Privacy policy

Open Credits (opencredits.games) is run by Lodestone Development (company details in our legal notice). We decide how your personal data is used, which makes us the controller under the GDPR.

Questions about your data: hello@opencredits.games.

You don't need an account to look up games, browse or search. We don't set cookies for visitors.

We count page views with Cloudflare Web Analytics, which works without cookies and doesn't identify you or follow you across sites. We see totals, such as how many people opened a page and which country they came from.

To keep the site available and stop abuse, we use your IP address for a short time to limit how many requests one visitor can make (for example, searches per minute). We don't store it for this. Our hosting provider keeps short technical logs for security and troubleshooting, which can include IP addresses.

What you type in search isn't linked to you. Recent searches are kept in memory for a few minutes so repeated searches are fast.

Some game pages have a trailer. It shows as a still image, and nothing loads from YouTube, Vimeo or Steam's video servers until you press play. When you do, the video comes from that service, which then applies its own privacy policy and may set its own cookies. For YouTube, we use its privacy-enhanced mode.

Developer accounts are for people who make games or act for a game's developer. When you use one, we keep:

• your email address, and when your account was created
• your sign-in sessions: when they start and expire, and the IP address and browser they came from
• your claims: the game, the code we gave you, how the claim was confirmed and a link to where we found the code
• what you publish: the AI credits and notes for your games, your trailer link, whether you asked us to show your Steam screenshots and trailer, and your links, all public on the game's page
• games you submit: title, developer name and links

We use this to run your account, confirm that a game is yours, show what you publish, reply to you, and keep a record of changes to public pages so mistakes can be put right.

The legal bases are our agreement with you (running your account and showing what you publish) and our legitimate interest in keeping the site accurate and safe (the change record and abuse prevention).

We set one cookie, and only after you sign in: it keeps you signed in for up to 30 days. It's strictly necessary for the account to work, so we don't ask for consent. Visitors who don't sign in get no cookies from us.

We send email only when it's needed for something you did: a sign-in link, a claim confirmed, or an update about a game you submitted. Sign-in links work once and expire after 15 minutes.

We don't send newsletters or marketing unless you sign up for them separately.

These companies process data for us, under agreements that let them use it only to provide their service:

• Railway: hosting and database, in the EU (the Netherlands)
• Resend: sending email, from its EU region
• Cloudflare: domain name service and cookieless visit counts
• OpenAI: reads the text of public Steam reviews that mention AI, without who wrote them, to sort them for our scores. No data about you or other people who use our site is sent to OpenAI

Some of these companies are based in the United States. Where data leaves the EU, it's covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses.

• Sign-in links: 15 minutes, and only until used
• Sessions: up to 30 days
• Your account and what you publish: until you ask us to delete your account
• The record of changes to public pages: for as long as the site runs, because it shows who changed what and why. After your account is deleted, the entries keep only an anonymous account number

You can ask us for a copy of your data, to correct it, to delete it, to move it elsewhere, or to stop using it. Write to hello@opencredits.games from the email address on your account, and we'll reply within 30 days.

If you think we've handled your data wrongly, you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

If we change how we use your data, we update this page and the date at the top. If a change affects your account, we tell you by email first.