Privacy Policy
Which personal data GAMPEON processes on gampeon.com, in the portal, the launcher and the APIs, why, for how long, and what your rights are.
Preliminary version. Some details are still being added and checked.
This policy describes what GAMPEON actually does today on gampeon.com and in the portal, the GAMPEON launcher, the developer docs, the APIs and the creator tools. Features that are not live yet are marked as such. We will update this policy before we switch on new processing.
1. Controller and contacts
The responsible legal entity (controller) is Gampeon, Inc., 651 N Broad St, Suite 206, Middletown, DE 19709, USA. Our EU contact address in Malta is listed in the Legal Notice. Data protection questions and rights requests: privacy@gampeon.com.
2. What we process, why, and on which legal basis
We only process the data needed for the features you use. The legal bases refer to Article 6(1) GDPR: (a) consent, (b) contract, (c) legal obligation, (f) legitimate interests.
| Data | When | Purpose | Legal basis |
|---|---|---|---|
| Email address, display name, username, password (stored only as a salted hash), month and year of birth, account role, sign-up time, email confirmation | When you create an account | Your account, logging in, confirming your email, resetting your password, age rules | (b); the date of birth also (c) and (f) to protect minors |
| Steam ID or Discord user ID and name, time of the last login with it, whether it is shown on your profile | Only if you log in with Steam or Discord or connect them | Logging in with these services, showing the connection if you choose to | (b) |
| Login sessions (stored only as a hash), access tokens for AI assistants (stored only as a hash) and their activity log with time, action, client name and IP address | When you log in or create an access token | Keeping you logged in, security, showing you what your tokens did | (b) and (f) |
| Profile text, profile picture, cover image, links, follows, friends, blocks, privacy settings, posts, comments, reactions, photos, chosen GIFs, mentions | When you use the profile, feed and friends features | Providing the social features with the visibility you choose | (b) |
| Studios, projects, project pages and galleries, community memberships, roles and messages, community moderation log | When you create or join them | Providing studios, projects and communities | (b) and (f) |
| Uploaded files and their descriptions, versions, the rights statement you confirmed and when | When you upload content | Hosting and delivering your content, rights and safety checks | (b), (c) and (f) |
| Job posts, applications and the messages within an application | When you use the job board | Providing the job board | (b) |
| Reports (category, explanation, name and email of the reporter where needed, a snapshot of the reported content), moderation decisions with reasons, appeals | When someone reports content or appeals a decision | Notice and action, statements of reasons and complaints under the EU Digital Services Act, defending legal claims | (c) and (f) |
| Game server listings (name, address, player counts reported by the server) and status checks | When a server is listed | Server browser and status page | (b) and (f) |
| GAMPEONS wallet: orders, packages, bookings, bought items, accepted seller and payout terms, with an audit log that includes IP addresses | Only if you use the wallet. Payments run in test mode only. | Transactions, accounting, fraud prevention | (b), (c) and (f) |
| IP address and browser information in technical requests | Every visit | Delivering the website, rate limits against abuse, counting a download or a project page view only once (kept in memory for up to 24 hours, not stored) | (f) |
| Emails you send us | When you write to us | Answering you | (b) or (f) |
We do not sell personal data, we do not show advertising, and we do not use your data for profiling.
When you upload images, we remove embedded metadata such as location, camera details and comments before they are stored.
3. Content visibility and communications
Public project pages, profiles and posts may be visible to other users or the public according to the settings you choose. Private projects, drafts and restricted content are disclosed only as necessary to provide the relevant features, administer access, investigate safety or rights complaints, or meet legal obligations. Do not upload personal data about other people without a lawful basis. Community messages in the launcher are visible to the members of the channel. Messages within job applications are visible only to the applicant and the people who manage the job. We do not scan private messages automatically.
4. Minors aged 13–17
GAMPEON is intended for users aged 13 or older. Users under 13 cannot register, and we do not store anything from a sign-up attempt by someone under 13. Accounts of users under 16, and accounts without a date of birth, get stricter defaults: friend requests only from friends of friends or nobody, friend lists private by default, no friend suggestions. Applying for jobs starts at 16 (unpaid roles only) and posting jobs at 18. Buying GAMPEONS and payouts are for users aged 18 or older. We show no advertising to anyone. Where processing relies on consent and the user's country requires authorization by a parent or guardian, GAMPEON will seek and reasonably verify that authorization before the relevant processing. A short version for teens is in Safety & Privacy for Users Aged 13–17.
5. Recipients and service providers
We use these service providers and services:
- Hosting: IONOS SE, Germany, runs the server for the website, the portal, the developer docs, the APIs and the database on our behalf. We will add the server location here.
- Game test servers: our own test servers for the game engine run on a dedicated server in Frankfurt, Germany, rented from Avoro. When you join one of them, it processes your IP address and the connection data the game needs.
- Email: ALL-INKL.COM – Neue Medien Münnich, Germany, sends and receives our emails (account emails such as confirmations and password resets, and our mailboxes).
- Payments (test mode only): Xsolla processes GAMPEONS purchases. When you start a purchase, Xsolla receives your account ID, email address, IP address and the order. Once purchases go live, Xsolla acts as merchant of record under its own terms and privacy policy.
- Steam (Valve Corporation, USA) and Discord (Discord Inc., USA): only if you log in with them. You sign in on their pages; we receive your ID and name as listed above. Their own privacy policies apply on their side.
- GIF search (KLIPY): our server sends your search terms to KLIPY and delivers the GIFs itself. KLIPY does not receive your IP address or your account.
- Link previews: when you post a link, our server loads the linked page to show a preview. The linked website sees our server, not you.
- Launcher downloads and updates (GitHub): we publish the installers and updates of the GAMPEON launcher on GitHub (GitHub, Inc., USA). When you download the launcher, and when the installed launcher checks for an update (when it starts and every 6 hours), GitHub receives your IP address and the technical data of the request. We don't send your account to GitHub. If the WebView2 runtime is missing on your PC, the installer downloads it from Microsoft.
- YouTube (Google): videos in project galleries are loaded from youtube-nocookie.com only after you click on them. From then on, Google receives your IP address and browser information.
- Discord community: our community server on Discord is run on Discord's platform, and Discord's privacy policy applies there.
We also share data where necessary and lawful with professional advisors, competent authorities, and parties to a rights dispute to the extent required by law. Independent creators who collect player information for their own purposes must provide their own lawful notices and controls.
6. International transfers
Gampeon, Inc. is a company in the United States, and some of the service providers above are in the United States. Processing outside the European Economic Area can be an international transfer. We are confirming the legal safeguard used for each of these transfers (such as an adequacy decision or standard contractual clauses) and will list it here. You can ask us about it at privacy@gampeon.com.
7. Retention
We keep data no longer than necessary. These are the periods built into our systems today:
| Data | How long |
|---|---|
| Account, profile and content | Until you delete the content or ask us to delete your account |
| Login sessions | 30 days |
| Access tokens for AI assistants | Deleted 90 days after they expire or are revoked; activity log entries after 90 days |
| Job posts | Deleted one year after the job closes or expires |
| Job applications and their messages | Deleted about six months after the job ends; withdrawn applications after 30 days |
| Deleted community messages | The text is removed after 30 days, unless it is needed for an open report |
| GIF search results | 7 days, unless the GIF is used in a post |
| Status checks | Single checks 7 days, daily summaries 90 days |
| Sign-in states, launcher login codes and server join tokens | Deleted when they expire (minutes) |
| Reports, decisions and appeals | While the case and any appeal are open, at least six months after a decision so it can be challenged, and afterwards only as long as needed for legal claims |
| Wallet and payment records | As long as tax and accounting law requires |
| Backups | Daily, kept for 30 days |
You can delete your posts, comments and projects yourself. To delete uploaded content or your whole account, write to privacy@gampeon.com from the email address of your account.
8. Your rights
Subject to applicable law, you can request access, correction, deletion, restriction, portability and information about processing; object to processing based on legitimate interests; and withdraw consent at any time without affecting prior lawful processing. You can complain to a data protection supervisory authority, in particular in the EU country where you live or work. In Malta, this is the Information and Data Protection Commissioner (IDPC). Send requests to privacy@gampeon.com. We may verify your identity proportionately and respond within the legally required periods.
9. Cookies and browser storage
gampeon.com sets no cookies and uses no analytics, advertising or tracking tools, and no third-party scripts. Fonts are served from our own server. The portal stores a few items in your browser that are needed for features you use:
- Local storage: your login token (until you log out), your colour theme, which notifications you have seen, and the state of a launcher login.
- Session storage (deleted when you close the tab): the state of a login with Steam or Discord, a pending payment, the page to return to after logging in, and the result of the age check during sign-up.
- GAMPEON launcher: your login is kept in the credential store of your operating system (on Windows, the Credential Manager) until you log out. The launcher also keeps a few things on your computer so it opens the way you left it: the path to the game client you chose, the games you played recently, the last page and channel you had open, and unsent message drafts until you close the launcher.
10. Security and automated decisions
We use technical and organizational measures appropriate to the risks, for example hashed passwords and tokens, encrypted connections, rate limits and an audit log for wallet actions. Some checks run automatically: rate limits, limits against fake downloads and views, and the age check at sign-up (under 13 cannot register). Moderation decisions about reports are made by people. We make no decisions based solely on automated processing that have legal or similarly significant effects on you, apart from the minimum age required by law.
11. Changes and contact
We will update this policy when our processing changes and tell you about material changes. Contact: privacy@gampeon.com or the EU contact address in the Legal Notice.