Privacy Policy
Last updated: May 13, 2026
The short version
We collect the minimum data needed to make the app work. We don't sell your data and we don't track you across the web. We use Google Analytics to understand general usage patterns, but we don't use that data to identify you or build ad profiles. Your game library data stays in your browser unless you explicitly opt into cloud sync.
What we collect
If you use the app without an account
Nothing leaves your device. Your entire game library, settings, and preferences are stored in your browser's localStorage. We have no access to it. If you clear your browser data, it's gone.
Behavioral and preference data
To improve your recommendations over time, the app tracks how you interact with its suggestion engine. This includes which games you skip when asked “What Should I Play?”, how you respond to nudges, and your dismissal preferences. This data is currently stored in your browser's localStorage and never leaves your device.
If you create an account, this behavioral data may be synced to our servers via Supabase to preserve your preferences across devices. This data is used solely to personalize your experience within the app. It is never shared with third parties, used for advertising, or made available to publishers, advertisers, or any external party.
If you create an account (cloud sync)
We store your email address, your synced game library data, and your recommendation preferences via Supabase (our authentication and database provider). This enables cloud sync across devices. Your behavioral data (skip history, nudge preferences, player archetype) may also be synced to provide a consistent experience. Supabase's privacy practices are governed by their own privacy policy.
If you import from Steam
We use the Steam Web API to fetch your public game list, playtime, and achievement data. Your Steam ID is sent to our server to make the API call, but we do not store your Steam credentials. The imported data is stored in your browser's localStorage (or in your synced account if you're signed in).
If you import from PlayStation
You provide a PSN authentication token (npsso) which we use ephemerally to fetch your trophy and game data. The token is sent to our server for the API call but is not stored, logged, or retained after the request completes. Your trophy data is stored locally in your browser.
If you import from Xbox
We use the OpenXBL API to fetch your game list and achievement data using your Xbox gamertag or XUID. Your gamertag is sent to our server for the API call but is not stored beyond what is saved in your local game library. The imported data is stored in your browser's localStorage (or in your synced account if you're signed in).
If you opt into product update emails
When you create an account, there's an unchecked checkbox labeled “Email me when we ship something worth knowing. No spam.” If and only if you tick it, we store that consent against your profile along with the timestamp you gave it. We use it to send occasional product-update emails (new features, major changes). We will not send marketing email on any other basis. Every such email includes a one-click unsubscribe. Opting out revokes the consent immediately. Auth emails (magic links, password reset, email change confirmation) are transactional and are sent regardless of this setting because you asked for them.
If you subscribe to product updates from the landing page
If you submit your email through the “Hear when we ship something good” form on the landing or about pages, we store your email address, the page you submitted it from, your browser user-agent, and the timestamp of your consent. We use this only to send occasional product-update emails (new features, major changes). Every such email includes a one-click unsubscribe. We will not share, sell, or rent this list to anyone, ever.
If you send feedback
When you submit through the Feedback widget, we store your message, the page URL you sent it from, and your browser user-agent string. Email is optional. If you provide an email, we use it only to reply to your specific feedback unless you explicitly check the “Hear from us about updates” box at the time of submission. That checkbox is the only way you can be added to a future marketing list. We currently send no marketing email at all.
Third-party services we use
To enrich your game data with descriptions, artwork, pricing, and completion times, we make API calls to the following services using game names (not your personal data):
- RAWG API: game metadata, descriptions, genres, screenshots
- IsThereAnyDeal API: current game prices and deals across stores
- HowLongToBeat: estimated completion times
- Steam Web API: game library, playtime, achievements (when importing)
- OpenXBL API: Xbox game library and achievements (when importing)
- PlayStation Store API: PS Plus catalog browsing (game names only, no user data sent)
- Xbox Game Pass catalog: Game Pass catalog browsing (game names only, no user data sent)
- Supabase: authentication and cloud sync (when signed in)
- Sentry: error monitoring (anonymous error reports, no personal data sent)
- Vercel Analytics: cookieless page view analytics (page URL, referrer, browser type — no cookies, no personal data)
Our Discord bot (Pip)
We run an optional Discord bot called Pip (inventory-full-bot.fly.dev). Server admins can add Pip to their own Discord server to use slash commands like /pick and /archetype.
Pip is stateless. It does not store any user data, message history, server membership, or persistent identifiers. It does not request privileged intents. It cannot read your messages — it only sees the slash command payloads Discord sends it when someone explicitly invokes one. Each interaction is processed in memory and discarded when the response is returned.
Pip does not have access to your Inventory Full account, library, Steam/PSN/Xbox tokens, or any other data you've given the web app. The bot and the web app share branding only, not data.
Operational errors from Pip may be sent to Sentry (anonymous error reports, no Discord user IDs or message content) on the same terms as the rest of our error monitoring.
Affiliate disclosure
When we show game deals via IsThereAnyDeal, some links include affiliate parameters. If you buy a game through one of those links, we may earn a small commission at no extra cost to you. We disclose this in line on every deal surface so the affiliation is visible at the point of click, per FTC endorsement guidelines.
We never recommend games to buy. We only show deals on games you already own or have wishlisted yourself. Our goal is to help you play what you have, not sell you more.
Cookies and tracking
On your first visit, we ask whether to enable analytics cookies. Google Analytics only loads if you accept. If you decline, no analytics scripts are loaded and no tracking cookies are set. You can change your choice anytime via the “Cookies” link in the footer.
Strictly necessary cookies (no consent required): sign-in session cookies set by Supabase when you choose to create an account. These are required to keep you logged in and cannot be disabled while you remain signed in.
Analytics cookies (consent-based): Google Analytics 4 to understand page views, feature usage, and general traffic patterns. We do not use this data to identify individuals or build advertising profiles. No pixel trackers, no fingerprinting, no cross-site tracking.
Vercel Analytics (no cookies): We use Vercel Analytics for aggregate page view metrics. It is cookieless by design and does not collect personal data, set cookies, or track users across sites. It runs without requiring consent.
Error monitoring (no cookies): Sentry receives anonymous error reports when the app crashes. Reports include the error message and browser type. No personally identifiable information is sent. Authentication tokens and other credentials are automatically scrubbed before any report leaves your browser or our servers.
We use localStorage (a browser storage mechanism) to save your app state locally. This is not a cookie and cannot be used for cross-site tracking.
When you click deal links to third-party stores, those sites may set their own cookies for affiliate tracking and purchase attribution. We have no control over those cookies.
Data storage and retention
Without an account: your data lives in your browser only. This includes your game library, settings, recommendation preferences, skip history, nudge dismissals, and player archetype. You control it entirely. Clear your browser data and it's gone.
With an account: your synced library data and behavioral preferences are stored in Supabase's infrastructure. You can delete your account and all associated data at any time by contacting us. Deletion includes all behavioral data, not just your game library.
Your rights
Under applicable privacy laws (including CCPA, CPRA, and PIPEDA), you have the right to:
- Access: Export your data at any time using the Export Backup feature
- Delete: Clear your local data via browser settings, or request full deletion of your account and all cloud-synced data by emailing us
- Portability: Your exported data is a standard JSON file you can take anywhere
- Opt out: Use the app without creating an account (all features work locally, no data leaves your device)
- Know: This policy describes all data we collect and how we use it. If you have questions, ask us
We respond to data deletion requests within 30 days. When we delete your account, we delete everything: your email, your library data, your sync history, and any associated metadata. We do not retain anonymized copies.
Personalized recommendations and profiling
Our “What Should I Play?” feature uses algorithmic matching based on your selected mood, available time, game metadata, and your history of past recommendations to suggest games from your own library. The engine learns from your skips and choices to make better suggestions over time. No AI models are used. No personal data is sent to external AI services. The matching happens entirely in your browser.
We also analyze your library data (games owned, completion status, play hours, genres, skip patterns, nudge responses) to generate a “Player Archetype” profile, personalized stats, and contextual nudges (such as “Did you finish this?” or “Pick up where you left off”). This profiling is used solely to enhance your experience within the app. It runs in your browser and is never shared with third parties.
When game deals are displayed, they are based on games already in your library or wishlist. No third-party advertiser has access to your profile, library, or behavioral data. We do not build advertising segments, sell user profiles, or allow external parties to target you based on your data. We are not an advertising platform.
We do not sell your data
We do not sell, rent, lease, or trade your personal information to any third party for any reason. Not for advertising. Not for marketing. Not for analytics. This applies to all data we collect: your email, your game library, your play history, your behavioral profile, and any other information associated with your account. Full stop.
Children's privacy
This app is not directed at children under 13. We do not knowingly collect personal information from children under 13.
Changes to this policy
We'll update this page if anything changes. Material changes will be noted with an updated date at the top.
Contact
Questions about your data? Reach out at privacy@inventoryfull.gg