Last updated: 2026-09-15. This notice describes data processing under Art. 13 GDPR.
Controller
Mira
TODO: set STEAM_ROULETTE_OPERATOR_ADDRESS
TODO: set STEAM_ROULETTE_OPERATOR_EMAIL
What we store
| Table | Fields | Whose data |
|---|---|---|
| Users | SteamID64, display name, avatar URL, account creation time | the signed-in person |
| Groups | group name, owner SteamID64, timestamps | the signed-in person (as owner) |
| Players | SteamID64, name, avatar, library status, last synced, per group | everyone added to a group, not just the signed-in person |
| Owned games | SteamID64 + AppID + playtime, global, no per-row expiry | anyone whose public library was synced |
| Jobs | group reference, filter/budget parameters | indirectly, via the group |
| Session cookie | signed, contains SteamID64 + CSRF token, browser-session only (no persistence past closing the browser) | the signed-in person |
| Guest cookie | signed, contains a random guest identifier (not a real SteamID), valid up to 365 days | guest users only |
Game metadata and prices (names, categories, prices) are not personal data - they describe games, not people.
Purpose and legal basis
We process this data to run the core feature of this tool: intersecting the public game libraries of a group you assemble, so a game can be picked for you to play together. Signing in via Steam is based on your consent / to perform the service you requested (Art. 6(1)(a)/(b) GDPR). Displaying data of group members you add (name, avatar, library status) rests on a legitimate interest (Art. 6(1)(f) GDPR): we only ever read data that Steam already exposes publicly according to that person's own privacy settings, and only for the stated purpose.
Source of data
All game-related data comes from Valve's Steam Web API. We do not buy, sell, or share data with any other third party.
Retention
Game metadata is cached for up to 30 days, prices for up to 18 hours. Owned-games data has no fixed expiry, but is automatically deleted once the SteamID it belongs to is no longer a member of any group and is not itself a registered account here. Group/account data is kept until you delete it yourself (see below).
Cookies
We use one strictly necessary session cookie to keep you signed in, and (guest mode only) one strictly necessary persistent cookie to remember your anonymous guest group across visits. Both are required for the site to function and fall under the "strictly necessary" exemption of the ePrivacy Directive - no consent banner is shown, and no tracking/advertising cookies are used.
Your rights
You have the right to access, rectify, or erase your data, and to object to its processing. If you signed in, you can delete your own account, group, and cached data yourself at any time on the account deletion page - this does not remove entries about you held in someone else's group, since those are managed by that group's owner. You may also contact us directly at TODO: set STEAM_ROULETTE_OPERATOR_EMAIL, and you have the right to lodge a complaint with a data protection supervisory authority.
Fonts
The heading font (Cinzel) is hosted on our own server, not loaded from Google Fonts - your browser does not contact any third party for it.