Privacy & cookies
What the service uses, what you can control and how to request help.
You can browse the public game catalogue without creating an account. Account, connected-library and community features process additional information only when you use those features.
Privacy review in progress. This overview explains the service's current data handling. The legal bases, processing locations, transfer safeguards and complete retention schedules are still being confirmed.
Who is responsible and how to contact us
The responsible operator is Kenta Mattsson, based in Sweden.
For privacy questions or a request about your personal data, contact https://lumirinav.se/kontakta-oss.
What information is used and why
- Browsing and security: requests include connection information such as your IP address, requested URL and browser headers. The web service uses this information to deliver pages, limit abusive requests and diagnose failures. Public game, price and player statistics come from provider observations, separate from a member's library.
- Your account: email address, password hash, display name, handle, account dates, verification state, roles and privacy preferences support sign-in and account management. Passwords are stored as hashes. Verification and reset links use expiring tokens; the database stores their hashes.
- Optional Steam connection: Steam sign-in provides a Steam identifier. Lumiri GameDB does not receive your Steam password. The identifier is encrypted at rest, with a keyed hash for matching. When you request synchronization, available owned games and playtime are imported for your member library.
- Library and community: selected games, personal ratings, watchlist entries and optional price targets, profile introduction, featured game, friendships and blocks support the features you choose. Friend requests and optional notification preferences belong to your account.
- Private Lab history: daily library snapshots and successful Steam synchronizations record library titles, cumulative playtime and personal ratings for period comparisons. Period history is available only to the account owner and can be included in the account export.
- Moderation: a profile report contains the reporter and reported account, category, optional comment and a snapshot of the reported profile text. Authorized moderators can review it and record a resolution.
- Awards: signed-in interest marks use your watchlist. Guest interest marks stay in the server-side session and are separate from votes. If guest Public Choice voting is available, an email is used to send a confirmation link; the raw email is not stored in the voting database. A keyed, edition-specific fingerprint helps prevent duplicate voting.
Legal basis
The operator's legal basis for each purpose, including optional features and security processing, is awaiting confirmation.
Control what other members can see
Your library is private by default. You can choose a private, approved-friends or public audience. Profile introductions and featured games follow that audience. Sharing playtime and personal ratings are separate choices and are off by default.
A pending friend request does not grant access. You can remove friendships, block members, turn off incoming friend requests and disable friend-request notification emails. Public profiles do not display account email addresses or private Steam connection identifiers.
Review these choices in Account settings and My library. Publishing information allows other people to read or copy it; changing the audience cannot remove copies they have already made.
Recipients and international transfers
Authorized service administrators access account and operational data to provide support, secure the service and investigate faults. Authorized moderators access profile reports. Other members receive only the profile and library information permitted by your audience settings.
The operator has identified Lumiri GameDB as the service provider and has not named separate hosting, mail or backup providers. This does not establish the infrastructure's physical locations.
Steam receives the requests needed for optional sign-in and synchronization. If Turnstile is enabled, Cloudflare receives the challenge and verification data. External image hosts receive image requests. When you follow a store, affiliate, donation or contact link, the destination operates its own service and privacy notice.
The locations where these providers process information and any applicable safeguards for transfers outside the EEA are awaiting confirmation.
Retention and deletion
Active account and library data remain until you remove the relevant information, disconnect the store or delete your account. Synchronization can replace imported library entries. Disconnecting Steam removes the stored connection, imported Steam library, associated personal ratings and personal Steam playtime data.
Account deletion removes active account data and related library, watchlist and community records. A separate deletion register retains keyed hashes of the email and handle, the account creation date and the deletion date so that restoring an older backup cannot silently recreate the account. The raw email and handle are not kept in that register.
Private Lab snapshots are retained for up to 400 days, with scheduled daily cleanup. Disconnecting Steam removes Steam data from those snapshots; account deletion removes all of the account’s Lab history and price targets.
Resolved or dismissed profile reports are scheduled for deletion after 180 days. Related moderation and blocking audit events are scheduled for deletion after 365 days. Open reports remain until they are resolved. General security and administrative audit records have a separate retention policy.
Unconfirmed guest vote requests expire after 30 minutes and are scheduled for deletion once they have been expired for 48 hours. Guest confirmation requests are removed after the 90-day result-review window. Published Awards results remain available, with pseudonymous ballot identifiers retained in the append-only voting record so that the result can be checked.
Account and library downloads are streamed directly to you; the application does not save a temporary export file. Deleting active data does not instantly remove copies from existing backups. The operator must apply recorded account deletions before a restored backup is opened to members.
The active retention periods for server-side sessions, infrastructure logs, general audit records, the deletion register and backups are awaiting operator confirmation. A backup target or software default is not a verified live retention period.
Your choices and data rights
While signed in, you can download your account data as JSON, export your library as CSV, correct profile details, disconnect Steam and delete your account. Exports cover the available self-service account and library information; you can contact the operator to request additional personal data.
Where GDPR applies, you can request access, correction, deletion, restriction or portability of your personal data, object to processing where applicable, and withdraw consent for processing based on consent. Rights have legal conditions and exceptions. Withdrawing consent does not change the lawfulness of earlier processing.
You can also complain to your competent data protection authority. In Sweden this is Integritetsskyddsmyndigheten (IMY). Please send requests to the privacy contact above; self-service exports do not limit your legal rights.