Who is responsible

The site is run by Pshi Tech. Privacy requests: [email protected].

What is collected

Account: sign-in is only with Google, and there are no passwords. The email, name and profile picture from your Google account, and your Google account id, are stored. For security, a record of sign-ins (time, IP address and browser or device type) is also kept.

Your lists: saved games, target prices, games you asked to be alerted about when on sale, and list names.

Alerts (only if you turn them on): on the site, the push subscription address your browser creates and its encryption keys; in the app, the push token your phone gets from the Expo service. Also your interface language, the alert types and stores you chose, and a record of alerts already sent so none is sent twice. The address and the token contain no phone number or other device information.

Description translation: when a signed-in user asks for a new translation of a game description, the account id, the time of the request and the number of characters are stored, to limit how many translations are made.

Usage on the site and in the app: usage events go to PostHog, on servers in the European Union: which pages and screens were viewed, which game pages, search terms, use of filters, sorting and buttons such as save and go to store, and the site you came from (domain only). PostHog stores no cookies or other data in your browser or phone, records no screen and collects nothing you type into fields. If you are signed in, events are linked to your account id only, never to your email.

Error reports: when something breaks, a technical report of the error (the message, where in the code, the browser or device type and the page) goes to Sentry so it can be fixed. It contains no email, cookies or sign-in tokens, and nothing is recorded from the screen.

If your browser sends Do Not Track or Global Privacy Control, PostHog does not load on the site and no usage event is sent.

Why

To provide the service and sync your lists across devices.

To send target-price and sale alerts, only after you allow them in your browser.

To improve the site and the app from usage data without identifying details, and to fix errors from the error reports.

Data is never sold, rented or shared for advertising.

Cookies and browser storage

The site sets no cookies. Supabase keeps you signed in using your browser storage, and in the app the sign-in is stored encrypted on your phone.

Preferences such as language, currency and payment methods stay in your browser storage.

There are no advertising cookies.

Who else is involved

Supabase (servers in the European Union, in Frankfurt) runs the sign-in and stores the database: your account, lists and alert settings.

Cloudflare serves the site and the public price data.

GitHub Actions runs the price updates and sends the alerts. For that it reads the lists, alert settings and push subscriptions, and records which alerts were sent.

PostHog (servers in the European Union) receives the usage events and Sentry receives the error reports. Both act only as service providers, and nothing is used for advertising.

Sign-in goes through Google. The site receives only your verified email address, name, profile picture and account id from Google, nothing else from your Google account.

Public game data, images and descriptions come from Nintendo, IGDB, RAWG and OpenCritic, with no data about you. Videos load from YouTube (privacy-enhanced mode) only when you press play.

Descriptions are translated into Hebrew by MyMemory. It receives only the game description text, with no data about you.

On the site, alerts are delivered through your browser push service: Google (Chrome, Android Edge), Apple (Safari and iPhone), Mozilla (Firefox) or Microsoft (Windows). The alert content is encrypted on the way and they only pass it to your device. In the app, alerts are delivered through the Expo push service, which passes them to Apple or Google and on to your phone.

Retention

Account data and lists are kept while the account exists. Deleting the account immediately deletes it and everything linked to it: lists, alert settings, devices, the record of sent alerts and the translation records.

A push subscription or push token is deleted when you turn alerts off on a device, when the push service reports it is no longer valid, or when you delete the account. The record of sent alerts is kept while the account exists. Translation request records are deleted after a week.

Usage events are kept in PostHog for up to a year and error reports in Sentry for up to 90 days, then deleted automatically.

Your rights

Access and export: on the site, "My account" > "Export my data".

Correct or delete: edit lists any time, or delete the account from "My account" on the site or in the app.

Stop alerts: "My account" > "Turn off on this device", or block notifications for the site or the app in your browser or phone settings.

Anything else: [email protected].

Security

Traffic is encrypted (HTTPS) everywhere. Sign-in is only through Google, so there are no passwords to store. The database uses row-level security (RLS), so each user can reach only their own data, and secret keys are kept only on the server side. No system is fully secure; if a breach affects you, you will be notified as the law requires.

Minors

Under 18s need a parent's consent before creating an account.

Changes

Last updated 2026-10-07.