Privacy Policy

FinishedYet is operated by Daniil Davidchuk, an individual based in Slovakia. Daniil Davidchuk is the controller responsible for personal data processed through FinishedYet. For privacy questions or to exercise your data protection rights, contact support@finishedyet.com.

• Account/authentication data: email, account identifiers, signup and sign-in times, verification status, session information, and Terms acceptance and Privacy acknowledgement versions and times. Passwords are submitted to Supabase Auth for authentication.
• Profile data: username, display name, biography, avatar images and file metadata, setup state and visibility settings.
• Game activity: ratings, play statuses, favorites, reviews, play dates, lists and items, visibility choices and generated activity events.
• Social data: follows, blocks and achievements derived from game activity.
• Reports/moderation: reporter and target identifiers, reasons, explanations, copied content snapshots, moderator actions, notes and timestamps.
• Illegal-content notices: content locations, allegations and context, name and contact details where required, good-faith declarations and receipt information. Submissions may contain information about people other than the sender.
• Support correspondence and information supplied to resolve requests.
• Technical data: authentication cookies, browser storage described below, IP-derived and account-based rate-limit keys, request counts/times, diagnostics and hosting/authentication request information.
• Game titles, identifiers, images, metadata and search queries used to retrieve catalog information from IGDB/Twitch.

Send only information relevant to your request. Do not send passwords, sign-in links or unnecessary sensitive information.

Account, profile and activity data is processed to provide the service you request under the account agreement. Required registration information is needed for an account; optional profile and community content is your choice.

Our legitimate interests in operating and protecting the service support moderation, support, abuse prevention, troubleshooting and disputes. We also process information to meet legal obligations. Where a feature relies on consent, it must ask separately; acknowledging this policy is not blanket consent.

FinishedYet does not currently implement advertising, behavioural analytics or the sale of personal data. Recommendations and achievements use game information or activity; the application does not make automated legal-notice or moderation decisions.

Profile setup asks you to choose Public or Private. Profiles without a completed publication choice are not public. New game activity and lists default to Private. When adding games during onboarding, you explicitly choose whether to share that batch or keep it private. Profile visibility and individual activity/list visibility are separate: public presentation requires a public profile and content separately marked Public.

Public profiles can show username, display name, biography, avatar, public activity and lists, and social counts. Public ratings may contribute to FinishedYet community ratings. Public content can be viewed without an account and copied by others.

Making a profile private hides its public-profile surfaces without rewriting individual visibility choices. Making it public again may reveal items previously marked Public. Private data is restricted from other ordinary users; the operator and providers still process it to operate the service.

Achievements have a separate display setting, off by default for new profiles. They derive from activity, including private activity, so displaying them can reveal information about it. Avatars are stored in a public bucket: uploaded avatar URLs may remain accessible even when the profile is private.

Blocking removes follows in both directions and limits each other's social/community visibility while signed in. It does not prevent logged-out viewing. Incoming blocks are not shown to you. Changing visibility or deleting original content does not automatically erase copies retained in reports.

Supabase provides authentication, the database and avatar storage. Vercel hosts and delivers the app. Verification and password-recovery emails use the configured authentication email setup. Support messages are handled through the support mailbox.

FinishedYet uses Cloudflare Turnstile to help prevent automated abuse of authentication and account-confirmation requests. Cloudflare may process technical signals needed for bot detection, such as your IP address, browser/device information, and site origin or request context. The resulting verification token is supplied to Supabase as part of authentication verification. See Cloudflare's Turnstile Privacy Addendum.

IGDB/Twitch supplies catalog metadata and image URLs. Catalog requests, including game-search text, are made server-side; Twitch API credentials are not intended for the browser. Images may use application image optimization. FinishedYet is independent and is not affiliated with or endorsed by IGDB or Twitch.

Providers may process information outside Slovakia, including outside the European Economic Area. Transfer arrangements depend on the provider and configuration; contact us for information about applicable arrangements and safeguards.

Relevant report, notice or support information may be shared with providers, affected people or authorities where necessary to investigate, address a dispute or meet legal obligations. Do not assume complete confidentiality.

Supabase authentication cookies maintain and refresh sessions and support authentication flows. These differ from localStorage and sessionStorage.

Recent game-search terms are saved in localStorage on your device for convenience, without a time-based expiry. Clear them using your browser's site-data controls. A pending signup email is saved in sessionStorage for verification-email resending and cleared by the confirmation flow or when the tab's session storage is cleared.

No advertising or analytics-cookie system is currently implemented. Clearing authentication cookies may sign you out. IP-derived rate-limit counters are held in server memory; hosting and authentication providers may separately maintain technical logs.

Account data is kept while reasonably needed to provide your account and service. Use Account and data settings to delete your account after confirming your password and deletion choice.

The workflow removes the authentication account, profile, linked game activity, lists, follows and blocks in both directions, achievements, activity events, legal acknowledgement records and avatar objects. It does not erase every record connected with the account.

Moderation/report snapshots and evidence, legal-notice submissions and contact details, and abuse-prevention, security and legal records may remain for as long as reasonably necessary to review reports/notices, prevent abuse, handle disputes, preserve record integrity and meet legal obligations. They should be deleted or de-identified when no longer reasonably needed. Retention requires manual review rather than automatic expiry.

Support correspondence is kept as needed to handle requests and related issues. Provider backups, logs and copies of formerly public content may follow separate retention processes. Immediate deletion from every backup, log or third-party copy cannot be promised.

Account settings exports JSON containing account/profile details, public and private activity, lists, social connections and outgoing blocks, achievements, activity events, legal acknowledgement and avatar metadata. It does not include every internal record. Passwords, session tokens, incoming blocks, avatar file bytes and confidential report/moderation evidence are excluded. Legal-notice submissions are outside the self-service export.

Use settings to correct profile/activity information. For further access, correction, deletion, restriction, objection or portability requests, contact support@finishedyet.com. We may need proportionate information to verify identity and protect other people's data. Rights and exceptions depend on applicable law. Consent may be withdrawn where processing relies on it, without affecting earlier lawful processing.

You may complain to the Office for Personal Data Protection of the Slovak Republic or another competent data-protection authority.

Accounts are for people aged 16 or older. FinishedYet does not collect a date of birth or operate a parental-consent service. Contact us if you believe an underage person has registered.

Material policy updates are published here with a new version and effective date. Registration records the version acknowledged. Additional information or consent will be requested where applicable law requires it.