Privacy policy

The short version

Sidequestd stores the things you deliberately put into it — your account, your reviews, your lists, your photos — plus the minimum needed to keep the service running and secure. There are no advertisers, no analytics trackers, and nothing is sold. If you want your account and its contents gone, email us and they will be.

The rest of this page is the detail behind those sentences. It describes what the software does today, not what it might do later — if the behaviour changes, this page changes with it.

Who runs this

Sidequestd is an independent project, not a company. It is operated from the United States, and using it means your information is handled there — including if you are somewhere with stronger local protections, which continue to apply to you regardless.

Questions about privacy, requests for your data, and account deletions all go to the same place: hello@sidequestd.app.

What is collected

Your account

• Email address. Used to sign in, to reset a password, and to reach you about your account. It is never shown on your profile or to other members.
• Username, display name, bio and avatar. These are the public parts of a profile — visible to anyone who can see your account under the visibility rules below.
• Password. Stored only as a cryptographic hash. It is never stored in a readable form and cannot be recovered, only reset.

What you write and upload

• Reviews: the rating, the text, and the playtime if you record one.
• Photos and video clips attached to reviews, and the thumbnails generated from them.
• Comments and replies, and which reviews you have liked.
• Your four backlog lists, your favourite games, and the pinned games on your profile.

Your connections

Who you follow, who follows you, and any pending follow requests in either direction.

Technical records

Ordinary server logs, which include IP addresses and browser user-agent strings. Your IP address is also used to enforce rate limits on sign-in, password reset and search, which is what stops those endpoints from being brute-forced. These records exist for security and reliability, and are not used to build a profile of you.

What is not collected

• No advertising networks and no ad targeting.
• No third-party analytics or behavioural tracking scripts.
• No selling, renting or sharing of personal data with data brokers or advertisers.
• No tracking of you across other websites.

Photos, clips, and camera metadata

Files from a camera or phone carry more than the picture. Photos embed EXIF data — the date and time, the device make and model, camera settings, and, if location services were on, the GPS coordinates the photo was taken at. Video files keep the same things in their own container.

Sidequestd removes all of it before your file is stored. Photos are re-encoded without their metadata, and clips have their location and device atoms blanked out. This happens on the way into storage, so the version we keep — the one anyone else could ever download — has never carried it. It applies to review photos, review clips, and profile pictures alike.

Two honest caveats. Rotation is the one piece of that data we act on before discarding it, so a photo taken sideways still appears the right way up. And anything visible in the image — a street sign behind you, a name in a screenshot — is content rather than metadata, and is published exactly as you uploaded it.

Uploads are checked by their actual file contents rather than by the name or content type your browser claims, and every stored file is given a server-generated name, so an upload cannot overwrite anyone else's.

Who can see what

Every account is either public or private, and you can change this at any time.

• Public. Your profile, reviews, stats and lists can be seen by anyone, including people who are not signed in. Anyone can follow you without asking.
• Private. Your profile still appears in search so that people can find and request to follow you, but your reviews, stats and lists are visible only to followers you have approved. New followers must send a request that you accept or decline.

This is enforced on the server, on every request that returns content — not merely hidden in the interface. Changing to private applies immediately to everything you have already posted.

Two things are worth being clear about. Anyone who can see your content can copy it, and no privacy setting prevents that. And removing a follower stops future access, but not what they have already read.

Service providers

Running Sidequestd means a small number of outside companies necessarily handle some of your data. They act on our instructions, for the purpose described, and for nothing else. None of them is permitted to use your data for their own ends.

• Infrastructure. The application, its database and the files you upload run on third-party hosting and storage providers.
• Email delivery. Account email — password resets and similar — is sent through a third-party delivery provider, which handles your email address in order to deliver the message.

One outside service is worth describing separately, because it sees something we never send it:

• IGDB (via Twitch). The games catalog is imported from IGDB on a schedule, and no personal data is sent to them as part of that. However, game cover images are loaded by your browser directly from IGDB's image servers, which means those servers see your IP address and user-agent whenever a cover renders, exactly as any third-party image on any website would.

Cookies and sessions

Sidequestd uses authentication tokens to keep you signed in and to refresh that session as it expires. That is the extent of it: there are no advertising cookies and no analytics cookies. Signing out invalidates the session.

Because nothing here tracks you in the first place, a “Do Not Track” signal from your browser has nothing to switch off. There is no behaviour to opt out of.

Keeping it secure

Concretely, and only what is actually true:

• Passwords are stored as cryptographic hashes and never in a form anyone — including us — could read.
• Traffic between your browser and the service travels over an encrypted connection.
• Sessions use short-lived tokens that rotate as they refresh. Presenting a token that has already been used invalidates the whole chain and forces a fresh sign-in, which is what limits the damage a stolen token can do.
• Sign-in, password reset and search are rate limited per IP address, which is what stops passwords being guessed at scale and the member directory being harvested.
• Every request that returns someone's content re-checks who is allowed to see it on the server, rather than relying on the interface to hide it.

None of this makes any service invulnerable, and nobody honest claims otherwise. If something does go wrong in a way that affects your data, we will tell you.

How long things are kept

Your account and its contents are kept for as long as the account exists. Deleting a review, comment or list entry removes it. Server logs are short-lived and rotate in the ordinary course of running the service.

Deleting your account

You can have your account deleted by emailing hello@sidequestd.app from the address on the account. Deletion removes or anonymises your personal data: profile, email address, reviews, comments, likes, lists, uploaded media, and your follow relationships. Requests are acted on within 30 days.

Backups are retained for a short period for disaster recovery, so a copy may persist there briefly after deletion before ageing out.

Your rights

Wherever you live, you can ask for a copy of the data held about you, ask for something inaccurate to be corrected, or ask for your data to be deleted. Email hello@sidequestd.app from the address on your account and we will act on it. You will not be charged for asking, and you will not get a worse version of Sidequestd for having asked.

If you are in the United States

California and a growing number of other states give residents specific rights over their personal information. The most important one is the easiest to state: Sidequestd does not sell your personal information, and does not share it for cross-context behavioural advertising. There is no such arrangement to opt out of, because there is no advertising here at all.

Beyond that, you have the right to:

• Know what personal information is held about you and where it came from.
• Get a copy of it.
• Have it corrected if it is wrong.
• Have it deleted.
• Not be discriminated against for exercising any of these.

If someone is authorised to make a request on your behalf, we may need to confirm that with you before acting on it.

If you are in the UK or the European Economic Area

You have the rights above, and in addition the right to object to or restrict certain processing, the right to receive your data in a portable form, and the right to complain to your local data protection authority. Your data is processed in order to provide a service you asked for, and on the basis of our legitimate interest in keeping that service running and secure.

Children

Sidequestd is not intended for children under 13, and under 16 in the European Economic Area. It is not directed at children, and information is not knowingly collected from them. Accounts belonging to anyone younger will be removed when identified — if you believe a child has created one, email hello@sidequestd.app and it will be handled.

Changes to this policy

When this policy changes, the date at the top of the page changes with it. For a change that materially affects how your data is handled, we will give notice in the app rather than relying on you to re-read this page.