Privacy policy

1. What data do we process?

• Account

  ContentEmail address, password (kept only in an irreversibly encrypted form by the authentication service, never readable), username, creation date, version of the legal texts you accepted and the date of acceptance

  Where does it come from?You provide it when signing up

• Library

  ContentGames you added, status (Playing, Completed, Dropped, Backlog), date added, platforms you chose, history of status changes

  Where does it come from?You create it by using the app

• Ratings

  ContentHalf-star ratings (Overall, Gameplay, Story, Music, Graphics), N/A marks, tags you picked

  Where does it come from?You enter them

• Profile

  ContentYour profile visibility (private by default), unlocked badges and their levels, with their dates

  Where does it come from?The setting comes from you; badges are computed automatically

• Friends, requests and blocks

  ContentThe friendship links between two players (requests sent and received, accepted friendships, declined requests kept for 30 days), the members you blocked, your invitation link (a random token), your "Be found for friend requests" setting and the date you closed the matching information window

  Where does it come from?You create them by using the app

• In-app notifications

  ContentThe entries of the Notifications page: a game from your Backlog is out (game, date, seen or deleted); your friend requests received; your friends' recommendations

  Where does it come from?Created automatically when a game from your Backlog is released; requests and recommendations come from other players

• Recommendations

  ContentThe games you recommend to a friend (friend, game, date) and those a friend recommends to you (friend, game, date, seen or dismissed), and your two push notification switches (game releases, recommendations)

  Where does it come from?You create them by using the app

• Reports

  ContentReports about game pages (one per player and per game)

  Where does it come from?You send them

• Technical data

  ContentIP address and browser (in the host's logs), hashed IP fingerprints used to limit abuse

  Where does it come from?Automatic, on every visit

• Service emails

  ContentSign-up confirmation, forgotten password

  Where does it come from?Sent when you request them

• Release notifications (optional)

  ContentFor each device where you turn them on: the subscription address provided by your browser and its encryption keys, interface language, activation date; the list of games already notified

  Where does it come from?You turn them on yourself; your browser creates the subscription

• Contact

  ContentMessages you send to hello@rankologist.app

  Where does it come from?You write to us

We never need your date of birth, your real name, your address, your precise location or a payment method. Rankologist is free.

2. Automatic calculations based on your ratings

From your ratings and your library, the app computes for you your Gamer DNA (all of its gauges), your archetype, your badges, your tier lists, the Pick My Next Game suggestions and the comparison with community averages. These calculations only serve to show you information: they produce no decision with legal effects or that would significantly affect you (no credit, no account blocking, no targeted advertising).

They are recomputed every time from your data; only unlocked badges are stored. If you change a rating or delete your account, the results change or disappear. Explanations ("Why this score?", "Why this archetype?") are shown in the app.

3. Why, and on what basis?

• Create and manage your account, log you in, send service emails

  Legal basis (GDPR)Performance of a contract (art. 6(1)(b))

• Provide the features: library, ratings, profile, statistics, automatic calculations

  Legal basis (GDPR)Performance of a contract (art. 6(1)(b))

• Aggregated, anonymous community statistics (game pages, Discover, community tiers)

  Legal basis (GDPR)Legitimate interest (art. 6(1)(f)): offering a core feature of the service with aggregated figures, above a minimum number of players

• Security, rate limiting, abuse prevention, handling reports

  Legal basis (GDPR)Legitimate interest (art. 6(1)(f)): protecting the service and its players

• Anonymous usage counters (for example: how many exports per day)

  Legal basis (GDPR)Legitimate interest; these counters contain no personal data (no identifier, no IP address)

• Friends: requests, friend list, blocks, invitation link, and showing your Overall rating to your friends on game pages

  Legal basis (GDPR)Performance of a contract (art. 6(1)(b))

• Showing you in the app the friend requests you received, your friends' recommendations and the games from your Backlog that are released (Notifications page), and letting you recommend a game you rated to your friends

  Legal basis (GDPR)Performance of a contract (art. 6(1)(b))

• Telling you the day a game from your Backlog is released, when someone sends you a friend request or a friend recommends a game to you (push notifications, optional, with one switch per type)

  Legal basis (GDPR)Consent (art. 6(1)(a)): you turn them on yourself and can turn them off at any time

• Answering your requests

  Legal basis (GDPR)Performance of a contract or legitimate interest

• Meeting a legal obligation or answering an authority

  Legal basis (GDPR)Legal obligation (art. 6(1)(c))

Under Swiss law, this processing follows the principles of good faith, proportionality and purpose limitation: we collect nothing "just in case" and only use your data for these purposes.

Only the optional game release push notifications rely on your consent: you turn them on yourself and can withdraw it at any time, without affecting what was done before. There are no ads, no advertising tracking and no analysis of your behavior by third parties.

4. What other players and visitors can see

Your profile is private by default. Only you and your friends can see it. You can make it "visible to logged-in players" in the Account page, and switch back to "private" at any time.

When your profile is visible, another logged-in player who knows your address (/u/your-name) or finds you through the member search sees:

• your username and the month and year you joined;
• your archetype, your most pronounced Gamer DNA gauges and your unlocked visible badges (without dates);
• the number of secret badges unlocked (never their names);
• library statistics: number of games, rated games, average rating, breakdown by status, platforms;
• your five best-rated games, with their rating;
• a few fun facts: oldest game played, favorite decade, most used tag, longest game finished.

Never visible to others: your email address, your activity (dated ratings and status changes), your Backlog, the detail of your ratings (apart from your top five games), your tags and sub-ratings, the dates you unlocked your badges, your account's internal identifier.

Being found by your username. The member search (for logged-in players only) lists, from two characters, at most twenty members: visible profiles and members who left the "Be found for friend requests" setting on (on by default, you can turn it off at any time in the Account page). For a private profile found this way, only your username is shown, with an "Add" button: never your profile. If you turn this setting off, you can only be reached with your invitation link. A logged-out visitor never sees a player's profile.

Friends. A friendship is mutual: a request has to be accepted. Your friends see your profile even if it is private (the same information as a visible profile, except that for them all the gauges of your Gamer DNA are shown instead of only the most pronounced ones, without the explanations written for you) and, on a game page, your Overall rating when you rated it (with the username of each friend who rated that game). When a friend wants to recommend a game to you, they will only learn whether you already have that game in your library, Backlog not counted (yes or no), never your status or your rating. Never your activity, your Backlog, the detail of your ratings or your secret badges.

Requests, blocks and invitation link. Whoever receives your request sees your username; a declined request is not reported to its sender and cannot be sent again for 30 days. You can remove a friend or block a member at any time: they lose access to your profile, can no longer find you or send you requests, and are not told. You also have a personal invitation link (a random token you can replace at any time): whoever opens it, logged in, can send you a request, which you still have to accept. Demo accounts do not take part in friends.

Recommendations. You can recommend any game in your library to one or more friends, whatever its status (Backlog and not-yet-released games included): they receive the game and, if you rated it, your current Overall rating (it follows your changes; if you delete it, the recommendation stays, without a rating), with no free-text message. There is only one recommendation per friend and per game, for life, even if dismissed; it disappears if you remove the game from your library, or when the friendship ends or a block is set (in either direction). Limits: 20 friends per send and 40 recommendations per 24 hours. The recipient can dismiss it or add the game to their Backlog; you are not told what they do with it.

Public game pages. Game pages can be viewed without an account. They show aggregated, anonymous statistics (averages, dominant tags, share of games completed or dropped), only when at least 5 players are involved; never the rating, status or library of an identifiable player.

Shareable card and exported tier lists. The images are created in your browser, on request, with your own data; the app neither sends nor stores them. What you do with them afterwards (posting, sending) is up to you. Your tier list draft stays in your browser.

Sharing previews. When a link to a game page is shared, the services that display it (social networks, messaging apps) fetch the game's title, description and cover, never any player data.

5. Providers and where data is processed

We use technical providers, who process data on our behalf:

• Supabase

  RoleDatabase and authentication

  Data concernedAll account, library, ratings and profile data

  LocationLondon, United Kingdom (region eu-west-2)

• Vercel

  RoleWebsite hosting and function execution

  Data concernedRequests (IP address, browser) and displayed pages

  LocationFunctions in London (region lhr1); Vercel's global delivery network receives requests close to you

• Infomaniak

  RoleSending service emails (confirmation, forgotten password) from hello@rankologist.app

  Data concernedYour email address and the content of the email

  LocationSwitzerland

• IGDB (Twitch)

  RoleGame catalog

  Data concernedOnly the text you type to search for a game and game identifiers, sent by our server: no account data, not your IP address

  LocationUnited States

• Browser notification services (Google, Mozilla, Apple, Microsoft)

  RoleDelivering release notifications, only if you turned them on

  Data concernedYour device's subscription address and an encrypted message that only your device can read

  LocationDepends on the service (Google for Chrome and Android, Mozilla for Firefox, Apple for iPhone, Microsoft for Edge), including outside Switzerland and the EU

Main processing in London, transport through Vercel's global network: the database and the calculations are in the United Kingdom, but Vercel's delivery network receives requests close to each visitor (static files, IP address and browser in its technical logs). We therefore do not claim that "everything stays in the United Kingdom".

Supabase and Vercel are US companies. Supabase applies its public data processing agreement (standard contractual clauses, with the UK addendum and Swiss law), in force because we accepted its terms. Infomaniak (Switzerland) provided us with a data processing agreement compliant with Article 28 of the GDPR. Vercel acts as host and technical provider under its own terms of service and privacy policy: we have not concluded a separate data processing agreement with it at this stage. Your account, library and ratings data is not kept at Vercel (it is at Supabase), but it passes through its servers when you use the site.

We do not sell or rent your data, and we do not share it with any advertising network.

6. Cookies and storage in your browser

Rankologist uses only necessary or functional cookies. There are no advertising cookies, no audience analytics, no third-party tracking: since no cookie requires your consent, there is no cookie banner.

• Session cookies (Supabase, names starting with sb-)

  PurposeKeep you logged in. Set only after you log in; not accessible to the page's code (httpOnly)

  DurationUntil you log out; renewed as long as you use the site

• NEXT_LOCALE

  PurposeRemember the language you chose in the profile menu

  Duration1 year

Your browser also keeps, on your device only and without a cookie: the draft of your current tier list (local storage) and, for the length of your visit, the latest search or Discover results and your scroll position (session storage) so that the back button returns to the right place. None of this is sent to our servers.

If you install the app on your phone or open it in your browser, a small browser program (a service worker) keeps a copy of public site files on your device (code, fonts, icons, the same for everyone) so they load faster, plus a “You're offline” page shown when you have no connection. No personal data is copied there: no account pages, no games, no ratings, no responses from our servers. You can clear this cache at any time in your browser settings (site data) or by uninstalling the app.

Fonts are hosted with the site: your browser contacts no third-party font service.

7. Push notifications

Optional, only if you turn them on. For each device, we keep the subscription address provided by your browser and its encryption keys, the interface language and the activation date, only to send you a notification the day a game from your Backlog is released, when someone wants to add you as a friend or when a friend recommends a game to you. Each type has its own switch in Account (game releases; friends and recommendations); for notifications turned on before friends and recommendations existed, the "friends and recommendations" switch is off. We also keep the list of games already notified (60 days at most) so that we never tell you twice.

The message (the game's name; for a recommendation, also your friend's username and their rating if they gave one; for a friend request, the requester's username) is encrypted and goes through the notification service of your browser or system (Google for Chrome and Android, Mozilla for Firefox, Apple for iPhone, Microsoft for Edge): it sees the subscription address, not the content.

In the app, without push. Independently of push notifications, the Notifications page (the bell in the header) lists the games from your Backlog that are released, the friend requests you received and your friends' recommendations, whether or not you turned push notifications on. A release entry stays visible until you delete it, 60 days at most. A push (game release, recommendation, friend request) is tried only once; a recommendation or friend request push goes out right away and replaces the previous one from the same friend. No push is sent if the request did not go through.

You can turn them off at any time in Account, in the Upcoming section of the Backlog or in your browser settings: the subscription is then deleted, as it is when you delete your account. A subscription that no longer responds is deleted automatically.

8. How long do we keep your data?

• Account, profile, library, ratings, badges, history, reports

  RetentionAs long as your account exists. When you delete your account (Account page), everything is erased from the database immediately.

• Backup copies

  Retention30 days at most: copies that contain deleted data disappear at that point.

• Account whose email address was never confirmed

  RetentionDeleted automatically after 7 days (address, username and profile included).

• Former username after a change

  RetentionReserved for 30 days (to prevent someone from taking your old name), then erased; also erased with your account.

• Hashed IP fingerprints (abuse limiting)

  RetentionErased automatically after 24 hours at most.

• Anonymous usage counters

  RetentionKept: they contain no personal data.

• Providers' technical logs (host, database)

  RetentionAccording to each provider's policy, outside our control. We store no password or token in them.

• Messages you send us

  Retention12 months at most after the end of the exchange.

• Notification subscriptions

  RetentionAs long as you keep them on; deleted as soon as you turn them off, when the browser's service says they no longer exist, after 5 consecutive delivery failures, or with your account.

• Friendships, pending requests, blocks, invitation link

  RetentionAs long as your account exists, or until you remove the friend, cancel the request, unblock the member or replace the link; erased with your account (you also disappear from your friends' lists).

• Recommendations

  RetentionAs long as your account exists; deleted as soon as the game is removed from the library of the person recommending it, the friendship ends or a block is set, or with your account; a recommendation you dismiss is hidden but kept (one per friend and per game) until one of these deletions.

• Declined friend requests

  Retention30 days (they prevent asking again right away), then erased automatically.

• Game release entries (Notifications page) and protection against duplicates

  Retention60 days at most, or until your account is deleted; an entry you delete is hidden and kept until then so that we never tell you twice.

• Inactive accounts

  RetentionNo automatic deletion for now; you can delete your account at any time.

9. Your rights

At any time, you can:

• access and retrieve your data: the "Download my data" button in the Account page produces a JSON file (profile, email, library, ratings, status history, badges, reports, notification devices);
• correct your data: change your username (one change every 30 days) and your password in the Account page, edit or erase your ratings;
• delete your account and all your data from the Account page, without asking us;
• limit the visibility of your profile (private, or visible to logged-in players);
• withdraw your consent to game release notifications: turn them off in the Account page or in your browser settings;
• object to processing based on our legitimate interest, or ask for it to be restricted, by writing to us.

For any other request, or if you cannot log in, write to hello@rankologist.app: we answer within 30 days at most. We may ask you to confirm your identity from the account's email address.

You can also lodge a complaint with a data protection authority: the Swiss Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or the authority of your country if you live in the European Union.

10. Security

Passwords handled by the authentication service (never readable); encrypted connection (HTTPS); database with per-player access rules; sensitive writes only on the server side; rate limits against abuse; administration access protected by two-factor authentication; backups. The administration only shows aggregated statistics and the list of game-page reports, without any player identifier.

No system is infallible: if a security breach presented a high risk to you, we would inform the people concerned and the competent authority, as the law requires.

11. Minimum age

Rankologist is reserved for people aged 16 or older and is not designed for children. If you think someone under 16 has created an account, write to us: we will delete it.

12. Changes to this policy

We update this text when the service or the law changes; the version date appears at the top of the page. For an important change, we will tell you in the app or by email before it takes effect. The French version is binding; the English version is its translation.

13. Controller and contact

The controller is Felipe Saenz, a private individual based in Genève (Switzerland), who publishes Rankologist (https://rankologist.app).

Single point of contact for any question or request about your data: hello@rankologist.app. No postal address is published while the app is free.

Rankologist is subject to the Swiss Federal Act on Data Protection (FADP). Because the service can also be used from the European Union, we also apply the principles of the GDPR. We have not appointed a representative in the European Union: we consider that the exception in Article 27(2)(a) of the GDPR applies, because the processing is occasional, presents a low risk to individuals and does not involve sensitive data.