Privacy policy

What we collect today

Four things may be processed even without an account:

• Your email, if you sign up for updates, along with which part of the site you signed up from.
• Content sent through the feedback form: subject, message, name and email when provided, the current page and basic browser information.
• Your IP address, used to rate limit public forms. It is cached briefly and is not linked to your email or message.
• Aggregate visit metrics through Vercel Analytics, which uses no cookies and builds no individual profile.

What an account will add

Once sign-in exists, we will also process:

• Your email and, if you sign in with Google, your Google account identifier. If you set a password, we store only a hashed version of it, never the password itself.
• Authentication logs kept by Supabase, which include the IP address and browser used to sign in.
• Whatever you tell us about yourself in your profile: name or studio, what you do (developer, publisher, marketing, press, student), team size and country. All optional, and used to understand who the audience is and prioritise features.
• Whatever you save inside the product, such as analyses and alerts.

Why we may use it

The legal basis depends on the purpose, and the difference is practical:

• Account and product features: performance of the contract between you and us.
• Newsletter: your consent, given separately. This is why leaving the newsletter does not delete your account.
• Feedback and contact: your request that we receive and answer the message; without an email, our legitimate interest in fixing problems and improving the tool.
• Rate limiting and security: our legitimate interest in keeping the service running.

Who we share it with

We do not sell your data and do not use it for advertising. What you tell us in your profile is used to understand who uses the tool and decide what to build. We use providers that process data on our behalf:

• Supabase, database and authentication.
• Vercel, hosting and visit metrics.
• Upstash, the cache behind rate limiting.
• Resend, delivery of confirmation emails, newsletter content and internal feedback notifications.

International transfer

These providers may process data outside Brazil. Those transfers must follow the applicable LGPD and GDPR requirements and each provider's data-protection terms.

How long we keep it

• Newsletter email: until you unsubscribe.
• Feedback and contact messages: as long as needed to reply and track the problem, or until you ask us to delete them.
• Account data: for as long as the account exists.
• Rate-limiting IP: minutes, only as long as the count needs it.
• Visit metrics: aggregated, with no individual identification.

Your rights

You may request access, correction, deletion, portability, and may withdraw consent at any time.

Two of these work without waiting for us to answer a request:

• You can withdraw consent through the contact below. Once newsletter content starts, every message will also include an unsubscribe link that works without signing in.
• Deleting your account, inside the product, once sign-in exists. Deleting an account also removes your newsletter subscription unless you tick the box to keep receiving it.

Data that is not personal

GamingBubble's market analysis comes from public Steam and SteamSpy sources and does not describe people. It is not covered by this policy.

Contact

To exercise any right, or to ask about this document, write to isacmorandin@icloud.com. We answer within the periods the law requires.