Privacy Policy (GDPR Notice)

GameShelf, version 1.5.4 — last updated 29 June 2026

Who is responsible

GameShelf (“the app”) is a free hobby application provided by Klemen Lapanja (klemen.lapanja@proton.me), who is the data controller within the meaning of the EU General Data Protection Regulation (GDPR) for any processing described here.

The short version

The developer collects no personal data. The app has no user accounts, no analytics, no crash reporting, no advertising, and no tracking of any kind. Everything you enter — your games, consoles, prices paid, notes and settings — is stored only on your device.

Data stored on your device

• Your game collection and wishlist (titles, consoles, ratings, prices paid, purchase dates, notes) in a local database.
• App settings, including your own RAWG API key if you choose to enter one (a built-in key is used otherwise) and, if you add them, your IGDB (Twitch) Client ID and Client Secret with a short-lived access token, in local app storage.
• A cached copy of the Discover feed and of shop prices fetched for your wishlist.

This data never leaves your device unless you export it yourself (see Backups). Uninstalling the app or clearing its data deletes all of it permanently.

Data that leaves your device

Some features contact third-party services over the internet. Like any internet request, these services see your IP address and the request content:

• RAWG (api.rawg.io, USA) — when you search for games or use the Discover feed, your search text, platform filters and an API key (the built-in one, or your own if set) are sent to RAWG. See RAWG’s privacy policy at https://rawg.io/privacy_policy.
• IGDB / Twitch (api.igdb.com and id.twitch.tv, USA) — only if you enter IGDB credentials in Settings: when a game search finds nothing on RAWG, the search text and your credentials (to obtain an access token) are sent to these Twitch services. See Twitch’s privacy notice at https://www.twitch.tv/p/legal/privacy-notice/.
• Barcode lookup — when you scan a barcode, the barcode number is sent to identify the product. The app tries, in order: UPCitemdb (api.upcitemdb.com, USA), then Open Products Facts (world.openproductsfacts.org, France). If neither recognises the barcode, the number is run as an ordinary web search — through DuckDuckGo (duckduckgo.com), falling back to Microsoft Bing (bing.com, USA) — loaded in an embedded browser view so the app can read game titles from the result list; the search engine may set cookies within that view. Only the barcode number is sent; no camera image leaves your device. Each service’s own privacy policy applies to its processing.
• Online game shops (Slovenia and Germany) — when price tracking runs, the titles of your wishlist games are sent as search queries to several public game-shop websites in Slovenia and Germany. Each shop’s own privacy policy applies to its processing.

The developer does not operate any server and never receives any of this traffic.

Legal bases

• Lookups you trigger yourself (game search, barcode scan, Discover refresh): necessity for providing the service you request (Art. 6(1)(b) GDPR).
• The optional daily background price check: the developer’s and your legitimate interest in keeping wishlist prices current (Art. 6(1)(f) GDPR). It runs only if you enable it in Settings and you can disable it at any time.

Camera

The camera is used only for barcode scanning and reading game titles from box photos. All image processing happens on the device (Google ML Kit on-device models). Camera frames are never stored or transmitted.

Notifications

Price-drop notifications are generated locally on your device. No notification service of the developer is involved.

Backups

You can export your collection as a JSON file from Settings, saved to a location you choose.

You can also turn on scheduled backups in Settings. While enabled, the app periodically writes a JSON copy of your whole collection to a folder you pick, keeping only the most recent few files. If you choose a folder that syncs to a cloud service (for example Google Drive, Dropbox, or another documents provider), a copy of your data is written there and that provider’s own privacy policy and security then apply to it. The developer operates no server, never receives these files, and is not responsible for the destination you select. Scheduled backups run only while enabled, and you can turn them off and remove the chosen folder at any time.

Any file you export or that is backed up is entirely under your control; you are responsible for wherever you store or share it.

Retention

All data is kept until you delete it: remove individual entries in the app, clear the app’s data, or uninstall the app.

Your rights

You have the GDPR rights of access, rectification, erasure, restriction, portability and objection (Art. 15–21). Because all data is stored only on your device, you exercise them directly: view and edit anything in the app, export a copy (portability), or delete the app’s data (erasure). For questions, contact klemen.lapanja@proton.me. You also have the right to lodge a complaint with your supervisory authority (in Slovenia: Informacijski pooblaščenec, www.ip-rs.si).

Automated decisions and profiling

None.

Children

The app is not directed at children and processes no personal data of any user beyond what is described above.

Changes

If a future version of the app changes what data is processed, this policy will be updated and the new version shipped with the app.