Privacy · Updated October 11, 2026

Privacy policy

The short version. Steam handles sign-in, so we never see your Steam password; it sends us only your public Steam ID. Your guesses and results stay in your browser. We count how the game is played with PostHog, tied to your Steam ID once you sign in. We don't sell your data or use it for ads.

1. Introduction

Steamdle ("we," "us," or "our") is a Steam-based guessing game that uses publicly available data from the Steam Web API to power its gameplay. This Privacy Policy explains what information we process, how we use it, who we share it with, and the rights you have over your data.

By using Steamdle, you agree to the practices described in this policy. If you do not agree, please discontinue use of the service.

Data Controller: Nathan Campolina — nathancampolina.r@gmail.com

2. Information We Collect

2.1 Steam Authentication (via Steam OpenID)

When you choose to log in, you are redirected to Steam's own website to authenticate. This process is handled entirely by Valve's Steam OpenID service — Steamdle never sees, receives, or stores your Steam username, password, or any login credentials.

Upon successful authentication on Steam's website, Steam returns a single piece of information to Steamdle: your Steam ID. The Steam ID is a publicly visible identifier — it is the same ID that appears in your Steam profile URL and is visible to anyone on the internet.

This Steam ID is stored in an encrypted, server-signed session cookie in your browser using Iron Session (see Section 5). It is not stored in any database or persistent server-side storage operated by Steamdle.

2.2 Steam Profile & Game Data (via Steam Web API)

Once authenticated, Steamdle uses your Steam ID to query the Steam Web API on your behalf. The Steam Web API returns only publicly available profile information, specifically:

  • Display name and profile avatar
  • Public game library (titles and playtime visible on your public Steam profile)

This data is fetched on demand to power gameplay and is not persisted in any server-side database. If your Steam profile is set to private, this data will not be accessible and certain game features may not function.

2.3 Gameplay Data

Your in-game guesses, scores, and session state are stored locally in your browser (using browser storage mechanisms such as localStorage or sessionStorage). They are not transmitted to or stored by Steamdle's servers. PostHog (see 2.4) receives only each guess's position in the round (1st, 2nd, …) and, when a round ends, a summary: whether you won, how many guesses it took, and the answer game. With each round it also receives how many earlier days this browser played the daily, a count taken from the boards saved on your device, so we can tell new players from returning ones. Which games you guessed stays on your device.

2.4 Analytics Data (PostHog)

We use PostHog for product analytics to understand how Steamdle is used and to improve the experience. The data PostHog collects depends on whether you are logged in:

  • Before login: PostHog sets no cookies. It keeps a random anonymous ID in your browser's localStorage, so your visits from this browser are linked to each other, across tabs and days, but not to your name or Steam account. Anonymous event data (e.g. pages visited, interactions) is sent to PostHog under that ID. If you log in from this browser, those events become part of your account's analytics.
  • After login: PostHog uses your Steam ID as a persistent Distinct ID to associate analytics events with your account across sessions. This allows us to understand how logged-in users interact with the game over time. PostHog may also collect browser type, operating system, device type, and your IP address, which is used to derive an approximate location (country and city).

Your browser sends this data to steamdle.net, which forwards it unchanged to PostHog, so Vercel (see 2.5) handles it on the way.

2.5 Infrastructure Data (Vercel)

Steamdle is hosted on Vercel, which processes standard request metadata (e.g. IP addresses, request logs) as part of delivering the service. Vercel acts as a data processor on our behalf. See vercel.com/legal/privacy-policy for details.

3. How We Use Your Information

We use the information described above for the following purposes:

  • To authenticate you via Steam OpenID and identify your session
  • To fetch your public Steam profile and game library data to power gameplay
  • To analyze product usage and improve Steamdle (via PostHog)
  • To detect and prevent abuse

We do not use your data for advertising and we do not sell it to third parties.

4. How We Share Your Information

We share data only with the following third-party service providers:

  • Vercel Inc. — hosting and infrastructure, United States. Processes request metadata to deliver the service. Governed by Vercel's Data Processing Agreement.
  • PostHog Inc. — product analytics. After login, your Steam ID is sent to PostHog as a Distinct ID to associate analytics events with your account. PostHog stores this data in the United States. See posthog.com/privacy.
  • Valve Corporation — authentication is handled by Steam's OpenID service on Valve's own servers. Game and profile data is retrieved from the Steam Web API. We do not send your personal data to Valve beyond the standard OpenID authentication flow.

We do not sell, rent, or share your personal data with any other third parties for their own purposes.

5. Cookies & Browser Storage

5.1 Session Cookie (Iron Session)

After you log in, Steamdle sets an encrypted, server-signed cookie managed by Iron Session. It contains only your Steam ID and is used solely to keep you authenticated between page loads.

It is set only after you actively choose to log in. It is removed when you log out or when it expires.

5.2 Language Cookie

Steamdle remembers the language of the pages you open, or the one you pick in the header, in a NEXT_LOCALE cookie for one year, so the next visit opens in that language. It holds only the language code.

5.3 PostHog Analytics

PostHog sets no cookies. Before login, it stores a random anonymous ID in localStorage, so a return visit from the same browser counts as the same visitor; the ID says nothing about who you are. After login, it stores your Steam ID there instead, to associate your analytics events across sessions, and logging out replaces it with a new anonymous ID. Either one stays until you clear this site's storage in your browser, which starts you over as a new visitor. You can also opt out by contacting us.

5.4 Browser Storage (Gameplay)

Your gameplay data (guesses, scores, session state) is stored in your browser's localStorage or sessionStorage. Apart from the guess positions, round summary and count of earlier daily days described in Section 2.3, this data never leaves your device. You can clear it at any time through your browser's settings.

6. Data Retention

Steamdle does not operate a backend database. We do not store your personal data on our servers beyond the following:

  • Session cookie — persists in your browser until you log out or the cookie expires. Cleared automatically on logout.
  • Language cookie — persists in your browser for one year, or until you clear it.
  • PostHog — analytics data including your Steam ID as Distinct ID is retained by PostHog according to their own retention policies. You can delete your PostHog data yourself at any time (see Section 8).
  • Vercel infrastructure logs — retained according to Vercel's standard log retention periods.
  • Browser storage — gameplay data stored in your browser is retained until you clear it yourself via your browser settings.

7. Data Security

We take reasonable technical measures to protect your data, including:

  • HTTPS / TLS encryption for all data in transit
  • Iron Session's encrypted and server-signed cookie for session management
  • No persistent storage of personal data in any database operated by Steamdle

No system is completely secure. We cannot guarantee the absolute security of data processed by third-party providers (Vercel, PostHog) and are not liable for unauthorized access beyond our reasonable control.

8. Your Rights

You have the following rights regarding your personal data:

  • Access — request information about what data we or our processors hold about you
  • Deletion — request deletion of your data, including your PostHog analytics profile. While logged in, you can do this yourself: open the account menu (your avatar) and choose "Delete my analytics data". This deletes your PostHog profile and its events and signs you out; PostHog completes the removal shortly afterwards.
  • Portability — request your data in a machine-readable format
  • Objection / Restriction — ask us to stop or limit certain processing

To exercise any of these rights, or if you cannot log in to delete your PostHog analytics data yourself, contact us at: nathancampolina.r@gmail.com.

If you are located in Brazil, you have additional rights under the Lei Geral de Proteção de Dados (LGPD), including the right to lodge a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).

If you are located in the EU/EEA, you have additional rights under the General Data Protection Regulation (GDPR), including the right to lodge a complaint with your local data protection supervisory authority.

9. Children's Privacy

Steamdle is not directed at children under the age of 13 (or 16 in the EU/EEA). We do not knowingly process personal data from children. If you believe a child has used Steamdle and their data has been processed, please contact us and we will take prompt action.

10. Steam Services Compliance

10.1 Two Separate Steam Services

Steamdle uses two distinct Steam services, which should not be confused:

  • Steam OpenID — used for authentication only. The login process takes place on Steam's own website. Steamdle receives only your Steam ID upon successful login. No credentials are ever shared with or stored by Steamdle.
  • Steam Web API — used after authentication to retrieve your public profile and game library data. This is a separate service from OpenID. All data returned by the Steam Web API is limited to information you have made publicly visible on your Steam profile.

10.2 Steam Data Storage Location

Steam Data retrieved via the Steam Web API is processed on infrastructure operated by Vercel Inc., defaulting to the iad1 region (Washington D.C., United States). Vercel's edge network (on AWS, Azure, and GCP) may cache content globally. Steam Data is not stored in any persistent database operated by Steamdle.

10.3 Steam Data Disclaimer

As required by the Steam Web API Terms of Use, Steam Data is provided to you on an "as is," "with all faults," and "as available" basis. Valve Corporation, Steam game publishers and developers, and their suppliers make no representations or warranties of any kind, express or implied, regarding Steam Data, including without limitation any warranties of merchantability, fitness for a particular purpose, accuracy, or non-infringement.

In no event will Valve or its suppliers be liable for any indirect, consequential, special, incidental, or punitive damages arising out of your use of Steam Data retrieved through Steamdle, even if advised of the possibility of such damages.

Steamdle is not endorsed by or affiliated with Valve Corporation or Steam.

11. Third-Party Links & Services

Steamdle may link to third-party services such as Steam store pages. This Privacy Policy does not apply to those services. We encourage you to review the privacy policies of any third-party sites you visit.

12. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Continued use of Steamdle after changes are posted constitutes your acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or data requests regarding this Privacy Policy, please contact:

Nathan Campolina

Email: nathancampolina.r@gmail.com

← Back to home