Privacy Policy

Keyfinder collects only the data needed to operate the site, measure aggregate usage, and improve price comparison pages.

Data we process

We may process basic request data such as page URL, referrer, browser information, and click details for outbound merchant links. We do not sell personal information.

To count how many visits the site gets, where they come from and how often a game or code was viewed, each page reports its address to our server once it has loaded, and for the first page of a visit also the domain of the referring site or the source tag in the address (utm_source, for example chatgpt.com). We store the page address, the time and that source, plus the country, the browser language, the device type (phone, tablet or computer), the browser family and the operating system. For clicks on shop links we also store the country, browser language and device type. We work out the country from the IP address on our own server, without passing it to anyone (IP Geolocation by DB-IP). We store no IP address, full user agent, cookie or user ID for this, and nothing is saved on your device. We do not link these coarse details to a person or a specific device. We also check the browser's user agent to filter out bots, and keep the IP address only in memory, so the same page view counts once within 30 minutes and a game or code at most once a day per visitor; after that it is deleted. On games and codes we show how often they were viewed in total. The legal basis is our legitimate interest in measuring how the site is used (Art. 6(1)(f) GDPR).

Purchase notices

On the site we show real purchases made through our links: the product, the time, and the buyer's country if the partner shop reports it. We do not show or store names, cities or email addresses for this; as proof that the purchase is real, we keep only the partner's reference number. The legal basis is our legitimate interest in showing that people buy through Keyfinder (Art. 6(1)(f) GDPR). So the notices don't pile up, your browser remembers how many you have seen until you close the tab (session storage, not a cookie).

Hosting

The website and its database run on a server of Contabo GmbH. Requests reach it through a server of Hetzner Online GmbH, which handles encryption and forwards them. Both servers are in the EU. Server log files are kept only as long as operations and security require.

Price alerts by email

If you turn on price alerts in the member area and click the link in our confirmation email (double opt-in), we use your sign-in email address to tell you about price drops for games on your wishlist. We store the time of the request and of the confirmation. The legal basis is your consent (Art. 6(1)(a) GDPR). You can stop price alerts at any time in the member area or through the unsubscribe link in every email. We use the provider Resend as a processor to send these emails.

You can also set a price alert for a single game on its page without an account. We then store your email address, the game, the language, the time of the request and of the confirmation, and the price we last told you about. We only send emails after you click the link in the confirmation email (double opt-in), and at most one a day, when the price drops by 5% or more. The legal basis is your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time through the unsubscribe link in every email.

Partner programme

If you apply as a partner, we process your name, your email address, the link to your channel or site and your message to review the application and run the programme with you (Art. 6(1)(b) GDPR). The application also appears in a channel on our Discord server that only our team can see (Discord Inc., USA; data may also be processed in the USA). We delete the data once we no longer need it and no statutory retention periods apply.

Links from our partners contain the partner's code (utm_source, utm_medium). If you arrive through such a link, we store the code with the page view and with clicks on shop links, so we can pay the partner their share. While you stay on Keyfinder, your browser keeps the code in memory only; nothing is saved on your device, and we cannot link it to a person. The legal basis is our legitimate interest in paying partners correctly (Art. 6(1)(f) GDPR).

If you add payout details as a partner, we process your name or company, your address, your tax status, your VAT ID if you have one, and your IBAN or PayPal address, to pay you and to prove those payments (Art. 6(1)(b) and (c) GDPR). Only you and our team see these details; for a payment we pass what is needed to our bank or to PayPal. If you change your account, our team gets a message in a channel on our Discord server that names only your partner code, not the account. We keep the details while you take part in the programme and after that for as long as statutory retention periods apply.

Live chat

If you write to us in the chat window, we process your email address, your messages and images, the page you opened the chat on, the page you came from, your browser (user agent) and whether you are on the site right now. We use them to answer your question in the chat or, if you are no longer online, by email. The legal basis is our legitimate interest in answering requests (Art. 6(1)(f) GDPR).

The conversation is kept in a channel of our Discord server that only our team can see. The provider is Discord Inc., USA, so data may also be processed in the USA. So that the conversation is still there on your next visit, the chat window stores it and your email address in the local storage of your browser, only once you send a message. We use your IP address only briefly, in memory, to limit abuse. We delete a conversation when you ask us to, and otherwise once we no longer need it.

Cookies and local storage

If you create an account, we store your sign-in email and the games you save to your wishlist. Your wishlist is private to your account. You can remove saved games in the member area. Authentication cookies keep you signed in.

We use local storage to remember cookie consent. Privacy-friendly analytics load only after consent. We use Datafast to measure site visits and navigation.

Browser extension

The "Keyfinder.gg" browser extension for Chrome only runs on store.steampowered.com. When you open a game page, a wishlist, search, a sale page or the cart there, it sends the Steam app IDs of the games shown to keyfinder.gg to look up prices. For the summary on a wishlist it fetches the whole list straight from Steam, using the Steam ID of the list's owner shown on the page; that request only goes to Steam, and keyfinder.gg only receives the app IDs. The extension does not send page addresses, cookies or a user ID, and we do not link these lookups to a person; the request data they create is handled as for visits to the website. If you search in the extension's popup, the search term is sent to keyfinder.gg. Price alerts are stored only in your browser; once an hour the extension sends the app IDs of the watched games to keyfinder.gg and shows a browser notification when a target price is reached. When you click an offer, we count the click (shop, offer, time and the part of the extension it came from) as we do on the website, without a user ID. The extension keeps your settings in your browser, and in your Google account if Chrome sync is on; price alerts and recent searches stay on the device, and prices are kept only for the current browser session.

Contact

Privacy requests can be sent to daniel@wgmiconsulting.com.