Privacy Policy

This policy explains how Nextplay processes personal data when you visit the website, connect a Steam account, use your library and wishlist, or join an achievement challenge.

Controller and contact

xthink strategy GmbH
Pappelallee 78/79
10437 Berlin
Germany

Email: k.konrad@xthink-strategy.de. Further company details are in our Legal Notice.

Data we process and why

Website access and security

Our hosting provider processes technical request information, which may include your IP address, browser details, requested pages, and timestamps, to deliver the website, maintain security, and diagnose errors. The legal basis is our legitimate interest in operating a secure and reliable service (Article 6(1)(f) GDPR).

Steam sign-in and your account

When you choose to sign in, we redirect you to Steam OpenID. Steam authenticates you and returns a Steam ID; we do not receive your Steam password. We obtain your public Steam display name, avatar, and profile URL and store them with your Nextplay account. We use a short-lived sign-in cookie and a signed session cookie to complete sign-in and keep you signed in. This processing is necessary to provide the account features you request (Article 6(1)(b) GDPR).

Library, wishlist, achievements, and challenges

When you use these features, we retrieve available Steam game and wishlist data, playtime, recent activity, and achievement unlocks. We store this information to show your library, recommendations, dashboard, and challenge score. If you join a weekly challenge, your Steam display name, avatar, and score can appear on its leaderboard. The legal basis is Article 6(1)(b) GDPR. Availability depends on your Steam privacy settings and the data Steam provides.

Usage measurement

We use Vercel Web Analytics for aggregated page views and limited custom events. Vercel states that its Web Analytics does not use third-party tracking cookies or store a persistent visitor identifier. We also record selected event names and timestamps in our database without a user ID, IP address, or device identifier. We use these measurements to understand and improve the service, based on our legitimate interest (Article 6(1)(f) GDPR). See the Cookie Policy for browser storage details.

Contact

If you email us, we process your message, email address, and any information you provide to answer your request. Depending on the request, the legal basis is Article 6(1)(b) or (f) GDPR, or Article 6(1)(c) GDPR where a legal obligation applies.

Recipients and external services

Vercel hosts and delivers the website and provides Web Analytics. Supabase hosts the application database. Steam supplies account and game information after you initiate sign-in or a data refresh. We obtain game metadata from Steam and IGDB and availability data from NVIDIA GeForce NOW; these catalogue lookups generally use game identifiers, not your Steam account details. Game artwork and Steam avatars may load from external image hosts, which receive the technical information needed to serve those images. Links to external websites are governed by their own privacy policies.

Service providers may process data outside the European Economic Area. Where a transfer requires safeguards, we rely on an applicable adequacy decision or appropriate safeguards such as standard contractual clauses.

How long data is kept

Account and imported Steam data are kept while your Nextplay account is in use. You can ask us to delete your account and associated personal data by emailing the address above; legal retention obligations may require us to keep limited records for longer. Technical logs are kept only as long as needed for operation, security, and troubleshooting under our hosting arrangements. Usage measurements are retained according to their purpose and the settings of the relevant service. The sign-in cookie expires after 10 minutes; the session cookie expires after 30 days.

Your rights

Subject to applicable conditions, you may request access, correction, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. You may also lodge a complaint with a data protection supervisory authority. Contact us at k.konrad@xthink-strategy.de to exercise your rights.

Changes to this policy

We may update this policy when the service or legal requirements change. The current version will be available on this page with its update date.