Security

Last updated: [DATE — fill in on publish]

We know that connecting your Steam library, Discord identity, or other gaming accounts requires trust. This page explains, in plain language, how we protect your data and what we do — and don't do — with it.

Your account stays private by default

Nothing about your account — your connected games, playtime, or activity — is visible to anyone else unless you explicitly choose to share it, such as by making your profile public or joining a squad and opting to compare libraries. Your library and linked accounts remain private by default.

We never sell your data

We do not sell your personal data to advertisers, data brokers, or any third party, under any circumstances. We don't run third-party advertising trackers on the Service.

Your connected accounts, your control

You choose which platforms to connect (Steam, Discord, Google, and others we may add) and can disconnect any of them at any time from your account settings. Disconnecting immediately stops us from receiving any further data from that platform.

For Steam specifically: we can only see what your own Steam privacy settings allow. If your Steam profile or library is set to private, we cannot access it regardless of whether you've connected your account.

How we protect your data technically

Encryption in transit: all traffic to and from Level40.gg is encrypted (HTTPS/TLS).
Encrypted credentials at rest: when a connected-platform token must be stored for a supported feature, it is encrypted before it reaches the database. Google and Discord sign-in do not require token storage.
Access controls: account data is protected by server-side authorization checks, database foreign keys, privacy-scoped queries, and revocable sessions. The application does not currently claim database-native row-level security.
Least-privilege admin access: our internal admin tools (used to verify game data) are separately access-controlled and cannot access personal account data beyond what is operationally necessary.
No plaintext secrets: API keys, database credentials, and other secrets are never committed to our codebase or exposed in client-facing code.

Our co-op data verification process

Separately from account security, we also take care with the accuracy of the game information we publish. Every game on Level40.gg starts as "unverified" or "AI-suggested" and is never presented as a confirmed fact until a real person on our team has checked it. You can see this status on every game page.

Reporting a security concern

If you believe you've found a security vulnerability or issue with Level40.gg, please contact us directly at [SECURITY CONTACT EMAIL — fill in] rather than disclosing it publicly. We take reports seriously and will respond promptly.