Privacy Policy

This Privacy Policy explains how Gameful Inc. ("Gameful", "we", "us" or "our") collects, uses, shares and protects personal information when you use the Services (as defined in our Terms of Service), including the Gameful websites, Gameful accounts and the Gameful Discord bots, and the choices and rights you have.

Gameful Inc. is the controller of the personal information described in this policy. If you have any questions, contact us at privacy@gameful.com.

1. Information we collect #

1.1 Information you give us #

• Account information. Your email address, your password (which we store only in hashed form), your username and its history, the ways you sign in, such as passkeys and two-step verification, and your confirmation that you are at least 13 years old. If you choose to give it, your age range. We do not ask for your date of birth.
• Profile information. The optional details you add to your profile, such as an about line, pronouns, languages and pictures. Each account is also given a member ID.
• Trading and community content. Your listings, offers, trade outcomes, inventory and wishlist, saved searches, posts, replies, votes, reactions, ratings, value suggestions, giveaway entries and donations.
• Messages. The messages, reactions and images you send in direct messages, group chats and trade rooms, and when you have read a message.
• Friends and connections. Your friends, friend requests, the people you follow and block, and who invited you to Gameful.
• Games, progress and feedback. The games you play, your XP, level, streaks and achievements, your time zone, and the answers you give when we ask for feedback.
• Images and evidence. Images you upload, such as trade proof pictures, and the videos and other evidence you attach to reports and appeals.
• Communications. Emails and support requests you send us, your notification and email preferences and, if you turn on push notifications, the address your browser's push service gives us for them.

1.2 Information from services you link or sign in with #

• Google, Discord, Apple or Roblox sign-in. An identifier for your account with that provider and, depending on the provider, your email address, display name and profile picture.
• Roblox. When you link a Roblox account, we store its user ID, username, display name, creation date and avatar image. To protect users from fraud and to apply the right protections for your age, we also periodically read public and account-status information about the linked account and its inventory. If you list a Roblox Limited, we regularly check that your account still holds it, and we may check the traders' inventories to confirm a trade.
• Discord. When you link a Discord account or use a Gameful bot, we receive your Discord user ID and username and what you send to the bot. In Discord servers that use a Gameful bot, the bot may also process messages to apply that server's moderation settings, count messages per member per day where the server has turned this on, and keep support ticket transcripts. When you sign in with or link Discord, you give us permission to add you to Discord servers, which we may use to add you to Gameful's server and to the server of a game you join.

1.3 Information we collect automatically #

• Sign-in and security information. Your IP address and browser with each session, security events such as sign-ins and changes to your account, and information about your device and network, some of which we keep only in hashed form. We use it to keep accounts secure, ask for a code by email when a sign-in looks unusual, tell you when a new device signs in, prevent password guessing, detect fraud and identify accounts used to evade enforcement.
• Usage statistics. When you view a page on the Gameful websites, your browser sends us short records of the visit: the kind of page and the game or item it concerned (not the page address), how you arrived, your device type, browser language and country, performance and error details, the features you used and, when we test a change, which version you saw. We work out your country and network information from your IP address and then discard the address. Each record carries a visitor code that changes every day and a random reader identifier, kept in your browser's local storage for 397 days, so that we can count visitors and recognise returning readers. IP geolocation by DB-IP.
• Usage statistics linked to your account. While you are signed in, your browser sends us its reader identifier at most once a day, and we link it to your account for one purpose: when we test a change, to count how many of the accounts that saw each version went on, within seven days, to send an offer, have an offer accepted, post a listing, complete a trade or create an account. Only those totals leave the link. We do not use it to build a profile of you, choose your ads or contact you. We never link a reader identifier to an account that we believe belongs to a child under 13, or one identifier to two accounts. The link is deleted with your account, and otherwise after 400 days in which it was not renewed.
• Server logs. Our servers record each request, including your IP address, your browser and the full page address, and delete these records after 35 days. Our monitoring systems are configured to filter personal information out of technical logs.

If your browser sends a Global Privacy Control or Do Not Track signal, we do not collect usage statistics from it, do not give it a reader identifier (and remove one it already holds), never link it to an account, do not load Google Analytics and do not show it the Sign in with Google prompt.

2. How we use information #

We use personal information to:

1. provide the Services, including your account and profile, listings, offers, trade rooms, messages, notifications, your feed, XP, levels and achievements, giveaways, rewards and the Discord bots;
2. keep users safe and enforce our rules, including screening content, reviewing reports, preventing fraud and scams, protecting younger users and detecting accounts created to evade enforcement;
3. maintain trust between traders, including confirming trades, calculating ratings and standing, and awarding badges;
4. communicate with you, including service messages, security alerts, answers to your requests and, if you have opted in, news about Gameful;
5. understand and improve the Services, including measuring use and performance, testing changes, working out item values from value suggestions, votes and the trades and feedback you report, and fixing errors;
6. improve our safety systems, by training and evaluating the automated systems that screen content, using content those systems flagged and our moderators' decisions; and
7. comply with the law, respond to lawful requests, and establish, exercise or defend legal claims.

3. Legal bases (European Economic Area and United Kingdom) #

If you are in the European Economic Area or the United Kingdom, we rely on the following legal bases:

Where we rely on legitimate interests, we have balanced those interests against your rights, taking particular account of the interests of younger users.

4. Automated moderation #

We use automated systems, including rules and machine-learning models that we run on our own systems, to check messages, pictures and other content, usually before it is delivered or published, and to detect spam, scams, fraud and accounts used to evade enforcement. Photos are also checked against known child sexual abuse material. Content that appears to break our rules may be held for review or refused.

New accounts, and accounts that show signs of risk, have limits that are lifted over time, after a review or when you link a Roblox account. We calculate a trader's standing from the ratings they receive. Some actions, such as pausing an account that is sending spam, are taken automatically, and some protections against spam and scams work without notifying the account concerned. When an automated action restricts your account, we tell you, and you can appeal it to a member of our moderation team.

When enabled, we may send reported content to a moderation service provider, and the details of a trade dispute to an artificial intelligence service that drafts a summary for our moderators. Both receive the content with usernames replaced and no account details, and a trade dispute involving an account that we believe may belong to a user under 16 is never sent for a summary. Any action taken with their help can be appealed to a person.

5. How we share information #

We do not sell your personal information. We do not give advertisers your account, your name, your messages or your reader identifier.

5.1 With other users and the public #

Some information is visible to others by design, according to your privacy settings:

• your username, profile picture and profile details, your listings, community posts and other public content;
• your ratings and standing, your recent completed trades with the items and the other trader's username, when you were last active and how quickly you usually reply;
• your place on leaderboards and whether you have read someone's messages, unless you turn these off;
• your inventory, wishlist, online status, linked Roblox and Discord accounts and alternative accounts, to the extent your settings allow; and
• if our moderators confirm that an account has scammed other users, an entry on our public scam list.

Messages are visible to the people in the conversation, and trade proof pictures are visible only to the trader who added them and our moderators.

5.2 With game teams and moderators #

Each game on Gameful is supported by a team, which may include our partners and volunteer moderators. Team members can access the information they need for their role, such as the reports, moderation records and community content for that game. They must keep it confidential and use it only for that role.

5.3 With service providers and connected services #

Our service providers process personal information only on our instructions and under contract. Sign-in providers you choose and our advertising partners handle what they receive under their own privacy policies. You can ask for a current list of our service providers at privacy@gameful.com.

5.4 For legal reasons and safety #

We may disclose information if we believe in good faith that it is necessary to comply with the law or a legal process, to respond to lawful requests from public authorities, to protect the rights, property or safety of Gameful, our users or others, or to detect and prevent fraud or abuse. We report apparent child sexual exploitation to the National Center for Missing & Exploited Children.

5.5 Business transfers and consent #

If Gameful is involved in a merger, acquisition, financing or sale of assets, personal information may be transferred as part of that transaction, subject to this policy. We may also share information with your consent or at your direction.

6. Advertising and analytics #

6.1 Advertising #

Some Gameful pages show ads, and we may show sponsored placements that we sell directly. You can also choose to watch a video ad, for example to bump a listing or complete a rewards quest. If your browser blocks ads, we may ask you to allow them before you use some features, such as the trade calculator, and we keep a count of those uses in your browser's local storage.

Ads are served by Playwire, LLC through its RAMP platform, with advertising partners such as Google Ad Manager and other ad exchanges and bidders. Their script runs in your browser and may set and read cookies and receive your IP address, information about your device and browser, and the address of the page, which they use to choose, show and measure ads, limit how often you see the same ad and detect fraud. Playwire's child-directed setting is not used on Gameful, so Playwire and its partners may show you ads based on your interests, depending on where you live and the choices you make. Playwire's and Google's privacy policies apply to what they collect.

6.2 Google Analytics #

Some Gameful sites use Google Analytics 4, a service of Google LLC, to count page views and a few actions: getting a result from the trade calculator, creating an account, posting a listing and sending an offer. It sets the _ga cookie and a cookie whose name begins with _ga_, which hold a random identifier. We have turned off Google signals and ad personalisation signals, we do not send Google a user ID, and page addresses are sent without search terms or other query details, except campaign tags, and with usernames and conversation identifiers removed. Event-level data is kept for 2 months, the shortest period Google Analytics offers. Google says that Google Analytics 4 does not log or store IP addresses. Playwire's terms require that Playwire can view our Google Analytics reports.

6.3 Your choices about ads and analytics #

• If your browser sends a Global Privacy Control or Do Not Track signal, we do not load Google Analytics or give your browser a reader identifier. These signals do not turn off ads.
• You can block or delete cookies in your browser settings. This may change the ads you see, but it does not remove them.
• You can manage the ads Google shows you in Google's My Ad Center, use the opt-out tools of the Network Advertising Initiative and the Digital Advertising Alliance (YourAdChoices), and install Google's Google Analytics opt-out browser add-on.

7. Cookies and similar technologies #

Cookies, local storage and session storage keep small pieces of information in your browser. We use them to keep you signed in and protect sign-in against forgery (strictly necessary), to remember your choices (preferences), to count visitors with the reader identifier described in Section 1.3 (audience measurement), and, on sites and pages that use them, for Google Analytics and for ads, as Section 6 describes.

We do not ask for consent before setting strictly necessary and preference cookies. If we begin using cookies or similar technologies for any other purpose, we will update this policy first and, where the law requires it, ask for your consent.

The cookies we set are listed below. Some names may appear with a "__Secure-" or "__Host-" prefix, which tells your browser to send the cookie only over a secure connection.

Your browser's storage also holds short-lived notes about this browsing session, such as when it last renewed your sign-in; the reader identifier and the account it was last linked to; a copy of your username and picture while you are signed in; and conveniences such as when your browser first visited, so that we ask you to create an account only once, chat read positions, unsent trade drafts and recent searches.

Cloudflare, which protects our websites on our behalf, may set cookies on our domains that help distinguish people from automated traffic, for example when a form is protected by Cloudflare Turnstile. Google, Discord, Apple and Roblox may set cookies on their own websites if you sign in with them, and Google may do so when its Sign in with Google prompt is shown.

You can block or delete cookies and site data in your browser settings. If you block strictly necessary cookies, you will not be able to sign in, and deleting preference cookies or site data resets the choices they record.

8. How long we keep information #

We keep personal information for as long as we need it for the purposes in this policy, and then delete or de-identify it.

8.1 Your account #

You can delete your account at any time from your account settings. You are then signed out everywhere and your profile is hidden for 30 days, during which you can restore it by signing in; we email you a restore link and a reminder seven days before the end. After 30 days, we delete your account, profile, posts, messages, sign-in methods, connections and any link to a reader identifier, and email you to confirm. You cannot delete your account while you hold a role on a game's team, and we may delay deleting information that a report, an appeal or the law requires us to keep.

Some records are kept after deletion in a form that no longer identifies you, such as donations, changes you made to values, and reports, enforcement actions and appeals. If your account was banned, we keep a hashed form of its email address and the history of its linked accounts for as long as the ban applies, to prevent the ban from being evaded. A released username is reserved for 90 days so that nobody else can impersonate you.

8.2 Retention periods #

9. Security #

We use technical and organisational measures designed to protect personal information, including encryption in transit, hashed passwords, encrypted storage of sign-in tokens from other services, restricted and logged staff access, and two-step verification for staff. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If you believe your account has been compromised, contact us at support@gameful.com.

10. International transfers #

Our main servers are located in the United States, and some of our service providers store or process information in other countries. Gameful Inc. is based in the United States, and we and our service providers may access and process personal information in countries whose data protection laws may differ from those where you live. Where we transfer personal information from the European Economic Area, the United Kingdom or Switzerland, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (and the United Kingdom's addendum to them) or a provider's certification under the EU-U.S. Data Privacy Framework. You can ask for a copy of these safeguards at privacy@gameful.com.

11. Your choices and rights #

11.1 Choices available to everyone #

• Privacy settings. In your account settings you can control who can message you and send you friend requests, who can see your profile, inventory, online status, alternative accounts and linked accounts, whether others see when you have read their messages, and whether you appear on leaderboards.
• Notifications and email. You can change your notification settings at any time, and every non-essential email has an unsubscribe link.
• Usage statistics, ads and analytics. You can turn on Global Privacy Control or Do Not Track in your browser, and use the choices in Section 6.3.
• Your account. You can update your profile and delete your account at any time from your account settings.

11.2 Your rights #

Depending on where you live, you may have the right to:

• access the personal information we hold about you and receive a copy of it in a portable format;
• correct inaccurate information;
• delete your personal information;
• ask us to restrict our processing of your information;
• withdraw your consent where we rely on it, without affecting processing that has already taken place; and
• not be subject to a decision based solely on automated processing that produces legal or similarly significant effects for you.

Right to object. Where we rely on our legitimate interests, you may object at any time to our processing of your personal information on grounds relating to your particular situation, and we will stop unless we have compelling legitimate grounds or need the information for legal claims.

To exercise any of these rights, write to privacy@gameful.com from the email address on your account, or tell us your username. We may need to verify your identity first, normally by asking you to confirm the request from that email address or while signed in, and we will respond within the time required by law, normally one month. You may authorise an agent to make a request for you, and a parent or guardian may make a request for their child. We will not discriminate against you for exercising your rights. If you are in the European Economic Area or the United Kingdom, you also have the right to lodge a complaint with your local data protection authority.

11.3 Additional information for United States residents #

Residents of California and certain other US states have rights to know what personal information we collect, use and disclose, to access, correct and delete it, and to opt out of its sale or sharing for targeted advertising or of profiling with legal or similarly significant effects. We do not sell personal information, as that term is defined under California law. Section 6 describes the advertising and analytics on Gameful and your choices.

In the past 12 months, we have collected the following categories of personal information, from the sources and for the purposes described in Sections 1 and 2: identifiers (such as your email address, username, account identifiers and IP address); characteristics of protected classifications (your age range and, if you provide them, your pronouns); internet or other electronic network activity information (such as usage statistics, which are linked to your account while you are signed in, and security events); approximate geolocation (your country); audio, electronic or visual information (such as images and video evidence you upload); the content of your messages and posts; inferences (such as your trading standing); and sensitive personal information, namely account sign-in credentials and the contents of messages you send to other users. We disclose these categories for business purposes to the recipients described in Section 5. We use sensitive personal information only for purposes permitted by law, such as providing and securing the Services, so we do not offer a right to limit its use. We have no actual knowledge of selling the personal information of consumers under 16.

You can make a request as described in Section 11.2. If we deny a request, you may appeal by replying to our response, and we will explain our decision.

12. Children and teenagers #

12.1 Minimum age #

Gameful accounts are for people aged 13 and over. Anyone may read Gameful's public pages, but you must be at least 13 to create an account or use features that need one. Everyone who creates an account must confirm that they are at least 13, and may tell us their age range in their account settings; we do not ask for a date of birth. We do not knowingly collect personal information from children under 13. If a user tells us they are under 13, or we otherwise have reason to believe that an account belongs to a child under 13, we close it promptly, without the usual 30-day waiting period, and delete its personal information.

12.2 Protections for users aged 13 to 17 #

• An account that has not told us its age range gets the same settings as an adult account, and its owner can change who can message them and who can see their profile at any time.
• Every account aged 13 or over can message, trade with and be friends with any other, whatever their ages. Messages from someone you have not accepted wait in your message requests, and can include photos only once you accept. Adults, and accounts that have not told us their age range, can turn message requests off; users aged 13 to 17 always receive them as requests.
• Every message is checked for unsafe content, and you can block or report anyone. Age information can be wrong, so please report anyone who makes you uncomfortable.
• Users aged 13 to 17 can use the same features as adults, including email, push and Discord notifications, a personalised feed, and public posts, likes and votes. Some protections stay in place for them: people who are not their friends see a trader card rather than their full profile and cannot see when they are online, photos that our screening has not cleared stay hidden, they are warned before accepting a friend request from someone they do not know, and phone numbers and email addresses sent to or from them are held for review.

12.3 Parents and guardians #

If you are a parent or guardian, you can write to parents@gameful.com to tell us that your child under 13 has a Gameful account so that we can close it, to ask what personal information we hold about your child and request a copy, to ask us to correct or delete it or close your child's account, or to raise any concern about your child's safety. Please include your child's Gameful username or the email address used for the account. We will take reasonable steps to verify that you are the child's parent or guardian before we disclose or change any information. For a child aged 13 to 17, we take into account the child's own rights and best interests and the law where you live, may involve your child, and do not normally disclose the content of private messages.

12.4 Removing content (California) #

If you are under 18 and live in California, you can remove content you have posted by deleting it, or ask us to remove it by writing to privacy@gameful.com. Removal does not ensure complete or comprehensive removal, for example where another user has copied or reposted the content.

13. Changes to this policy #

We may update this policy from time to time. A new version takes effect when we publish it here, and the date at the top of this policy shows when that was.

14. Contact #

Gameful Inc.

• Privacy questions and requests: privacy@gameful.com
• Parents and guardians: parents@gameful.com
• General support: support@gameful.com