Privacy Policy

1. Introduction

IsItP2W.com ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

2. Information We Collect

2.1 Account Information

When you create an account, we collect:

• Email address
• Display name (optional)
• Password (securely hashed)

2.2 User-Generated Content

When you submit reviews, we collect:

• Review content (title, text, ratings)
• P2W scores and assessments
• Hours played (self-reported or verified via Steam)
• Money spent information (optional)

2.3 Steam Data

If you choose to link your Steam account, we access the following data through the Steam Web API:

• Steam ID - Your unique Steam identifier
• Display Name - Your Steam profile name
• Avatar - Your Steam profile picture
• Game Playtime - Hours played for games you review (only when you submit a review)

Important: We only access your Steam data when you explicitly request it by linking your account or submitting a review. Your Steam profile must be set to public for playtime verification to work. We do not access your Steam password, friends list, purchase history, or any other private information.

2.4 Automatically Collected Information

We may automatically collect:

• IP address (hashed for rate limiting - see section 2.5)
• Browser type and version
• Device information
• Pages visited and time spent

2.5 Analytics Data

We use Umami, a privacy-focused analytics service, to understand how visitors use our website. Umami is designed to be privacy-friendly and compliant with GDPR, CCPA, and other privacy regulations.

What Umami collects:

• Page views and visit duration
• Referrer information (how you found us)
• Browser and device type
• Country/region (derived from IP, but IP is not stored)

What Umami does NOT collect:

• No cookies are used
• No personal information is collected
• No cross-site tracking
• IP addresses are not stored

Because Umami does not use cookies or collect personal data, no consent banner is required for analytics under GDPR and similar regulations.

2.6 Rate Limiting Data

To protect our services from abuse, we implement rate limiting on certain API endpoints. This involves:

• Hashed IP addresses - Your IP address is converted to a one-way cryptographic hash (SHA-256) before storage. This means we cannot reverse the hash to obtain your original IP address.
• Request counts - The number of requests made within a time window
• Timestamps - When requests were made

This data is automatically deleted after one hour and is used solely to prevent abuse such as spam, scraping, or denial-of-service attacks. The hashing ensures your actual IP address is never stored in our database.

3. How We Use Your Information

We use the collected information to:

• Provide and maintain our services
• Display verified playtime on your reviews
• Moderate content and prevent abuse
• Protect against spam, scraping, and denial-of-service attacks
• Improve our website and user experience
• Communicate with you about your account
• Comply with legal obligations

4. Data Storage and Security

Your data is stored on secure servers located in North America. We implement industry-standard security measures to protect your information, including:

• Encrypted connections (HTTPS)
• Secure password hashing
• Regular security audits
• Limited access to personal data

5. Third-Party Services

5.1 Steam Web API

We use the Steam Web API to verify your gaming playtime. By linking your Steam account, you agree to Valve's Privacy Policy and the Steam Web API Terms of Use.

Steam data is provided "as is" by Valve Corporation. We make no guarantees about the accuracy or availability of Steam data.

5.2 Authentication Providers

If you sign in using Google or other OAuth providers, we receive basic profile information as permitted by those services.

5.3 Umami Analytics

We use Umami for website analytics. Umami is a privacy-focused analytics service that:

• Does not use cookies
• Does not collect personal information
• Does not track users across websites
• Does not store IP addresses

Umami only collects anonymous, aggregated data such as page views, referral sources, browser type, and country (derived from IP but not stored). This data helps us understand how visitors use our website without compromising your privacy.

6. Data Sharing

We do not sell your personal information. We may share data:

• With your consent
• To comply with legal obligations
• To protect our rights and safety
• With service providers who assist our operations (under strict confidentiality)

7. Your Rights

You have the right to:

• Access - Request a copy of your personal data
• Correction - Update or correct your information
• Deletion - Request deletion of your account and data
• Unlink Steam - Disconnect your Steam account at any time
• Withdraw Consent - Opt out of optional data collection

To exercise these rights, visit your profile settings or use our contact form.

8. Cookies

We use essential cookies to maintain your session and preferences. We may also use analytics cookies to understand how visitors use our site. You can control cookies through your browser settings.

9. Children's Privacy

Our services are not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe we have collected such information, please contact us immediately.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page and updating the "Last updated" date.

11. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us through our contact form and select "Legal" as the message type.

12. Steam Data Disclaimer

Steam® and the Steam logo are trademarks of Valve Corporation. IsItP2W is not affiliated with Valve Corporation. Steam data accessed through the Steam Web API is provided "as is" without warranty of any kind. Playtime data may not reflect offline play or may be delayed.