Privacy Policy

1. Who we are

LootPick ("LootPick", "we", "us", "our") is operated by OAK TEK - FZCO, a company registered in the United Arab Emirates with its registered office at IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates ("OAK TEK").

For data protection law, OAK TEK is the controller of the personal data described in this policy, except where this policy says a third party decides for itself how to use data (see Section 8, Advertising).

Data protection contact: play@lootpick.quest. Send privacy questions and requests there.

This policy covers the LootPick website and web app at lootpick.quest and app.lootpick.quest (the "Website") and the LootPick mobile app, on Android and on iPhone once it is released (the "App"). One account works on both. The technology behind each is different, so this policy keeps them apart:

Where LootPick is offered. LootPick is offered in the countries listed on its store pages and is not directed at the European Economic Area, the United Kingdom or Switzerland. If you use it from anywhere, including those places, the protections in this policy apply to your data.

2. The short version

• You can browse LootPick as a guest. Guest lists stay in your browser or on your device.
• If you create an account we hold your email address, your username and what you add to LootPick: Picks (Wishlist), Loot (games you own), alerts, ratings, reviews, settings and, if you choose, Steam data.
• Ratings and reviews are public. They appear with your username to anyone who opens the game page.
• We never see your card number. Payments are handled by Google Play and the App Store (mobile app) and by Stripe through RevenueCat (website).
• Free accounts see ads, except during the free Premium window (1 November to 31 December 2026), when nobody sees them. Google receives data for that purpose.
• We do not sell your personal data.
• We send occasional product news emails to account holders. Each one has an unsubscribe link, and you can turn them off in Notifications (app) or Settings (website). Alert and account emails are not affected.
• You can delete your account yourself, in the app or on the website.

3. What we collect, how, and why

For each category we say where it comes from, what we use it for, and the legal basis. Legal bases are the ones used in the UK and EU GDPR; equivalent grounds apply under the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021, "PDPL") and other laws.

3.1 Data you give us when you create and use an account

When you sign up we ask you to confirm you are 13 or older. We do not ask for your date of birth.

3.2 Steam connection (optional)

If you connect Steam, we store your Steam ID and the Steam name, profile link or ID you typed to find your account. Using the Steam Web API, from our servers, we then read:

• your owned games, with total hours played, hours played in the last two weeks, and the date you last played each game, which we import into your Loot and refresh when you sync again;
• your public Steam wishlist, if you import it, which we add to your Picks (Wishlist);
• for a game whose page you open, your achievements for that game (which are unlocked and when, plus global unlock rates). We store only the unlocked count and total against your copy of that game.

This works only for data your Steam privacy settings make public (profile, game details and Steam wishlist). We do not ask for your Steam password. We do not post, change or delete anything on your Steam account, and we do not read your friends list or chat. Steam does not tell us what you paid or when you bought a game, so imported games have no price until you add one. Legal basis: your consent, which you can withdraw by disconnecting in Settings. Disconnecting clears the stored Steam ID and name and stops new reads. Games already imported stay in your Loot and Picks (Wishlist) until you delete them.

3.3A Data collected automatically: Website only

The Website does not use PostHog, OneSignal or Sentry.

3.3B Data collected automatically: App only

Push notifications (App only). If you allow them, OneSignal stores a push token, the device name and the platform so a message can reach your phone, and we keep the token linked to your account. We use it to tell you when a price you watch drops or reaches your target, when a tracked game is released, and when a free game appears, following the notification settings you choose in the App. The Website does not itself send push notifications. Alerts set up on the Website can be delivered by email, or by push to your linked App device if you choose that in Settings. Turn notifications off in the App or your device settings and the token stops being used. Uninstalling the App does not delete the token, but deleting your account removes it from our database. OneSignal keeps its own copy under its own retention period. Legal basis: your consent, which you can withdraw at any time.

Crash and error reports (App only). We use Sentry to receive crash and error reports. We switch off Sentry's default collection of personal data and we do not attach your name, email address or account id to a report. This is not controlled by the analytics setting, because it is how we find out the App has broken. Sentry keeps reports under its own retention period.

Release reminders and your calendar (App only). If you turn on release date reminders and allow calendar access, the App adds an event to a calendar on your device for each game in your Picks (Wishlist) that has a future release date, and updates it if the date moves. We do not read the contents of your other calendar entries, and we do not send calendar data to our servers. If the calendar on your device is synced by your calendar provider, that provider handles the events under its own policy. You can turn reminders off in Notifications and remove the permission in your device settings.

3.4 Guest use

On the Website, guest Picks (Wishlist) are stored only in your browser (local storage key lootpick_guest_picks) and are not sent to our database. In the App, guest lists stay on your device. Nothing in guest mode creates an account for you. Clearing browser or app data removes them.

3.5 Product news and the launch waitlist

Launch waitlist (Website). If you joined the launch waitlist on lootpick.quest, your email address is held by Brevo, our email service provider, so we can tell you about the launch and send product news. Legal basis: your consent. You can unsubscribe at any time and you can ask us to delete your address.

Product news (accounts). We email account holders occasionally about LootPick, for example the free Premium period and subscription offers. These come from news@lootpick.quest. This uses your account email address, your username and, for some emails, whether your account is an OG Looter (Section 3.1). Legal basis: legitimate interests in telling our users about the service, or your consent where the law requires it. Every product email has an unsubscribe link, and you can turn them off at any time under Notifications in the app or Settings on the website. Turning them off does not stop alert emails you asked for, sign-in codes, receipts or the emails described in Section 7.

3.6 The OAK TEK company website (oaktek.org)

The OAK TEK website at oaktek.org is a static site hosted on Netlify. It has no accounts. Its contact form collects the name, email address and message you type, so we can reply to you. It uses Google Analytics to count visits, which loads only after you accept analytics in the cookie notice on that site, and it keeps a server log of requests (IP address, pages requested) with its host. That website has its own privacy notice at oaktek.org/legal/oaktek/privacy, which applies to it.

3.7 Data we do not collect

We do not collect your card number (Google Play, the App Store and Stripe do), your Steam password, your contacts, or precise location. We do not collect your date of birth. We do not knowingly collect data from children under 13.

4. Cookies and similar technologies

4A. Website: cookies and local storage

Names and lifetimes of third-party cookies are set by those providers and can change.

Consent. On the Website we ask every visitor, in every country, before we load Google Analytics or Google AdSense. Nothing from Google for analytics or advertising loads, and no analytics or advertising cookie is set, until you accept. You can choose Accept all, Reject all, or switch analytics and advertising on separately. Your choice is stored in your browser (key lp_consent), not on our servers. You can change or withdraw it at any time under Cookie settings in the footer. Withdrawing stops measurement immediately and removes the analytics cookies we can reach. Rejecting does not affect your access to LootPick, but free-plan ads only appear if you accept advertising cookies.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a rejection of advertising cookies, even if you accepted them earlier.

4B. App: device identifiers and SDK storage

The App does not use browser cookies. It stores sign-in tokens and settings on your device, and its third-party SDKs may use device identifiers: the advertising ID (AdMob, free tier; you can reset or delete it in your device settings), a push token (OneSignal, if you allow notifications) and a random installation identifier (PostHog).

5. Who we share data with

We do not sell your personal data. We share it only as follows.

Service providers (processors), acting on our instructions.

5A. Used by both the Website and the App

5B. Website only

5C. App only

Independent third parties:

• Google (AdSense, AdMob, Analytics, YouTube) uses data for its own purposes as described in its own policies. Our ability to control that use is limited. You can read how Google uses data from sites and apps that use its services at policies.google.com/technologies/partner-sites, and manage or opt out of personalised ads at adssettings.google.com and optout.aboutads.info.
• Stripe decides for itself how to use payment data for fraud prevention and legal compliance (see 5B).
• Affiliate and store partners. Store links may pass through a partner before reaching the store and may carry affiliate tracking. Following one tells the partner and the store that you clicked. The price you pay is unaffected and does not change how we rank anything.
• Public display. Ratings and reviews are visible to others (Section 7).

Other disclosures. We may disclose information to comply with law or a valid legal request, to enforce our terms, to protect the rights, safety or security of users or the public, and in connection with a merger, financing or sale of the business (in which case we will require the recipient to honour this policy).

6. Game data that is not about you

Game titles, artwork, prices, release dates, scores and news come from IGDB, CheapShark, IsThereAnyDeal, OpenCritic, GamerPower, FreeToGame, Steam and public news feeds, requested by our servers or your browser without sending your account data. Game images are loaded from the providers' image servers (such as IGDB and Steam), which can see your IP address when your browser loads them. Games metadata is powered by IGDB.com.

We also keep a price history: once a day we store the lowest price we saw for each game, with the store and discount. It is about games, not about you, and it is not tied to any account.

7. Public information: ratings, reviews and community counts

When you rate a game or write a review, your username, your score, your review text, the date, and whether it is marked as containing spoilers are visible to people who open that game page. The Website shows usernames to signed-in visitors only, but the review data behind a game page can be requested by anyone, so treat your username as public. We do not show your email address, account identifier, or the contents of your Loot. Game pages also show anonymous totals: how many users have the game in Picks (Wishlist) or Loot and the average rating.

Reviews are limited to 400 characters and are checked automatically for profanity before they post. A rating and review are removed when you set a game back to "Not played", remove your last copy from your Loot, or delete your account. Do not include personal data about yourself or others in a review.

Reports and moderation. To report a review, use the Report link under it or email play@lootpick.quest. Each report reaches us with your username, the reason you chose and any note. When three different players report the same review it is hidden from everyone except its author while we look at it, and we email the author. When we decide, we email the author our decision and the reason, and we email each player who reported it the outcome. We do not tell the author who reported them. These emails go through Brevo (Section 5).

Blocking. If you block a player, their reviews are hidden from you. They are not told. You can undo it on the website in Settings, under Blocked users, or by emailing us.

8. Advertising

Free accounts may see ads. To serve and measure ads Google may collect device identifiers, cookies, approximate location from your IP address and device information. This is the one area where a third party uses your data for its own purposes.

8A. Website. Website ads are not running yet. Once we switch them on, ads will be served by Google AdSense on public pages only (not on sign-in, Picks (Wishlist), Loot, Settings, Profile or Premium pages). Nothing for advertising loads until you accept advertising cookies (Section 4A). Ad-Free and Premium subscribers see no ads and the AdSense script does not load for them.

8B. App. Ads are served by Google AdMob, to Free accounts only. Where the law requires it, for example in the EEA, the UK and Switzerland, personalised advertising depends on your consent through Google's consent prompt in the App. On iPhone and iPad we also ask for your permission through Apple's tracking prompt before the advertising identifier is used for ads. You can reset or delete your advertising ID in your device settings. Ad-Free and Premium subscribers see no ads, and the advertising SDK does not start for them when the App opens. The same applies to every account during the free Premium window (1 November to 31 December 2026): no ads, no consent form and no tracking prompt appear while it lasts. If you upgrade while the App is open, ads stop at once and the SDK does not start again the next time you open it.

9. International transfers

We operate from the United Arab Emirates. Our database (Supabase) is hosted in Singapore. Our other providers process data in the United States, the European Union and other countries. Where the law of your country restricts sending personal data abroad, we rely on the safeguards that law allows, such as the European Commission's Standard Contractual Clauses (and the UK Addendum) entered into by our providers, your consent where the law allows it, or another lawful transfer mechanism. Contact us for a copy of the safeguards where the law entitles you to one.

10. How long we keep data

11. Deleting your account

• Website: Settings, then Danger zone, then Delete account. You type DELETE and confirm with a one-time code sent to your email.
• Mobile app: Profile, then Delete Account. You type DELETE and confirm with a code sent to your email.
• By email: write to play@lootpick.quest from the address on the account. We respond within 30 days.

Deletion removes your Picks (Wishlist), Loot (including hours and achievement counts), alerts, ratings and reviews, reports you sent, blocks, email log, profile, Steam link and sign-in from our own application database and from Clerk. It cannot be undone. If Clerk deletes a user by any other route, an automated process removes the same data from our database. It does not automatically delete records held by third parties: your customer and transaction records at RevenueCat and Stripe (kept for tax, accounting and fraud purposes), your contact and email event log at Brevo, provider server logs, and backups, which clear on their own schedule. Those follow the providers' own retention periods. Email us if you want a provider asked to delete its copy sooner.

Subscriptions. If you have a website subscription, deleting your account cancels it and it remains active until the end of the paid period. A subscription bought through the App Store or Google Play cannot be cancelled by us. Cancel it in that store or it will keep billing after your account is gone.

12. Your rights

Depending on where you live, you may have the right to: access your data; correct it; delete it; restrict or object to processing; receive it in a portable format; withdraw consent at any time (without affecting earlier processing), including opting out of product news with the unsubscribe link in the email or the switch in Notifications or Settings; and not be subject to solely automated decisions with legal or similarly significant effects. LootPick's Buy Now Score is informational and has no such effect.

How to use them. Much of this you can do yourself in Settings or the App. For anything else email play@lootpick.quest. We may need to verify your identity. We respond within 30 days, or the shorter period the law requires. If we refuse a request, tell us and we will explain why and what you can do next.

Complaints. You may complain to your local data protection regulator. In the UAE that is the UAE Data Office under the PDPL. Many other countries we serve, including Canada, Australia, New Zealand, Japan, Singapore, Malaysia, the Philippines, Brazil, Türkiye, Saudi Arabia, Qatar, Bahrain, Oman, Kuwait, Egypt and Morocco, have their own privacy laws and regulators, and we honour the rights those laws give you in the same way.

California. You have the right to know, delete, correct, and to opt out of the sale or sharing of personal information. We do not sell personal information. Advertising cookies and identifiers may count as "sharing" for cross-context behavioural advertising. On the Website they are off unless you accept them, you can withdraw under Cookie settings in the footer, and we honour the Global Privacy Control signal (Section 4A). In the App you can reset your advertising ID in your device settings. We do not discriminate against you for exercising your rights.

13. Children

LootPick is for people aged 13 and over. We do not knowingly collect personal data from anyone under 13 (or the higher minimum age in your country). We ask for a confirmation that you are 13 or older when you sign up, and we do not collect your date of birth. If you believe a child has an account, email us and we will delete it and the data behind it.

14. Security

We use encryption in transit, row-level security in our database so that account rows are readable only by their owner, secret keys kept server-side, and re-verification (an emailed code) for irreversible actions such as deleting an account. Unsubscribe links in our emails are signed, so a link works only for the account it was sent to. No system is perfectly secure. If a breach affects your personal data we will notify you and the relevant authority as the law requires.

15. Automated processing

The Buy Now Score is calculated automatically from price, discount, ratings and your own list. It is informational only, does not produce legal effects, and you can ignore it.

16. Changes to this policy

We will update the effective date when this policy changes. For significant changes, such as a new category of data, a new purpose, or a new advertising practice, we will tell you in the app or by email before the change takes effect.

17. Contact

OAK TEK - FZCO, trade licence no. 90142, issued by the Dubai Integrated Economic Zones Authority. Registered office: IFZA Business Park, Dubai Digital Park, Dubai Silicon Oasis, Dubai, United Arab Emirates

Privacy and general enquiries: play@lootpick.quest