privacy policy

waffl.club collects only the data that it needs to operate. This is that data.

Your account. A username, a password, and an email address if you give one. The password is held as a hash, and the original password cannot be read from it. An email address is optional, but without one you cannot reset a password that you forget. You can also upload an avatar image.

What you put on waffl.club. Your stacks and the games on them, your reviews and their ratings, the modules on your profile and the text in them, the links you add to other sites, and the people you follow. waffl.club holds this data to show it to you, and to show it to other people if your settings permit that.

Your Steam connection. Only if you connect a Steam account. Refer to the Steam section below.

Your Twitch connection. Only if you connect a Twitch account. Refer to the Twitch section below.

Sign-in attempts. Each failed login and each signup records the IP address it came from and the username it used. This prevents an attacker from guessing passwords. waffl.club deletes these records after 24 hours.

Errors. When a fault occurs, waffl.club records the error, the position in the code, and the address of the page. It does not record your IP address, your cookies or your account details. The address of a profile page contains the username of that profile, which can be yours or another person's.

Messages you send. If you use the contact form, waffl.club keeps your name, email address and sent message.

waffl.club has no advertising, no A/B testing, no session recording and no behavioural analytics.

The GDPR requires a lawful basis for each use of data. waffl.club uses two.

A contract (Article 6(1)(b)) is the basis for the functions that you ask for: your account, your stacks and reviews, your profile, the people you follow, the notifications you turn on, the Steam import, the Twitch connection and the live tag, the Twitch panel, and the password reset email.

Legitimate interests (Article 6(1)(f)) is the basis for the functions that keep the app safe and available: limit on sign-in attempts, error records, backups, and replies to messages you send.

No function uses consent as a basis. There is no newsletter, no marketing email and no optional tracking.

waffl.club makes no automated decisions about you.

A new account is public. Any person on the internet can read your profile, your stacks and your reviews, with an account or without one. Search engines can find them.

You can change this at any time in your settings. A private profile is visible only to the people you approve.

You can also keep stacks private while the rest of your profile stays public. A private stack and the games on it are visible only to you. A stack that waffl.club manages for you, such as the one for your Steam wishlist, is always private.

If you connect Twitch, your profile shows a live tag while you stream, and the Twitch panel can show your profile on your channel. Both follow the same rule as the rest of your profile: if your profile is private, they show nothing to the people you have not approved.

This data is never public: your email address, your password, your sign-in records, your notifications, and the messages you send through the contact form.

Other people can copy public data while it is public. If you delete that data, waffl.club removes it. waffl.club cannot remove a copy that another person made.

A Steam connection is optional. waffl.club operates without one.

You sign in with Steam, so waffl.club does not receive your Steam password. waffl.club keeps your SteamID and the sign-in response that contains it.

When you start an import, waffl.club asks Steam for the games on your account and the play time for each game. It uses the play time only to select a stack for each game. If you ask for your wishlist, it reads that too. It then matches the games against a public games database to find the titles and the cover images. That request contains game identifiers and no data about you.

You can also turn on scheduled imports. waffl.club then reads your Steam library and your wishlist once a night, puts the games that are not yet on a stack onto the stacks that you choose, and sends you a notification. It keeps a record of each night's run for 90 days

If you disconnect Steam, waffl.club deletes the connection and the SteamID. The games that you imported stay on your stacks.

A Twitch connection is optional. waffl.club operates without one.

You sign in with Twitch, so waffl.club does not receive your Twitch password. waffl.club asks Twitch for no permissions, and it does not receive your Twitch email address. waffl.club keeps your Twitch user ID and the public profile that Twitch sends at sign-in. waffl.club does not keep a Twitch access token.

The live tag. waffl.club asks Twitch to tell it when your stream starts, when it stops, and when you change your Twitch name. Once an hour, it also asks Twitch whether your channel is live and what its name is, to correct a message that did not arrive. It keeps whether your channel is live, and since when.

The Twitch panel. If you add the waffl.club panel to your Twitch channel, it shows your username, your avatar and your stats to the people who watch your channel. The panel shows only what is public on your profile. When a viewer opens the panel, Twitch gives it a token that identifies your channel, and waffl.club uses that token only to find your profile. waffl.club keeps no data about the viewers of your channel.

If you disconnect Twitch, waffl.club deletes the connection and the Twitch user ID, and tells Twitch to stop sending messages about your channel.

waffl.club uses services from other companies. A contract permits these companies to process the data only as instructed.

• OVHcloud supplies the server that runs waffl.club and holds the database, in Canada. All the data above is held there.
• Cloudflare holds the avatar images.
• Mailjet sends the email. It thus holds your email address and the content of the messages sent to you, such as password resets and notifications.
• Bugsink receives the error records above.
• Valve (Steam) receives a request for your games, only if you connect a Steam account.
• Twitch receives your Twitch user ID in the requests about your stream, only if you connect a Twitch account.

No other company receives your data. No analytics company, no advertising network and no data broker is involved in waffl.club.

One person operates waffl.club and has administrative access to the database. That access is used in four conditions:

1. 1To help you, at your request. If you report a problem that cannot be diagnosed in a different way, and only as much as your question needs.
2. 2To correct a fault. If the error record does not explain a fault, the minimum data necessary to understand it can be read.
3. 3To act on a report of abuse. If an account is reported for behaviour that the terms prohibit, that account and the reported content can be examined.
4. 4When the law requires it. A valid and binding legal order is obeyed.

waffl.club does not sell, rent or trade your data. If a different person or company takes over waffl.club, you will get a message before the data moves, and you can delete your account first.

You have these rights. A request is answered in one month or less.

• Access. Ask for a copy of all the data held about you.
• Correction. Correct data that is not accurate. You can change most of it in your settings and on your profile.
• Erasure. Delete your account and its contents. There is a button for this in your settings, and it operates immediately.
• Portability. Receive your data in a format that a machine can read, or have it sent to a different service where that is possible.
• Restriction. Ask that the use of your data stops while a dispute about accuracy or about legitimate interests continues.
• Objection. Object to a use of data that has legitimate interests as its basis. These uses are listed above.
• Complaint. Complain to the data protection regulator of the country where you live. waffl.club operates from Canada, where that regulator is the Office of the Privacy Commissioner of Canada. In the European Union and in the United Kingdom, it is your own national regulator.

To use one of these rights, send an email to info@norrwyn.com. You must first confirm that the account is yours.

• TLS encrypts all traffic between your browser and the server. There is no unencrypted route into the app.
• Passwords are held only as salted hashes, with the algorithm supplied by Django.
• A password change immediately stops every open session, on every device.
• Sign-in attempts have a limit, by account and by IP address.
• Database backups are held on the same server as the database. The public internet cannot reach them.

No system is fully secure. If a breach puts your data at risk, the regulator receives a notification in 72 hours or less. If the risk to you is high, you receive a notification.

If you find a security fault, send a message to info@norrwyn.com before you tell other people.

Deletion is immediate and permanent. There is no delay period, and a deleted account cannot be restored.

Deletion removes your username, your email address and your password, your avatar image, your stacks and their contents, your reviews, your profile and its modules, your social links, the follows in both directions, your Steam connection and the SteamID with it, your Twitch connection and the Twitch user ID with it, your scheduled imports and the record of each one, your notifications, and the notifications that your activity created for other people.

Every session token issued to you stops when the account is deleted.

The backups are the one exception. waffl.club makes a database backup each night and keeps it for 14 days. A copy of the account stays in those backups until the last backup made before the deletion is itself deleted. Backups are used only to restore the service after a failure.

• Your account and its contents: while the account exists, except for the records listed below.
• Notifications you have read: 90 days. An unread notification stays until you read it.
• The record of each scheduled import: 90 days.
• Sign-in attempt records: 24 hours. Deletion is automatic.
• Error records: 60 days. Bugsink keeps a summary of each type of error, such as how often it occurs and when it first occurred, until it is deleted.
• Contact form messages: 12 months after you send the message.
• Database backups: 14 days.

The server, the database and the person who operates waffl.club are all in Canada. Your data is held there from the time that you create it.

waffl.club does not operate from the European Union. Your data is not exported out of Europe, because it is collected in Canada. waffl.club applies the standards and the rights in this policy to all users, in all countries.

Data held in Canada is subject to Canadian law. This includes the access that Canadian authorities have under that law.

Cloudflare is a company in the United States, so the avatar images are processed there. A contract permits Cloudflare to process the data only as instructed. Where European law applies to such a transfer, the Standard Contractual Clauses of the European Commission and the EU-US Data Privacy Framework cover it.

If you connect Steam, waffl.club sends a request to Valve, also in the United States. This occurs when you start an import, and once a night if you have scheduled imports turned on.

If you connect Twitch, waffl.club sends requests to Twitch, also in the United States.

waffl.club sets only the cookies that are necessary to sign you in: the session cookie, a token that protects the login form against forged requests, and a short-term cookie that records where to send you after sign-in. A website with accounts needs these cookies, so there is no cookie banner and there are no optional cookies.

waffl.club sets no advertising cookies, no analytics cookies and no third-party cookies.

waffl.club is not for children. To create an account you must be 16 years old or more. The terms give the same limit.

If you think that an account belongs to a younger person, send a message to info@norrwyn.com. That account will be removed.

This policy changes when the app changes or when the law changes. The date at the top of the page gives the last change.

Send questions, corrections and requests to info@norrwyn.com.