Privacy Policy
Last updated: 2026-10-13
This Privacy Policy explains what GameHeatmap — Steam Discount Heatmap (https://en.gameheatmap.app) collects and how it is used. The service shows Steam price history and is operated by an individual. You can use it without signing up. Price alerts and “My Library” require signing in with your Steam account, which is optional.
Information we collect
Without signing in: our server automatically records standard request logs (IP address, browser type, referring page, timestamp) for security and debugging, and preference and analytics cookies are stored (see “Cookies and browser storage”). If you sign in with Steam: we receive your Steam account ID (steamid) and create a sign-in account. If you set a price alert we store your email address and your alert list, and when you open My Library we store a summary of your wishlist discounts. This data is stored in Google Firebase (Firestore database). The purpose, retention and deletion of each item are described below. We do not ask for your name, phone number or payment details.
Location
To show prices in a suitable currency, our hosting provider adds an approximate country code derived from your IP address to each request. We use it only to pick a currency for that page view and do not store it.
Steam sign-in (optional)
After you confirm your identity on Steam's sign-in page, we receive your Steam account ID (steamid64). A sign-in account is created with it in Google Firebase Authentication, recording your steamid and when the account was created and last signed in. We never receive your Steam password. Purpose: keeping you signed in and loading your own data (price alerts, My Library). Retention: until you ask us to delete it. Signing out ends your session, but the account record remains.
Price alert email
Current status: price alerts are paused — we do not collect new email addresses or send alert emails. Data already stored is kept only until you delete your account or ask us to delete it, and addresses not confirmed within 7 days are still deleted. The description below applies if the feature resumes. When you set a price alert, we store the email address you enter. It is used only to send target-price alert emails, which are sent through Resend and contain the game name, price and a link to the store deal or the game page. On the site, your saved email is shown only to you while signed in. Confirmation and unsubscribing: before any alert is sent we email a confirmation link to the address, and alerts go only to confirmed addresses. Every alert email has an unsubscribe link that works without signing in; unsubscribing deletes your email address (your alert list stays until you remove it). For this we also store the confirmation status, the language for your emails, when confirmation emails were sent, and random one-time link codes (stored only as hashes; confirmation codes expire after 24 hours). An address that is not confirmed within 7 days is deleted. To limit how many confirmation emails one address can receive, we keep a hash of the address with the send times for 1 day. Retention: until you unsubscribe or ask us to delete it. Your email stays stored even if you remove all alerts; setting an alert with a new email overwrites it.
Price alert list
Current status: price alerts are paused and new alerts cannot be set. Existing entries are kept until you remove them, delete your account or ask us to delete them. For each game you set an alert on, we store the game ID, game name, target price, currency, when the alert was set, and the price and time of the last alert sent. It is used for target-price alerts and to show your list in My Library. Up to 100 alerts per account. Retention: until you remove the alert. You can remove (delete) it yourself at any time from the price alert box on the game page or from My Library.
Wishlist summary
When you open My Library and your Steam wishlist loads successfully, we store a summary for the preview on the home page: the number of wishlist games, the number on sale, up to 3 games with the biggest discounts (name, discount, price, image), and when it was calculated. It is overwritten each time you open My Library. We do not store your full wishlist. Retention: until you ask us to delete it.
Steam data we use but do not store (My Library and friends)
When you are signed in, we request your owned games, playtime, recently played games and wishlist from the Steam Web API. This follows your Steam profile privacy settings. It is used only to build the page and is not stored in our database (except the wishlist summary above). To avoid repeated requests it is kept temporarily for about 4 minutes in server memory and about 3 minutes in your browser. The friends' deals feature requests your friends list, your friends' display names and their public wishlists, for up to 40 friends. This is also used only to build the response and is not stored. To look up prices we send game IDs to IsThereAnyDeal, without any information that identifies you.
Cookies and browser storage
First-party cookies: • locale — your chosen language, 1 year • country — your chosen currency/country, 1 year • gh_session — sign-in session (keeps you signed in across language subdomains), 14 days, only when signed in • steam_auth_state — one-time value that protects Steam sign-in against forgery, 5 minutes • steam_auth_next — the page to return to after signing in, 5 minutes • steam_auth_token — one-time token that completes sign-in, 60 seconds • gh_email_verify, gh_email_unsub — one-time code from a confirmation or unsubscribe email link, kept only until you press the button on that page, up to 1 hour The steam_auth_* cookies are created only while you sign in and are deleted or expire shortly after. Browser storage: when you sign in, Firebase stores your sign-in state (authentication tokens) in your browser's IndexedDB and removes it when you sign out. Third-party cookies: Google Analytics (_ga, _ga_<ID>; up to 2 years per Google) and, when advertising is enabled, Google AdSense and its partners (see “Advertising” and “Analytics”). You can clear cookies in your browser at any time. The site works without the preference cookies, but clearing the sign-in cookie signs you out.
Service providers and third parties
• Vercel — hosting. Processes request logs for every request (IP, browser information, path, time). • Google Firebase — stores the sign-in account and the data described above (email, alert list, wishlist summary). The Firestore data is stored in the Google Cloud Seoul region (asia-northeast3, South Korea). • Resend — sends price alert emails. Receives the recipient email address and the email content (game name, price, link). • Google Analytics — visit statistics (see “Analytics”). • Google AdSense — advertising (see “Advertising”). • Steam / Valve — sign-in (Steam OpenID); requests for your owned games, wishlist and friends list by your steamid; game details and images. Your browser loads some images directly from Steam's CDN, which then sees your IP. • IsThereAnyDeal — we request price data by game ID and country; no user data is sent. Some game images (cover art and banners) are loaded by your browser directly from IsThereAnyDeal's CDN, which then sees your IP. • flagcdn.com — serves flag icons and sees your IP. • GOG / Epic Games — some images on board posts (screenshots, cover art) are loaded by your browser directly from their CDNs, which then see your IP. Each provider has its own privacy policy.
Advertising
We may display ads via Google AdSense. Google and third-party vendors use cookies to serve ads based on your prior visits to this and other websites. You can opt out of personalized advertising at Google Ads Settings (adssettings.google.com) or aboutads.info. In the EEA, UK and Switzerland a consent prompt is shown before advertising cookies are used.
Analytics
We use Google Analytics for visit statistics. Using cookies, Google Analytics collects the pages you visit, device and browser information and a cookie identifier; this data is processed under Google's privacy policy. In the EEA, UK and Switzerland, Google Analytics does not store cookies until you consent in the consent prompt; until then only limited cookieless signals are sent to Google. You can also block collection with the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout). Additionally, we use Vercel Analytics for cookieless visit statistics. It records the page path, country, device and browser type and referring site without using cookies or storing anything in your browser, and does not track you across sites or identify you personally. Pages for site administrators are not counted. We also use Vercel Speed Insights to measure page-load performance (Core Web Vitals), also without cookies; it records only the page path, country, device and browser type, network connection type, and the measured loading values.
Data retention
• Request logs: kept by our hosting provider (Vercel) per their policy, then deleted • Sign-in account, email and wishlist summary: until you delete your account yourself on My page or ask us to delete them (there is no automatic deletion period) • Price alert list: until you remove it or delete your account • Temporary copies of My Library results (server and browser): about 3–4 minutes • Cookies: as listed under “Cookies and browser storage”
Your rights and deletion
You can delete your GameHeatmap account from My page after signing in with Steam again to confirm the session. This deletes the Firebase Authentication account, the account document and its subcollections, and email confirmation/unsubscribe tokens associated with that account. It does not delete your Steam/Valve account or content that is not tied to your account (such as news articles, free-game board posts and game price data). A hashed email send-limit record shared across accounts may remain for up to 24 hours. An email already handed to the delivery provider may still be sent. Any Firebase backups and Vercel hosting logs are retained under their providers' policies. You can also remove individual price alerts or unsubscribe from alert emails. Depending on where you live (e.g. GDPR in the EEA/UK, CCPA/CPRA in California) you may have the right to access, correct, delete or object to the processing of your personal data, and to complain to a supervisory authority. For ad-related data, use Google's controls linked above.
Affiliate links
Some links to game stores are affiliate links. If you buy through them we may receive a commission from the store; this does not change the price you pay. We do not receive any personal information about your purchase.
Children
This service is not directed at children under 16 and we do not knowingly collect their data.
Changes
We may update this policy; the “Last updated” date above will change. Continued use after an update means you accept the revised policy.
Contact
Questions about this policy or deletion requests: contact@gameheatmap.app.