Privacy policy

Who is responsible

GameMargins is responsible (the controller) for your personal data:

Run by

Vidisti, trading as GameMargins

Address

Prinsengracht 352 1, 1016 HZ Amsterdam, the Netherlands

Chamber of Commerce (KvK)

74451588

VAT number

NL002328358B52

Email

support@gamemargins.com

Contact form

gamemargins.com/contact

Without an account

• We store nothing that identifies you. What you set on a tool page (levels, rates, filters, the character you link) stays in your own browser.
• When you look up a character (an Old School RuneScape name, an Albion Online or MapleStory Classic character), our server asks the game's own public service for it (the official Hiscores, Albion Online's player search, Nexon's rankings) and keeps the answer only a few minutes, for repeat lookups.
• Every page, picture and font comes from our own server: to show an item or a monster, your browser doesn't contact the games' servers or anyone else's.
• Our hosting provider keeps technical logs of requests, which include IP addresses, for a short time to run and protect the site. Login requests are counted per IP address for a few minutes to stop abuse.

With an account

• Your email address, to log you in, send the alerts you set up, and send messages about your account or subscription. We check new addresses against a list of throwaway email services; that check runs on our own server.
• Your password, if you set one: only as a scrambled (hashed) copy that can check a password but can't be turned back into it.
• A linked Google, Discord or Apple account, if you log in with one or link it: that service tells us your email address, whether it has confirmed it, and your account number there, and we store that number to recognise you next time, with the keys it gives us, encrypted. We don't keep your name or picture from there and never post anything on your behalf.
• Login sessions: when you log in we store your IP address and the type of browser with the session, to keep your account safe. A session expires 30 days after you last used the site, or when you log out, and is then deleted.
• The authenticator app, if you turn it on: its secret and your backup codes, stored encrypted.
• What you save: your watchlist, price alerts and their notifications, flip log, price list, FC 27 squads and the banks you save on the Bank value tool (the item list you pasted and its value at the time; valuing a bank without saving stores nothing). Price reports you share appear to others only inside an anonymous community price, where each mailbox counts once (so aliases of one inbox can't outvote other players), and saved squads only inside anonymous counts of which players are picked most.
• Auction house scans you upload (WoW: Forever, from our addon): per scan, which auction house it is of, when it was made, and per item the prices and quantities listed. The file also names the realm and zone it was made in; it never holds a character name, your account or any seller or bidder name, and we don't keep the file itself. The characters the addon notes (level, professions, recipes, gold, bags) are read in your browser and stay there; our server ignores them. Scans are kept for 90 days and stay, without any link to you, when you delete your account.
• Transfer Market prices from the browser extension (EA SPORTS FC 27): if you connect our extension to your account, it sends what your own Web App searches showed: per card, its id, rating, position and card type, the lowest buy-now price on the page, how many listings there were, the time, and whether it is the console or the PC market. It never sends your EA account, persona or club name, your coins, your own listings, bids or purchases, and it never contacts EA itself. The token that connects it is kept as a scrambled (hashed) copy and can be revoked on the extension page. Reports are kept for 14 days and the daily prices made from them for 90 days; both stay, without any link to you, when you delete your account (a deleted account's reports still count as one player's, never as several). Your club, which the extension notes when you look at it in the Web App, stays in the extension and goes only to GameMargins' own pages in the same browser, to mark your players; it is never sent to our server.
• Screenshots you upload (MapleStory Classic): the picture is read on our server while your upload runs and is then gone; it is never stored, and nobody looks at it. We keep only what was read off it: item, price, quantity and channel, with the time and a score of how sure the reading was. A picture can show character names or chat, and none of that is kept. Observations are kept for 90 days and stay, without any link to you, when you delete your account.
• Push notifications, if you turn them on: the address your browser or phone gives us for them. The notification travels through the push service of your browser or phone (for example Google, Mozilla, Apple or Microsoft), or through Expo for our app.
• A Discord webhook, if you add one: we keep its address until you remove it, and post your alerts to that channel, which puts them on Discord's servers.

Premium

• Payments go through Link (by Stripe), the seller of record. Link collects your payment details and billing address and handles them under its own privacy policy (Link, Stripe). We never see your full card number.
• We keep your Stripe customer and subscription numbers, your plan, and until when it runs.
• To give each person one free trial, we store a fingerprint of the payment method you started a trial with: a code Stripe derives from the card (not the card number), or a scrambled (hashed) copy of your Link email. We keep it for 3 years, also after you delete your account.

The contact form

• What you send: your email address, the topic, your message, the page you wrote from and, when you are logged in, your account's email address and whether it has Premium. It is emailed to our support mailbox; the site keeps no copy.
• We use it only to answer you and to follow up on what you reported.

Why we may use it

• Your account, your saved lists, alerts and Premium: to provide the service you signed up for (contract).
• Session details, request logs, the throwaway-email check and trial fingerprints: to keep GameMargins secure and stop abuse (our legitimate interest).
• Push notifications and Discord alerts: your consent, which you can take back any time in your browser or on the Alerts page.
• Contact form messages: to answer the question you asked us (our legitimate interest, and your request).

Who helps us

These services run parts of GameMargins for us and may only use your data to do that:

• Railway: hosting and the database, on servers in Amsterdam.
• Resend: sends our emails.
• Cloudflare: keeps our database backups, encrypted by us before they leave, on servers in the EU.
• Proton: our support mailbox.
• Push services of browser and phone makers, and Expo: deliver notifications. Discord: only if you add a webhook.
• Google, Discord and Apple: only if you log in with them, to confirm who you are.

Stripe and Link decide themselves how they use payment data. Railway, Resend, Cloudflare and Stripe are companies in the United States; where data goes there, it is protected by the EU-US Data Privacy Framework or the EU's standard contractual clauses. We don't sell your data or share it for advertising.

How long we keep it

• Your account and what you saved: until you delete your account. Copies in our encrypted database backups disappear as those backups expire: daily ones after 14 days, monthly ones after 3 months.
• Sessions: until they expire (30 days after your last visit) or you log out. Login links work for 10 minutes; links to confirm an address, set a password or delete an account for 1 hour; all are removed within a day after that.
• A linked Google, Discord or Apple account: until you remove it under Account > Security or delete your account.
• Email address changes: the old and the new address, for 30 days, so a change can be undone.
• Uploaded auction house scans: 90 days; the per-item detail of each scan 14 days, the daily prices made from them 90 days.
• Prices read off uploaded screenshots: 90 days; the screenshots themselves: not at all.
• Transfer Market reports from the browser extension: 14 days; the daily prices made from them: 90 days; extension tokens: until you revoke them or delete your account.
• Trial fingerprints: 3 years.
• Contact form messages and email to support: in our support mailbox for up to 2 years after the last message about it.
• Payment records: Link and Stripe keep them as long as tax law requires.

Cookies

We only set cookies needed for logging in: the one that keeps you logged in, and, if you use an authenticator app, one for the code step (10 minutes) and one for a device you chose to trust (30 days). They are needed for your account to work, so they need no consent. Tool settings are saved in your browser's local storage and never leave it. We use no tracking, analytics or advertising cookies. If we ever add advertising, we will update this policy first and ask for your consent where the law requires it.

Your rights

You can ask to see, correct or receive a copy of your data, object to how we use it, or have it deleted. You can download your data and delete your account yourself, under Account, Security; for everything else, email support@gamemargins.com and we answer within a month. If you are unhappy with how we handle your data, you can complain to the Dutch data protection authority, Autoriteit Persoonsgegevens, or the one in your own country.

Children

Accounts are for people aged 16 and over, or younger with permission from a parent or guardian.

Changes

When this policy changes, the date at the top changes too. For important changes we also email account holders.