Find a squadStart Squad
◂ Back to Level40

Privacy Notice

Last updated: [DATE — fill in on publish]

Draft status: This document has been prepared as a comprehensive first draft covering standard GDPR-required disclosures. It has not yet been reviewed by a qualified lawyer. Before this page is published live and relied upon, it should be reviewed by legal counsel familiar with Czech and EU data protection law (GDPR). Do not treat this as final legal advice.

1. Who controls your data

Level40.gg is operated by [LEGAL ENTITY NAME — fill in], based in the Czech Republic ("we," "us," "our"). We are the data controller for the personal data described in this notice.

Contact for privacy questions: [PRIVACY CONTACT EMAIL — fill in]

2. Our approach to your privacy

Level40.gg is built around one core principle: your gaming library, your identity, and your activity belong to you, and you decide who sees them. Nothing about your account is visible to anyone else — including other users in a squad — unless you take an explicit action to share it. This section explains exactly what we collect, why, and what control you have over it.

3. What data we collect

Account information When you create an account, we collect basic information such as your email address and a display name.

Connected platform data If you choose to connect a third-party account, we collect only the specific data you approve during that platform's authorization flow:

  • Steam: your Steam ID, and — only if you choose to share it — your game library and playtime. Steam library data is only accessible if your Steam privacy settings allow it, and remains subject to your Steam privacy settings at all times.
  • Discord: your Discord user ID and username, used to identify you within squad features.
  • Google: your name and email address, used solely for account sign-in.

Connecting a platform is entirely optional. You can disconnect any platform at any time from your account settings, which stops us from receiving any further data from it.

Usage data We may collect basic technical data necessary to operate the Service, such as pages visited and general interaction data (for example, which recommendation filters you use), to improve the product. This data is not sold or shared with advertisers.

What we do not collect We do not collect payment card information (any future paid features would be processed through a third-party payment processor, who would handle that data directly — not us). We do not use third-party advertising trackers.

4. Why we process your data (legal basis)

Under GDPR, we rely on the following legal bases:

  • Contract: processing necessary to provide the Service you've signed up for (e.g., showing your library-based recommendations).
  • Consent: for connecting third-party platforms and for any optional features — you can withdraw consent at any time by disconnecting the platform or adjusting your settings.
  • Legitimate interest: for basic security, fraud prevention, and service improvement, balanced against your rights.

5. Who can see your data

By default, your account, connected libraries, and activity are private — visible only to you. Data becomes visible to others only when you take a specific action to share it, such as:

  • Joining a squad and choosing to share your library for comparison with that squad.
  • Sharing a squad invite link with specific people you choose.

We do not make any user's library, playtime, or personal activity public by default under any circumstance.

6. Who we share data with

We share limited data with the following categories of service providers ("processors"), solely to operate the Service:

  • Hosting and database: our application and database are hosted with infrastructure providers (including Vercel and Neon), who process data on our behalf under their own data processing agreements.
  • Game metadata providers: RAWG and IGDB provide game information to us. We do not send them your personal data — this is a one-way data flow of public game information into our systems.

We do not sell your personal data to anyone, under any circumstances. We do not share your data with advertisers or data brokers.

7. International data transfers

Some of our infrastructure providers may process data outside the European Economic Area (EEA), including in the United States. Where this occurs, we rely on appropriate safeguards recognized under GDPR (such as Standard Contractual Clauses) to ensure your data remains protected to an equivalent standard.

8. How long we keep your data

We retain your account data for as long as your account is active. If you delete your account, we delete your personal data within [30 days — confirm timeframe], except where we are required to retain certain data for legal or security purposes (for example, fraud prevention logs).

9. Your rights

Under GDPR, you have the right to:

  • Access the personal data we hold about you.
  • Correct inaccurate data.
  • Delete your data ("right to erasure").
  • Export your data in a portable format ("right to data portability").
  • Object to certain processing, including processing based on legitimate interest.
  • Withdraw consent at any time, where processing is based on consent (such as a connected platform).
  • Lodge a complaint with your local data protection authority, or the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), if you believe your rights have been violated.

To exercise any of these rights, contact us at [PRIVACY CONTACT EMAIL]. We will respond within the timeframes required by GDPR.

10. Security

We take reasonable technical and organizational measures to protect your data, including encryption of sensitive credentials, access controls limiting who can view data internally, and restrictive default privacy settings. See our [Security page] for more detail on our practices.

11. Children's privacy

The Service is not directed at children under 16. We do not knowingly collect personal data from children under this age. If you believe a child has provided us with personal data, contact us and we will delete it.

12. Changes to this notice

We may update this Privacy Notice from time to time. Material changes will be communicated via the Service or by email before they take effect.

13. Contact us

Questions about this notice or your data: [PRIVACY CONTACT EMAIL — fill in]