Privacy Policy

1Who we are#

Perthro is made by Rune Art ltd. ("we", "us"), a corporation incorporated under the Canada Business Corporations Act, with its principal place of business in Alberta, Canada. This policy covers the Perthro app for iPhone and iPad, its widgets, the perthro.io website, and our emails and notifications (together, "Perthro").

We are responsible for the personal information described here. We have a Privacy Officer who is accountable for how we handle it:

• Email: contact@rune.art, with "Privacy Officer" in the subject
• Post: Rune Art ltd., attention: Privacy Officer, 330 5 Ave SW, Suite 1800, Calgary, Alberta T2P 0L4, Canada

This policy doesn't cover services run by other companies that you reach through Perthro, such as Steam, Xbox, PlayStation, Discord, Twitch or the App Store. Their own privacy policies apply to them.

2What we collect#

2.1What you give us#

To create an account you must give us an email address (or sign in with Apple, Discord or Twitch), a username and your date of birth. Without them we can't create your account. Everything else is optional.

• Account details. Your email address and password, or the account you sign in with (Apple, Discord or Twitch). If you use Sign in with Apple, you can hide your real email; if Apple shares your name, we use it as your display name until you change it.
• Date of birth. We ask for it when you sign up, to confirm you're 16 or over and to decide whether to hide mature content (see section 11). It's stored privately and never shown to anyone.
• Profile. Your username, display name, bio, avatar and banner, your profile visibility and your accent colour.
• What you post. Logs, ratings, reviews, playtime, mood tags, backlog and wishlist, lists, comments, likes, votes, bookmarks, follows, favourites, and the studios and genres you pick to shape your feed.
• Reports and support. Reports you make about content or people, and messages you send us, including attachments.
• Imports. Games you import from a CSV file or from your Steam wishlist.

2.2What comes from services you connect#

If you choose to connect Steam, Xbox or PlayStation, we receive your account ID and public profile (such as gamertag, avatar and level), your game library, playtime and play dates, what you've recently played, and your achievements or trophies (and gamerscore or trophy level). We keep these in sync until you disconnect. For Xbox and PlayStation we store sign-in tokens, encrypted, so that syncing keeps working. We never see or store your password for any of these services.

2.3What we collect automatically#

• Usage analytics. Which features are used: for example, that a game was logged or a search returned results. These events are linked to your Perthro account ID, not your name or email. Before an event leaves your device, we strip out personal details such as email, username, review text and search terms. Session recording is off, and we don't track your activity in other apps or websites.
• Crash reports. If the app crashes or hits an error, it sends a technical report with your device model, iOS version and app version. Reports are linked to a random ID for your installation, not to your account, and never include screenshots or your content. You can turn them off in Settings → Privacy & feed → Diagnostics.
• Notifications. If you allow notifications, we store your device's notification token, your notification choices, and your device's time-zone offset so quiet hours work.
• Purchases. If you buy a plan, Apple tells us which plan, when it started and when it ends. We never see your card details or billing address.
• Technical data. Like any online service, our servers and providers receive your IP address and basic device information when the app connects. We don't use your IP address to work out your precise location, and Perthro doesn't use GPS.

2.4What we don't collect#

We don't collect precise location, contacts, microphone or camera data, or health data. The photo picker lets you choose a single image without giving Perthro access to your photo library. We don't read your messages on any other service.

3Ads#

The free version of Perthro shows ads served by Google AdMob. Pro, Hero and Founder members don't see ads, and the ads system isn't started for them at all.

• In the EU, the EEA, the UK and Switzerland, Google's consent form asks for your choices before any ads load. You can change them later in Settings → Privacy options.
• Personalised ads use Apple's advertising identifier, and are shown only if you allow tracking when iOS asks. If you don't allow it, or turn it off later in iOS Settings → Privacy & Security → Tracking, you still see ads, but they're not personalised.
• Members aged 16 and 17 only ever see non-personalised ads. We tell Google they're teenagers, so its ad protections for teens apply, such as restricting ads for alcohol, gambling and dating. Google's consent form also treats them as under the age of consent.
• To show and measure ads, Google receives your IP address, device information and, if you allow it, the advertising identifier. Google handles this data under its own privacy policy. It may use SKAdNetwork, Apple's privacy-preserving install measurement, to measure ads.

We don't give advertisers your name, email, reviews or anything else you post.

4How we use your information#

We use personal information to:

• Run Perthro: create your account, show your library and feed, sync connected platforms, send notifications you've asked for, and deliver the features of your plan. (EU/UK legal basis: our contract with you.)
• Show your profile and posts to others, according to your visibility settings. (Contract.)
• Personalise Perthro: rank your feed and suggest games and people based on your taste picks, the games you log and who you follow. (Our legitimate interest in making Perthro useful. You can shape this through your taste picks, follows and mutes.)
• Keep Perthro safe: check your age, prevent spam and abuse, review reports, enforce our Terms and Community Guidelines, and protect accounts. (Legitimate interests: protecting our members, especially younger ones, and Perthro itself from harm and misuse; legal obligation.)
• Understand and fix Perthro, through analytics and crash reports. (Legitimate interests: finding bugs and learning which features work, so we can improve them. You can object, see section 9.)
• Show ads in the free version. (Consent for personalised ads; legitimate interests for non-personalised ads, where the law allows.)
• Process purchases and check them with Apple. (Contract.)
• Talk to you: account emails such as sign-up confirmation, password resets and deletion codes, answers to your messages, and notices about important changes. We don't send marketing email. (Contract; legitimate interests: keeping you informed about your account and about changes that affect you.)
• Meet legal obligations: tax and accounting, answering lawful requests, and protecting our rights. (Legal obligation; legitimate interests.)

We don't use your personal information to make decisions about you that have legal or similarly significant effects on you by automated means alone. Ranking your feed and hiding mature content by age are automatic, but they don't have effects of that kind.

No AI training. We don't use AI models to process your content, we don't train AI on it, and we don't give it to anyone for that purpose.

5What other people can see#

Perthro is a social app, so some of what you do is visible to others:

• Always public, even to people without an account: your username and avatar, so people can find you.
• Everything else on your profile, including your display name, bio, banner, logs, reviews, ratings, lists, follows and connected-platform stats (such as your gamertag and playtime), follows your profile visibility: Public (anyone), Followers only, or Private. New profiles start as Public. Change this in Settings → Privacy & feed → Profile visibility.
• Lists are public unless you mark them private.
• Comments on someone else's review can be seen by anyone who can see that review.
• Reviews marked Mature are hidden from members under 18. Blocked members can't see your activity, and you can't see theirs.

Anything you make public can be seen, and copied, by other people. Deleting it from Perthro removes it from Perthro, but we can't control copies other people have already made.

6Who we share it with#

We don't sell your personal information for money. We share it only with the following:

Service providers that help us run Perthro. They may use it only to provide their service to us:

• Supabase hosts our database, sign-in, file storage and servers.
• Resend sends our account emails.
• Apple provides the App Store, Sign in with Apple, push notifications and payments.
• Sentry receives crash and error reports.
• PostHog receives usage analytics.
• Google AdMob shows ads in the free version (see section 3). For personalised ads, Google acts as an independent company making its own decisions about the data.

Services you connect or sign in with. If you connect Steam, Xbox or PlayStation, or sign in with Apple, Discord or Twitch, we exchange the information needed to do that with the company concerned.

Content providers. When the app loads game artwork, screenshots and trailers, they come directly from their sources: IGDB, Steam, PlayStation, Xbox, Microsoft and YouTube. Those services receive your IP address when an image loads. When we look up game details and prices, we send IGDB and IsThereAnyDeal game IDs only, never anything about you.

The website. perthro.io doesn't use analytics or ads. If you pick a language, or close the banner that offers the page in the other language, a single cookie remembers that choice for a year. To show visitors in Quebec the French version first, our host, Cloudflare, checks your approximate location from your IP address when you open a page; we don't store it. Some pages show game artwork loaded from IGDB, which receives your IP address when it loads.

Other members, according to your visibility settings (see section 5).

When the law or safety requires it. We may disclose information when required by law, such as a court order; to respond to a lawful request from authorities; to report child sexual abuse material; to protect someone from serious harm; or to protect our rights, members and Perthro. Where we can, we tell you first.

If our business changes hands. If Rune Art is involved in a merger, acquisition or sale of assets, your information may be transferred to the new owner. They must keep protecting it as this policy describes, and we'll tell you before it becomes subject to a different policy.

7Where your data is stored#

Our main database, file storage and servers are run by Supabase in the United States (Oregon). PostHog and Sentry also store their data in the United States. Apple, Google and Resend process data on their own infrastructure, which may be in the United States or elsewhere.

This means your information is stored outside Canada, and outside the EU or UK if you live there. While it's in another country, the law of that country applies, and courts, law enforcement or national-security authorities there may be able to access it. We use contracts to require our providers to protect it to a standard comparable to this policy. Where GDPR applies, those contracts include the European Commission's Standard Contractual Clauses and the UK addendum. We stay responsible for your information when our providers handle it for us. Where GDPR applies, you can ask us for a copy of the safeguards we use.

You can ask our Privacy Officer (see section 1) for written information about our policies and practices for service providers outside Canada. The Privacy Officer can also answer questions about how those providers collect, use, disclose or store your personal information for us.

8How long we keep it#

We keep personal information only for as long as we need it for the reasons in this policy:

• Your account and everything you've posted: until you delete them or your account. Deleting in the app removes your account immediately. Remaining copies in backups are deleted within 60 days after that.
• Connected platforms: until you disconnect or delete your account. Disconnecting removes the imported data from that platform and its stored sign-in tokens.
• Sync history for connected platforms: 60 days.
• Crash reports: up to 90 days.
• Analytics: up to 2 years, then deleted or made anonymous.
• Records of account emails and notifications we've sent you: up to 12 months, for security and to make sure emails get delivered. After you delete your account, these records are no longer linked to it.
• Reports and moderation records: up to 2 years after the report is resolved, so we can deal with repeated abuse and appeals. Reports stay after the reported account is deleted, but are no longer linked to it.
• Records we must preserve by law, such as material we have reported under child-protection laws: for as long as those laws require.
• Support conversations: up to 2 years after they end.
• Age check for under-16s: if someone gives a date of birth under 16, we keep a one-way scrambled (hashed) copy of the email address so that address can't be used to sign up again. We keep nothing else about them.
• What the law requires us to keep, such as tax and accounting records: for as long as the law requires, usually 6 to 7 years in Canada.

Statistics that are fully anonymous, and so can't identify you, may be kept longer.

9Your choices and rights#

You can do most things yourself in the app:

• Download your data: Settings → Account & profile → Your data → Download my data saves a complete copy as a JSON file. Settings → Library → Export library saves your library as a CSV spreadsheet.
• Edit or delete anything you've posted, and edit your profile.
• Control visibility in Settings → Privacy & feed, and block, mute or hide people, games and posts.
• Choose notifications in Settings → Notifications, or turn them off in iOS Settings.
• Turn off crash reports in Settings → Privacy & feed → Diagnostics.
• Control ads as described in section 3.
• Disconnect Steam, Xbox or PlayStation in Settings → Connections.
• Delete your account (see section 10).

Depending on where you live, you also have legal rights. We honour these for everyone, wherever you live:

• to access the personal information we hold about you and get a copy;
• to correct it;
• to delete it;
• to take it with you in a portable format;
• to object to, or ask us to limit, how we use it, including analytics;
• to withdraw consent at any time, without affecting what we did before; and
• to complain to a regulator (see section 14).

For anything you can't do in the app, such as switching off analytics or correcting your date of birth, email our Privacy Officer at contact@rune.art from the address on your account. To protect you, we may need to confirm your identity first. We reply within 30 days. If a request is complex, we may take longer where the law allows, and we'll tell you. Requests are free, unless they're clearly unfounded or excessive.

10Deleting your account#

Delete your account in Settings → Account & profile → Delete account. You confirm by typing DELETE and entering a 6-digit code we email you, so nobody else can delete your account from your phone. Deletion is immediate and permanent:

• your account and profile, including your date of birth;
• your logs, reviews, ratings, lists, comments, likes, follows and bookmarks;
• your avatar and banner images;
• your connected platforms and their stored tokens; and
• your notification tokens and settings.

Backup copies are deleted within 60 days, and the few records described in section 8 are kept for their stated periods without being linked to your account.

Can't use the app? Email contact@rune.art from the address on your account, and we'll delete it within 30 days of confirming it's you. More detail is on our delete account page.

Deleting your account doesn't cancel a subscription. Cancel it with Apple first (see our Subscription Terms).

11Age limits and young members#

Perthro is only for people aged 16 and over, everywhere. We set one age limit for everyone that is at or above the age at which people can consent to online services in the places Perthro is available, including the EU (13 to 16, depending on the country), the US (13) and Quebec (14). We don't knowingly collect personal information from anyone under 16. If someone gives a date of birth under 16, we don't create a usable account.

For members aged 16 and 17, we take extra care. Mature content and adults-only games are hidden, and ads are never personalised.

If you're a parent or guardian and think a child under 16 is using Perthro, email contact@rune.art. We'll delete the account and its information.

12How we protect it#

We protect your information with measures appropriate to its sensitivity, including:

• encryption for every connection between the app, the website and our servers, and for stored data;
• extra encryption for connected-platform sign-in tokens;
• database rules that limit what each account can read and change;
• confirmation codes, and limits on how many attempts can be made, for sensitive actions such as deleting your account;
• checking purchases directly with Apple; and
• giving access to personal information only to the people who need it to run Perthro.

No system is perfectly secure. If you find a security problem, please tell us through our security policy.

If a breach of security affecting your personal information creates a real risk of significant harm (in Quebec, a risk of serious injury), we'll tell you as soon as we can. We'll also report it to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner of Alberta, and any other regulator the law requires, such as the Commission d'accès à l'information du Québec or an EU or UK data-protection authority. We keep a record of every breach for at least 24 months.

13Notes for specific places#

13.1Canada#

We follow the federal Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act. We also follow the private-sector privacy laws of Quebec and British Columbia for residents of those provinces. Quebec residents also have rights under Law 25, including to be told about decisions made by automated means alone (we don't make any), to have information about them ported, and to be served in French.

How we govern personal information. Our Privacy Officer is responsible for protecting the personal information we hold. We keep it only for the periods in section 8, then delete it or make it anonymous. We handle requests and complaints as described in sections 9 and 14. Before we start using a new service provider outside Quebec, or use personal information in a new way, we assess the privacy risks.

13.2EU, EEA, UK and Switzerland#

Rune Art ltd. is the controller of your personal data. The legal bases we rely on are listed in section 4, and international transfers in section 7. You can complain to the data-protection authority where you live or work. We are appointing representatives in the EU and the UK and will name them here. Until then, contact our Privacy Officer directly (see section 1).

13.3California and other US states#

We don't sell personal information for money. However, when you allow personalised ads, Google's use of your advertising identifier and device data may count as "sharing" or "targeted advertising" under California law and similar laws in other states. To opt out, don't allow tracking, or turn it off in iOS Settings → Privacy & Security → Tracking. You can also email us to ask us to opt you out.

You have the right to know what personal information we collect, use and disclose, and to delete it, correct it, and opt out of its sale or sharing. We won't treat you differently for using these rights. The categories we collect are listed in section 2, the purposes in section 4, who receives it in section 6, and how long we keep it in section 8. We don't use sensitive personal information to infer characteristics about you. Contact us as described in section 9. An authorised agent can make a request for you, and we may need to verify it.

13.4Everywhere else#

Wherever you live, we apply this policy and honour the rights in section 9 as far as we reasonably can.

14Complaints and contact#

If you have a question or concern, please contact our Privacy Officer first at contact@rune.art. We'll do our best to sort it out. You can also complain to a regulator:

• Canada: Office of the Privacy Commissioner of Canada, priv.gc.ca
• Alberta: Office of the Information and Privacy Commissioner of Alberta, oipc.ab.ca
• British Columbia: Office of the Information and Privacy Commissioner for British Columbia, oipc.bc.ca
• Quebec: Commission d'accès à l'information du Québec, cai.gouv.qc.ca
• UK: Information Commissioner's Office, ico.org.uk
• EU and EEA: the data-protection authority in your country
• California: California Privacy Protection Agency, cppa.ca.gov

15Changes to this policy#

We update this policy when Perthro or the law changes. The date at the top shows the latest version. If we make a significant change, such as using your information in a new way or sharing it with a new kind of company, we'll tell you in the app and by email at least 30 days before it takes effect. We won't use information we already have for a new purpose that needs your consent until you've given it.