Privacy Policy

1. Data controller

The controller of your data is the private individual who operates the howtoplay.ro website.

For any request regarding personal data you can contact us at liviu@howtoplay.ro. The full identity of the controller can be provided to data subjects on request.

2. What data we collect

We collect only the data necessary to run the service:

• Account: email address, display name and password (stored as an Argon2id hash, never in plain text), account role. • Usage and statistics: an anonymous identifier stored in a cookie (htp_anon), browsing events (pages visited, clicks), device type and IP address (processed temporarily, for security and aggregate statistics). • Price alerts: the games and thresholds you configure and the notification channel (email, push or Discord). • Connections: if you link your account to Discord or Patreon, we store that identifier to provide the feature. • Content: the listings, reviews, votes and contributions you publish.

We do not collect sensitive data and we do not ask for payment information (payments to stores happen on their own websites).

3. Legal basis

We process data on the basis of:

• Performance of a contract — to provide your account and the features you request. • Consent — for analytics and advertising cookies and for certain notifications; you can withdraw it at any time. • Legitimate interest — for security, abuse prevention and improving the service through aggregate statistics. • Legal obligations — where the law requires us to retain certain data.

4. Purposes of processing

We use data to: create and manage your account; send the alerts and notifications you enable; display and moderate the content you publish; generate aggregate and anonymous usage statistics; prevent fraud and abuse; and, only with your consent, display relevant ads.

5. Cookies

We use cookies necessary for operation and, with your consent, analytics and advertising cookies. Full details and control options are in the Cookie Policy.

6. Providers and third parties

To operate, we rely on providers that process data on our behalf, only for the purposes described:

• Resend — sending transactional emails and alerts. • Google — serving ads (AdSense) and managing consent (Funding Choices), when advertising is active and you have consented. • Discord — delivering notifications and the linked-account feature, if you use it. • Hosting provider — storing and running the application.

The game data sources (BoardGameGeek, Boardiacs, stores) do not receive personal data about you.

7. Disclosure of data

We do not sell or rent your personal data. We disclose it only to the providers above, strictly for the purposes described, and to authorities when the law requires it.

8. Data retention

We keep account data for as long as the account is active. After you delete your account, the associated data is deleted or anonymized within a reasonable period, except for data we must keep due to legal obligations.

Usage data may be kept in aggregate and anonymous form, without identifying you.

9. Your rights

As a data subject you have the right to: access your data; rectification; erasure (“the right to be forgotten”); restriction of processing; data portability; objection to processing; and withdrawal of consent at any time.

You can exercise most of these rights directly from Account → Data (export and deletion) or by writing to us at liviu@howtoplay.ro.

If you are dissatisfied, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

10. Data security

We apply reasonable technical and organizational measures: passwords are stored using strong hashing (Argon2id), traffic is encrypted via HTTPS, and sessions use secure tokens. No system, however, is 100% secure.

11. Minors

The site is not directed at children under 16. We do not knowingly create accounts for people under 16 without the consent of the holder of parental responsibility. If you learn that a minor has provided us data without such consent, contact us for deletion.

12. International transfers

Some providers (for example Google, Resend, Discord) may process data outside the European Economic Area. In such cases we ensure adequate safeguards are in place, such as the European Commission's standard contractual clauses.

13. Changes to this policy

We may update this policy. The current version, with the last-updated date, is always available on this page. Significant changes may be announced additionally.

14. Contact

For questions or requests regarding personal data: liviu@howtoplay.ro.