Privacy Policy

Last updated: 2026-07-12

Short version. We only collect what we need to identify you across sessions and prove your reports came from a real Steam account. You can delete your data at any time from the profile page. When you do, we strip the account link off any reports you left behind so the community keeps the compatibility data without keeping you.

The rest of this page explains the specifics. Every claim below is backed by open-source code you can read: the Steam sign-in edge function and the GDPR erase function.

How Steam sign-in works, and why we use it

Signing in with Steam uses Steam OpenID 2.0, not OAuth. The flow is deliberately narrow. Here is what actually happens on the wire:

You click Sign in with Steam. Your browser goes to steamcommunity.com/openid/login with our return URL attached.
You approve the sign-in on Steam. Steam bounces you back to our steam-callback edge function with an OpenID assertion.
The edge function re-sends the assertion to Steam and asks Steam to verify it is authentic. If Steam does not reply is_valid:true, sign-in fails and nothing is written.
Once verified, we know your Steam ID. We fetch your public Steam profile (display name and avatar URL) from api.steampowered.com/ISteamUser/GetPlayerSummaries.
We create or update a Supabase user for you and redirect you back to the site with a session cookie.

Why Steam sign-in, and not email or a password

Report legitimacy. A report that says "Cyberpunk runs great on Steam Deck" is more useful when we can tell the reporter actually owns the game on a real Steam account, and when we can rate-limit reports per Steam ID to keep the tier scores honest.
No password to steal. Steam handles the credentials. We never see your password, and there is no forgot-password flow on our side to abuse.
Removes fake accounts. Creating throwaway Steam accounts to game the ranking has a real cost. That is more friction than email verification and it keeps the tier data harder to manipulate.

What Steam gives us, verbatim. Steam sends back exactly three pieces of profile data: your 64-bit Steam ID, your public display name, and your avatar URL. Not your friends list, not your library, not your purchase history, not your email address. If we ever ask you to authorize more scope, that request will be explicit and separate from sign-in.

What we collect, in plain terms

From Steam sign-in

Steam ID (64-bit). Used as your identity across sessions and as the reporter identity on any reports you submit.
Steam display name. Shown next to your reports so other users can see who reported what.
Avatar URL. Pointer to the image Steam already hosts. We do not download or re-host the image.

From your activity on the site

Reports you submit (game tier, Proton version, hardware fingerprint, notes). Tied to your account so you can edit or withdraw them.
Votes you cast on other reports.
Anonymous browser telemetry (page views, timing) written to site_events. No third-party analytics, no ad pixels, no cross-site tracking.

Library / wishlist sync

Steam sign-in does not return your library or wishlist. To match reports against what you own, we fetch the lists ourselves. When this happens:

Library: fetched automatically the first time you open the profile page after signing in (there is no cached row yet, so we pull one).
Wishlist: fetched automatically the first time you activate the "On wishlist" filter chip on the browse page.
Beyond that first pull, we only re-fetch when you tap Refresh on the profile card.

Nothing here is secret: the same data your Steam profile page shows to the public web is what we call. Steam only returns anything at all when your profile visibility is set to Public. If it is Friends only or Private, Steam returns nothing and we cache nothing. If you want to opt out entirely, flip your Steam profile visibility to Friends only or Private and clear your cached row on the profile page.

When the fetch does fire, our sync-steam-library and sync-steam-wishlist edge functions call api.steampowered.com/IPlayerService/GetOwnedGames and api.steampowered.com/IWishlistService/GetWishlist with our Steam Web API key and your Steam ID.

What we cache: the appid list, the count, and the sync timestamp, in user_steam_library and user_steam_wishlist. That's it. No purchase history, no playtime beyond what you already send us in Pulse reports, no wishlist prices. The GDPR erase path wipes both tables.

Full technical breakdown, including how the sync is scheduled and which browse chips depend on it, lives in the Steam Library wiki.

Where it lives

Everything above lives in a single Supabase project (Postgres + auth), hosted on AWS. The static site itself is served from GitHub Pages behind Cloudflare. Nothing is shared with third parties. There are no ads on the site.

Deleting your data (GDPR right to erasure)

Every signed-in account has a Delete my account action on the profile page. There is no "email us and wait a week" step. It runs immediately.

What happens when you delete

Everything that identifies you is removed for good: your avatar row, Steam ID, plugin-link records, browser telemetry, your saved system profiles, and the Supabase auth record itself.

The compatibility reports you left behind stay, but the thread back to you is cut. We null the account id and installation id, swap the reporter handle for a one-time random token that points at nothing, and mark the row anonymized. Your name comes off it and nothing links it to your account. A five-year-old Deck result should not vanish just because you closed your account, so the report keeps counting toward the tier. Votes are deleted, since a vote only means something tied to a voter and the score is already tallied on the report.

Worth knowing: a report's free-form notes are part of that preserved record. They remain after your account is gone. Do not put personal information in the notes field.

This runs the moment you confirm on the profile page. The exact SQL is admin_erase_user.

Cookies and sessions

One session cookie set by Supabase auth so we know you are signed in. No tracking cookies. No third-party cookies. Signing out or clearing the cookie ends the session.

What we do not do

No third-party analytics (no Google Analytics, no Meta Pixel, none).
No selling or sharing your data.
No access to your Steam account beyond the three public profile fields above.
No email marketing. We do not collect your email.

Open source, so you can verify everything on this page

Read the code that runs Steam sign-in, the erase function, the schema, and every edge function:

proton-pulse-web (site + edge functions + migrations)
steam-callback edge function (Steam sign-in flow)
admin_erase_user migration (anonymize + erase pipeline)
decky-proton-pulse plugin (client side)

Contact

Questions or a specific data request: open an issue at github.com/mdeguzis/proton-pulse-web/issues or email mdeguzis@gmail.com.