Privacy Policy

This policy explains what data GamesHub24 collects, why we collect it, and what you can do about it. GamesHub24 is operated by JustSimplySoftware S.R.L., the data controller for the information described here. We collect as little as possible, we do not sell personal data, and we use it only to provide and improve the site.

Last updated: 15 October 2026.

1. What we collect

• Account data. Email address (required, used for sign-in and one-time verification codes), username, first name and last name, and optionally a mobile number. Your password is stored only as a salted hash.
• Authentication data. An access token, a single-use refresh token and an account role, kept so you stay signed in. Sessions expire automatically and refresh tokens are replaced on every renewal.
• Game activity data. Which games you played, when, and for how long; your favourites; the one-to-five star rating you give a game; and bug reports or suggestions you send for a game. Favourites, history and your individual rating stay private to your account — only aggregate counts and average ratings are public.
• Messages you send us. If you use the contact form or report a game, we receive the details you enter: name, email address, optional company and topic, and your message. Messages are limited in length and HTML is not accepted.
• Server logs. Like any web server, our hosting records technical entries such as IP address, timestamp, requested page and browser type, used for security and troubleshooting.

2. What we do not collect

We run no advertising, no third-party analytics, no cross-site tracking and no profiling cookies. We do not sell or rent personal data, and we do not use third-party sign-in providers. Games are served from our own domain, so playing a game does not expose you to another company's trackers.

3. Cookies and browser storage

• One essential cookie, named auth. It keeps you signed in. It is HttpOnly (not readable by scripts), Secure on HTTPS connections, SameSite=Lax, and holds an encrypted session payload containing your user ID, email address, username, role and tokens. It is deleted when you sign out or when it expires.
• Session storage. Sign-in and registration form fields are held temporarily in your browser's session storage so the page can be restored while you confirm a verification code. They are cleared when you leave the flow.
• We set no advertising or analytics cookies, so there is nothing to consent to beyond this single sign-in cookie.

4. Why we use your data, and on what legal basis

• Create and secure your account, keep you signed in, and protect the site from abuse — performance of a contract (GDPR Art. 6(1)(b)) and our legitimate interest in securing the service (Art. 6(1)(f)).
• Send verification codes and reply to your contact or report messages — performance of a contract and our legitimate interest in answering you (Art. 6(1)(b) and 6(1)(f)). Verification emails are sent from a no-reply address.
• Record play counts, play time, favourites, ratings and aggregate catalog statistics — legitimate interest in operating and improving the game catalogue (Art. 6(1)(f)).
• Keep server logs and investigate abuse or security incidents — legitimate interest in the security of the service (Art. 6(1)(f)) and our legal obligations (Art. 6(1)(c)).

5. Who we share it with

We share personal data only with the service providers we need to run the site: our hosting provider, our email delivery provider (for verification codes and messages you send us), and our DNS and infrastructure suppliers. Each provider processes data on our instructions and only for the purpose we specify. We may also disclose data if we are legally required to, or to protect the rights and safety of the site, its users and the public. We do not sell or share personal data for advertising.

6. How long we keep it

• Account data is kept for as long as your account is active.
• Authentication tokens expire automatically; refresh tokens are single-use.
• Messages you send us are kept while we deal with your request and for a reasonable period afterwards, and may be retained longer where the law requires it.
• Server logs are rotated on a short, fixed schedule.
• Aggregate play counts and average ratings may be kept in anonymised form after you delete your account, because they no longer identify you.

7. How we protect it

Passwords are salted and hashed and are never stored in readable form. Sessions are protected by an encrypted, HttpOnly, Secure, SameSite cookie and short-lived, rotated tokens, and the site is served over HTTPS. Access is limited to the people who administer the service. No system is perfectly secure, so please use a unique password and tell us at contact if you believe your account has been compromised.

8. International transfers

Our providers may process data outside the European Economic Area. Where they do, we rely on the European Commission's standard contractual clauses or an applicable adequacy decision to keep your protections intact.

9. Your rights

If you are in the EEA, the UK or Switzerland, you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased ("right to be forgotten") where there is no overriding reason to keep it;
• restrict or object to processing based on legitimate interest, and object to direct marketing;
• receive your data in a portable, machine-readable format;
• withdraw consent at any time, without affecting processing already carried out;

Send requests to JustSimplySoftware S.R.L. through the contact form, describing the account and the right you want to exercise. We respond within one month and may ask for proof that you own the account. We do not charge for this, and we will not treat you differently for exercising your rights.

10. Children

The site is intended for people aged 18 and over. If you are younger, a parent or legal guardian must hold the account and supervise your use. We do not knowingly collect personal data from children under 18; if you believe a child has created an account, contact us and we will delete it.

11. Changes and contact

We may update this policy when the site or the law changes; the "last updated" date above shows the current version. Questions about privacy go to JustSimplySoftware S.R.L. via the contact form. The rules you accept when using the site are set out in the terms and conditions.