change something substantial we update the date at the top, and where the change affects how we use your data we tell you by email before it takes effect.