Privacy Policy

When you sign in through Steam, we receive and store your public Steam identity: your 64-bit Steam ID, display name, avatar, profile URL, and country code. We never see or store your Steam password — sign-in happens entirely on Steam's own website.

When you sync your library (an action you trigger), we store your list of owned games and your playtime figures, including a history of playtime over time. We only ever retrieve Steam data about you, at your request — never about anyone who hasn't signed in.

When you ask Hoodoo a question, the text of your question and the names and playtimes of games in your library are processed to generate recommendations. We also store a daily counter of how many questions you've asked.

When you use the site, we collect usage analytics: the pages you visit, the things you click, your approximate location (country and region, derived from your IP address — we do not store the address itself), and your browser and device type. We also record replays of site sessions — a reconstruction of what happened on the page, so we can see where the site confuses people. Anything you type into a text field is masked before the replay leaves your browser: we see that you typed, never what you typed. While you are signed in, this activity is linked to your Steam ID, so we can tell one person's visit from another's. See ANALYTICS below for who runs this and how to opt out.

We use a small number of service providers to run Hoodoo: Supabase (database hosting, EU), Vercel (application hosting and delivery), Anthropic (processes your questions to Hoodoo together with your game list to generate recommendations), PostHog (usage analytics and session replay, EU hosting), and Valve/Steam (the source of your library data, governed by your own Steam privacy settings).

We do not sell your data. We do not run advertising trackers. If that ever changes, this policy will change first and say so plainly.

Our analytics and session replay are provided by PostHog, on their EU cloud (data stored in Frankfurt, Germany). We use it for one reason: Hoodoo is small and new, and watching where people click — and where they give up — is how we decide what to fix next. We do not use it for advertising, we do not sell what it collects, and nobody outside Hoodoo sees it.

It runs without cookies. Nothing is stored on your device, which also means we cannot recognise you across visits unless you are signed in.

Opting out: if you are signed in, there is a switch in your settings — turn analytics off and nothing is loaded and nothing is recorded, on any device you sign in on. Separately, if your browser sends a "Do Not Track" signal, we collect no analytics and record no sessions either — Hoodoo honours it, signed in or not. You can also email hello@hoodoo.gg and ask us to delete the analytics data tied to your Steam ID, or to object to this processing altogether.

We process your account and library data to provide the service you signed up for (Art. 6(1)(b) GDPR — performance of a contract).

We process usage analytics and session replays on the basis of our legitimate interest in understanding and improving the service (Art. 6(1)(f) GDPR). You have the right to object to this — see ANALYTICS above.

You can delete your account yourself at any time — the button is at the bottom of your own profile page — which immediately and permanently removes your profile, library, playtime history, playlists, and usage records from our database. For access or correction requests, email hello@hoodoo.gg.

You also have the right to data portability and the right to lodge a complaint with a supervisory authority — in Luxembourg, the CNPD (Commission nationale pour la protection des données).