Privacy Policy

This policy explains what LootPick collects, why, who else sees it, and how to get rid of it. It covers the LootPick mobile app and the LootPick web app, both operated by OAK TEK - FZCO ("we", "us", "our").

Age requirement

LootPick is for people aged 13 and over. We do not knowingly collect personal information from anyone under 13. If you are a parent or guardian and you believe your child under 13 has an account, email us and we will delete it and the data behind it.

What we collect

Using LootPick as a guest

You can use LootPick without signing up. In guest mode nothing is sent to our database, your lists stay on your device, and we hold no account for you. Clearing app data or changing device loses them. This section describes what happens once you create an account.

Your account

Accounts are handled by Clerk, our authentication provider. When you sign up we receive your email address, and if you sign in with Google, the name and profile picture attached to that Google account. Clerk holds your password. We never see it.

What you create in the app

Stored in our database at Supabase, tied to your account:

• Games on your wishlist and in your backlog, and the status you give them
• Price and score alerts you set, and their targets
• Purchases you log, including price, store and platform
• Your profile: display name, bio, gaming handles you choose to add, and your currency preference
• Your subscription tier and app settings

Steam sync, if you use it

Connecting Steam is optional. If you connect it, we store your Steam ID and the handle you entered, and read your public profile, owned games and wishlist so we can match them into your lists. We do not post anything, change anything, or read your friends list, private profile or chat. Disconnect at any time in your profile.

Subscriptions and purchases

Payments run through Google Play. We never receive, see or store your card number or billing address. RevenueCat, our subscription provider, tells us which plan you are on and whether it is active, so the app knows what to unlock. It holds an anonymous purchase identifier linked to your account.

Advertising

Free accounts see ads served by Google AdMob. To do that, Google collects your device advertising identifier, your approximate location derived from your IP address, and information about your device.

Ads are the one part of LootPick where a third party uses data for its own purposes rather than simply working on our behalf. We think you should know that plainly.

• In the EEA, the UK and Switzerland we show a consent prompt before any personalised advertising. Choose non-personalised and Google receives far less.
• Anywhere else, you can reset or delete your advertising ID in your device settings at any time.
• Ad-Free and Premium subscribers see no ads, and the advertising SDK does not run for them at all.

Notifications

If you allow push notifications, OneSignal stores a push token for your device so we can tell you when a price drops or a free game appears. Turn notifications off in your device settings and the token stops being used.

Analytics

We use PostHog to see which parts of the app people actually use and where they get stuck. It records a defined set of events, such as opening the app, adding a game, setting an alert or opening a store link, along with device type, operating system version and app version, and a random identifier for your installation.

You can turn this off. Profile, then Preferences, then Share usage data. Analytics never includes your name, email or the contents of your lists.

Email

Brevo sends our email: account emails, subscription receipts and, if you asked for it, launch and product news. Marketing email always carries an unsubscribe link, and unsubscribing does not affect account email you need to receive.

Game data, which is not about you

Prices, review scores, artwork and release dates come from IGDB, CheapShark, IsThereAnyDeal, GamerPower and the Steam Web API. That flows towards you, not away from you. Nothing about your account is sent to them.

Store links may pass through a partner service before reaching the store, and can carry affiliate tracking that earns a commission for us or for that partner. Following one tells that partner and that store you clicked, as any link does. The price you pay is identical. We do not adjust scores or rankings based on commission, and the Buy Now Score is calculated the same way regardless of whether a link earns us anything.

Games metadata is powered by IGDB.com

Why we are allowed to hold it

Where the UK and EU GDPR applies, our legal bases are:

• Performing our contract with you, for your account, your tracked games, your alerts and your subscription. Without this data there is no product.
• Your consent, for personalised advertising, push notifications, marketing email and Steam sync. Withdraw any of them at any time, in the app or your device settings.
• Our legitimate interests, for analytics, security and fraud prevention, balanced against your privacy. This is why analytics stays coarse and event based rather than recording everything you tap.

If you are in the UAE, the Federal Personal Data Protection Law gives you equivalent rights, listed below.

Who else sees it

We do not sell your personal information, and we do not share it for cross context behavioural advertising beyond the AdMob activity described above. The companies listed here process data on our instructions as our service providers, apart from Google's advertising business, which acts for itself.

• Clerk, accounts and sign-in
• Supabase, database and storage
• RevenueCat, subscription status
• Google AdMob and Google Play, advertising and payments
• OneSignal, push notifications
• PostHog, product analytics
• Brevo, email

We will also disclose information if the law requires it, or to protect our rights, our users or the security of the service.

Where it goes

We operate from the United Arab Emirates and our providers process data on servers in the United States and the European Union. Where personal data leaves the UK or EEA, our providers rely on the European Commission's standard contractual clauses or an equivalent safeguard.

How long we keep it

• Account and app data: until you delete your account, then removed from live systems immediately and from encrypted backups within 30 days.
• Subscription records: retained after deletion where tax and accounting law requires it, without the rest of your profile attached.
• Analytics events: retained by PostHog for up to 12 months.
• Email records: until you unsubscribe or your account is deleted.

Deleting your account

If you cannot reach the app, email play@lootpick.quest from the address on the account and we will delete it within 30 days.

Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another service. You can also withdraw consent at any time and complain to your data protection authority.

If you are in California, you have the right to know, delete, correct and opt out of sale or sharing. We do not sell personal information. We will not treat you differently for exercising any of these rights.

Most of this is faster to do yourself. Ads, notifications, marketing email, Steam sync and account deletion are all switches inside the app. For anything else, email us and we will respond within 30 days.

Security

Traffic between the app and our services is encrypted in transit. Database access is restricted by row level security, so your rows are readable only by your account. No system is perfect, and we do not claim otherwise. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

Changes

When this policy changes we update the effective date at the top. If a change is significant, for example a new category of data or a new advertising practice, we will tell you in the app or by email before it takes effect, and update our Google Play data disclosures at the same time.

Contact

Privacy questions, data requests and deletion requests go to play@lootpick.quest. For anything unrelated to LootPick, email oaktechnologiesfze@gmail.com.