Privacy Policy

1. Data controller

The controller of your data is the private individual who operates the howtoplay.ro website.

For any request regarding personal data you can contact us at liviu@howtoplay.ro. The full identity of the controller can be provided to data subjects on request.

2. What data we collect

We collect only the data necessary to run the service:

• Account: email address, display name and password (stored as an Argon2id hash, never in plain text), account role. • Usage and statistics: an anonymous identifier stored in a cookie (htp_anon), browsing events (pages visited, clicks), device type and IP address (processed temporarily, for security and aggregate statistics). • Price alerts: the games and thresholds you configure and the notification channel (email, push or Discord). • Connections: if you link your account to Discord or Patreon, we store that identifier to provide the feature. • Content: the listings, reviews, votes and contributions you publish.

We do not collect sensitive data and we do not ask for payment information (payments to stores happen on their own websites).

3. Legal basis

We process data on the basis of:

• Performance of a contract — to provide your account and the features you request, including recommendations based on what you saved in your account (wishlist, lists, price alerts). • Consent — for analytics and advertising cookies, for personalised recommendations based on your activity on the site (the "Personalisation" category) and for certain notifications; you can withdraw it at any time. • Legitimate interest — for security, abuse prevention and improving the service through aggregate statistics. • Legal obligations — where the law requires us to retain certain data.

4. Purposes of processing

We use data to: create and manage your account; send the alerts and notifications you enable; display and moderate the content you publish; personalise game and deal recommendations (based on your account or, with your consent, on your activity on the site); generate aggregate and anonymous usage statistics; prevent fraud and abuse; and, only with your consent, display relevant ads.

5. Personalised recommendations

We order games and deals (for example the recommendations on the home page, the Black Friday deals and the deals page) by what interests you, on two separate legal bases:

• With your consent (the "Personalisation" category, Art. 6(1)(a) GDPR): we use the games you view, the ones you add to your wishlist and your clicks through to shops, linked to the anonymous identifier htp_anon and, if you are logged in, to your account. We use only the signals from the last 60 days. You can withdraw your consent at any time from the "Cookie settings" link; after withdrawal we no longer use your activity for recommendations and we delete the signals kept solely for personalisation. • As part of the service, if you have an account (performance of a contract, Art. 6(1)(b) GDPR): we use what you explicitly saved in your account — wishlist, lists, price alerts — to show you relevant recommendations, even without the "Personalisation" category.

Recommendations only change the order in which we show you games and deals; we make no decisions based on them that produce legal effects concerning you. Personalised results are kept only in your browser, for a few minutes. Cookie details are in the Cookie Policy.

6. Cookies

We use cookies necessary for operation and, with your consent, analytics, advertising and personalisation cookies. Full details and control options are in the Cookie Policy.

7. Aggregate audience measurement

In addition to consent-based analytics, we count pageviews in aggregate, without cookies and without identifiers: we only retain how many views a page received on a given day, with no information about the visitor (no ID, IP address or browser data stored). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in measuring our own site's audience; since this counting sets no cookie and reads no identifier from your device, this counting does not require consent and also works if you rejected analytics.

8. Providers and third parties

To operate, we rely on providers that process data on our behalf, only for the purposes described:

• Resend — sending transactional emails and alerts. • Google — serving ads (AdSense) and managing consent (Funding Choices), when advertising is active and you have consented. • Discord — delivering notifications and the linked-account feature, if you use it. • Hosting provider — storing and running the application.

The game data sources (BoardGameGeek, Boardiacs, stores) do not receive personal data about you.

9. Disclosure of data

We do not sell or rent your personal data. We disclose it only to the providers above, strictly for the purposes described, and to authorities when the law requires it.

10. Data retention

We keep account data for as long as the account is active. After you delete your account, the associated data is deleted or anonymized within a reasonable period, except for data we must keep due to legal obligations.

Signals kept separately for personalised recommendations (games viewed and added to your wishlist, when statistics are turned off) are deleted automatically after 60 days, and immediately when you withdraw your "Personalisation" consent or delete your account.

Usage data may be kept in aggregate and anonymous form, without identifying you.

11. Your rights

As a data subject you have the right to: access your data; rectification; erasure (“the right to be forgotten”); restriction of processing; data portability; objection to processing; and withdrawal of consent at any time.

You can exercise most of these rights directly from Account → Data (export and deletion) or by writing to us at liviu@howtoplay.ro.

If you are dissatisfied, you have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP, dataprotection.ro).

12. Data security

We apply reasonable technical and organizational measures: passwords are stored using strong hashing (Argon2id), traffic is encrypted via HTTPS, and sessions use secure tokens. No system, however, is 100% secure.

13. Minors

The site is not directed at children under 16. We do not knowingly create accounts for people under 16 without the consent of the holder of parental responsibility. If you learn that a minor has provided us data without such consent, contact us for deletion.

14. International transfers

Some providers (for example Google, Resend, Discord) may process data outside the European Economic Area. In such cases we ensure adequate safeguards are in place, such as the European Commission's standard contractual clauses.

15. Changes to this policy

We may update this policy. The current version, with the last-updated date, is always available on this page. Significant changes may be announced additionally.

16. Contact

For questions or requests regarding personal data: liviu@howtoplay.ro.