Privacy Policy

MyGameDNA classifies games across skill dimensions and lets people contribute their own ratings and scores. This policy explains what personal data we collect, why we collect it, and the choices you have. It covers the MyGameDNA website and its questionnaire, catalogue, rankings, and profile features.

If you have a question or a request about your data, contact us at alerts@gamedna.my.

1. Information you provide

Account details

When you create an account we store your username, your email address, and a hashed password. We never store your password in plain text. You may optionally add a first name, a last name, and a short biography. If you fill in your top-games list, it is shown on your public profile alongside your username, biography, and the classifications you publish.

Activity

We store the answers you submit in the questionnaire and the resulting Challenge and Reward classification profiles. We store the game scores you submit. If you report another user, we store the report and the moderation records that arise from handling it.

2. Information we collect automatically

Server logs

Our infrastructure records standard request logs, which include your IP address, your browser’s user-agent string, and the time of the request. We use these logs to operate and secure the service.

Rate limiting

To stop automated abuse we keep counters keyed by hashed identifiers rather than raw values. The counters exist to throttle requests; they are not used to build a profile of you.

3. Cookies and browser storage

We use a small number of cookies and browser storage keys.

• sessionid cookie. An HttpOnly cookie that identifies your signed-in session. It is required to stay logged in.
• CSRF cookie. A cookie that protects forms against cross-site request forgery.
• sessionStorage auth-status cache.Remembers whether the interface should show a signed-in or signed-out navbar, so the header does not flicker while it re-checks. It is cleared when you close the tab.
• localStorage questionnaire drafts.Saves questionnaire answers you have not submitted yet so you can resume later. Drafts are automatically discarded 7 days after they are written.

4. Anti-abuse and security

We use Google reCAPTCHA v3 on signup, login, and administrative actions. When it runs, Google receives signals from your browser, such as your interaction patterns and device information, and handles them under Google’s own privacy terms.

Our content delivery network resolves the client IP address of each request and forwards it to our backend so that abuse prevention and rate limiting work correctly.

5. Service providers

We rely on a small set of processors to run the service. They handle data only on our instructions:

• Neon — managed PostgreSQL database, hosted on AWS in the ap-southeast-1 (Singapore) region.
• Render — hosting for the Django backend.
• Vercel — hosting for the frontend.
• Resend, with ZeptoMail as a failover— sending outgoing email such as verification and password-reset messages.
• Google — reCAPTCHA.
• Steam storefront API— fetching game metadata. This happens server-side; we do not send user data to Valve.

6. What we do not do

We do not sell your personal data. We do not use it for advertising or to build advertising audiences.

Analytics. If a Google Analytics measurement ID is configured, the production site loads Google Analytics (gtag), which sets its own cookies and collects usage measurements. When no measurement ID is configured, no analytics script is loaded and no analytics request is made.

7. Retention and deletion

We keep account and activity data for as long as your account exists. You can request deletion of your account; the request starts a workflow backed by a scheduled deletion job that removes your account and its associated personal data. Some records, such as moderation records and security logs, may be retained for a limited period where we need them to resolve disputes, enforce our terms, or meet legal obligations.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or object to our processing of your personal data. To make a request, contact us at alerts@gamedna.my. We will respond within the time required by applicable law.

MyGameDNA is operated from Malaysia, and the Malaysian Personal Data Protection Act 2010 (PDPA) applies. If you are in the EU or the UK, you also have rights in the style of the GDPR, including the right to lodge a complaint with your local supervisory authority.

9. Children

The service is not directed at children, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at alerts@gamedna.my and we will delete it.

10. International transfers

Our processors may store and process data outside Malaysia, including in Singapore and the United States. Where required, we rely on the providers’ safeguards for cross-border transfers.

11. Changes to this policy

If we make material changes we will update the “Last updated” date at the top of this page.

12. Contact

Questions about this policy or your data: alerts@gamedna.my.