Privacy

What we collect

Any game’s page is open without an account. Signing in collects:

• Your email address, to send you sign-in codes and links. It is never shown to other players. Asking for a code creates your account, even if you never use the code. If you change your address, we keep the new one beside the old until you enter the code we send it, or until you ask for a different one instead. Once it changes, we email the old address to say so.
• The username, display name and profile picture you choose. These are public, along with the date you joined. A picture is optional: it is a photo you upload from your account page, which you frame as a square and your browser redraws small before it is sent, leaving the photo’s location and camera details behind. We store the square that arrives, corners included, in Supabase Storage, where anyone with its address can load it, and you can remove it at any time, which deletes the file. Without one, you are shown by your initials. If you gave an avatar link when you signed up, we still hold that link and it is still public, but the site shows it nowhere and never loads it.
• Your trades, holdings and balance, to run the game. Other players cannot see them, except the figures the Rich List shows once you qualify for it (below).
• A record of each session. When you sign in, the IP address and browser you used are stored with the session.

Whether or not you sign in, our providers keep short-lived request logs (IP address, browser, page and time) to keep the site running and secure.

We do not collect your real name, postal address or payment details. We use your email address only to sign you in and to tell you when it changes: we send no marketing email, and we do not sell your data or share it for advertising.

The Rich List

Once you qualify for the Rich List, anyone can see your username, display name, profile picture if you have added one, place, net worth and how it has changed, the share of it in cash, the game you hold most of and its share, how many games you hold, how many trades you have made and on how many days, your best place, how long you have spent at the top and when you were first listed, the badges you have earned, and your net worth at each hourly edition this season. If you hold one of its honours, the figure it was awarded for is shown too, rounded: your biggest holding’s share of your net worth, the profit you have banked by selling to the nearest 1% of the starting cash, or the fees you have paid to the nearest credit.

Nobody else sees your email, the number of shares you hold, what you paid for them, or any single trade. Your net worth and your top game’s share are public, though, so that holding can be roughly estimated. Until you qualify you are counted but never named. The page asks search engines not to index it. Admins can see every portfolio in order to run the game. It is stored in the same Supabase database as the rest of your account, and deleting your account deletes your entries.

Where it is processed

Your account and everything in it are stored and processed in the United States, by three providers:

• Supabase holds the database and runs sign-in, in its us-east-2 region (Ohio). Profile pictures are stored there too, and delivered through its global network.
• Vercel hosts the website. The code that reads the database runs in the United States, next to it. Pages are delivered through Vercel’s global network, so a request may first reach a server near you.
• Resend delivers the sign-in email and the notice when your address changes, from its us-east-1 region (North Virginia). It receives your email address and the message.

Game artwork loads directly from Steam’s image servers, and profile pictures from Supabase’s, so those servers see your IP address when an image loads. A player’s initials load from nowhere, and no image ever loads from a server a player chose. The service that alerts us when the site stops working is sent nothing about you.

Cookies

Every cookie on Vidstonks is for signing in:

• A session cookie keeps you signed in. It is renewed as you use the site and removed when you sign out. Left unused, it expires after 400 days.
• A sign-in cookie remembers the email address you typed while you wait for your code. It is sent only to the sign-in page, deleted once you are signed in, and lasts an hour at most.
• Sign-in check cookies. When you ask for a code, our sign-in provider (Supabase) also sets cookies holding random one-time check values, with nothing about you in them. They stay after you sign in, are removed when you sign out, and otherwise expire after 400 days.

If you change the theme or the colour palette, your browser remembers the choice in its own storage and never sends it to us. There are no analytics, advertising or tracking cookies, and no analytics of any other kind.

How long we keep it

• Your account, profile, trades and past seasons’ results are kept for as long as your account exists.
• The record of a session is removed when you sign out.
• Request logs expire on each provider’s own schedule.
• The database is backed up daily and each backup is kept for seven days, so deleted data can remain in a backup for up to a week.

Deleting your account

We delete an account by hand when its owner asks. Deleting it removes your email address, profile, profile picture, trades, holdings and season results together, and it cannot be undone. Your entries in the Rich List go with it.

Steam data

We fetch no per-user Steam data. There is no Steam login or Steam account linking, so nothing is read from anyone’s Steam account. We use game-level concurrent-player counts, not individual players’ information.

Changes

If what we collect changes, this page changes first.