Privacy Policy

1. Introduction

GameDex ("we", "us", "our") operates the website gamedex.ro and specs.retroplay.ro. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our services.

We are committed to protecting your privacy in accordance with the General Data Protection Regulation (GDPR) and Romanian data protection laws.

2. Data We Collect

2.1 Account Data

When you register an account, we collect:

Email address (required)
Display name (optional, set by you)
Password (stored securely hashed, never in plain text)
Registration IP address
Date of birth (if provided)

2.2 Social Login Data

If you register or log in via a social provider (Google, Facebook, Discord, etc.), we receive:

Your name and profile picture from the provider
Your email address (if shared by the provider)
A unique identifier from the provider

We do not access your social media posts, friend lists, or any data beyond what is needed for authentication.

2.3 Usage Data

We automatically collect:

Pages visited and actions taken (searches, comparisons, clicks on referral links)
Browser type, operating system, and device information
IP address and approximate location (country level)
Referral source (how you arrived at our site)

2.4 User-Generated Content

Comments, ratings, suggestions, and other content you voluntarily submit.

3. How We Use Your Data

Account management — to create and maintain your account, authenticate logins, and provide personalized features (wishlists, price alerts).
Price alerts — to notify you via email when a tracked product drops below your target price.
Communication — to send password resets, account notifications, and (with your consent) newsletter updates.
Analytics — to understand how the site is used and improve our services.
Security — to detect and prevent fraud, abuse, and unauthorized access.
Legal compliance — to comply with applicable laws and regulations.

4. Cookies & Tracking

We use cookies for:

Essential cookies — session management, authentication, CSRF protection. These are required for the site to function.
Preference cookies — to remember your language, currency, and display preferences.
Analytics cookies — to collect anonymous usage statistics (we do not use third-party trackers like Google Analytics).
Referral cookies — to track affiliate link clicks for commission attribution (typically 24–30 day duration, set by partner retailers).

You can control cookie preferences in your browser settings. Disabling essential cookies may prevent you from using certain features.

5. Data Sharing

We do not sell your personal data. We may share data with:

Hosting provider — our web hosting provider processes data as needed to serve the website.
Social login providers — only the authentication data exchanged during login (governed by their own privacy policies).
Legal requirements — if required by law, court order, or to protect our rights and safety.

We do not share your email, browsing history, or personal data with advertisers or partner retailers.

6. Data Security

We implement appropriate security measures:

Passwords are hashed using bcrypt (never stored in plain text).
API keys are stored as SHA-256 hashes.
HTTPS encryption for all data in transit.
CSRF protection on all forms.
Rate limiting on authentication and API endpoints.

7. Data Retention

Account data is retained as long as your account is active.
If you delete your account, personal data is removed within 30 days.
Anonymous usage statistics may be retained indefinitely.
Referral click logs are retained for up to 12 months.

8. Your Rights (GDPR)

As a user in the EU/EEA, you have the right to:

Access — request a copy of all personal data we hold about you.
Rectification — correct inaccurate or incomplete data.
Erasure — request deletion of your personal data ("right to be forgotten").
Portability — receive your data in a machine-readable format.
Restriction — limit processing of your data in certain circumstances.
Objection — object to data processing based on legitimate interest.
Withdraw consent — for processing based on consent (e.g., newsletter), at any time.

To exercise any of these rights, contact us at: privacy@gamedex.ro

9. Children's Privacy

GameDex is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child under 16 has created an account, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Significant changes will be communicated via email to registered users. The "Last updated" date at the top reflects the most recent revision.