Your games are personal.
Your data should be, too.
This page explains what the current prototype does and the intended data practices for a future GamerID service. It is a working draft: connected accounts and login security are not live, and this page must be checked against the finished service before launch.
What happens right now
This is a static website preview. GamerID sign-in and two-factor authentication, Steam sync, Xbox or other platform connections, YouTube and Twitch connections, friend search, AI suggestions, and uploads are not connected. The account, library, friends, and playtime shown are sample data. The sign-in buttons do not collect or send passwords.
The preview stores your privacy choice in browser local storage for up to 180 days. If you opt into personalisation, it also stores the last hero-game image and your visual settings so they can carry across pages. Analytics and advertising tracking are not active.
Some design assets load from Google Fonts, Steam’s image CDN, and Unsplash. Those providers may receive basic connection information such as your IP address and the requested asset when your browser loads them. A live service should review, list, and minimise external requests before launch.
Browser storage choices
“Cookies” can include technologies beyond cookie files. UK rules can also cover local storage, tracking pixels, scripts, and other ways to store or access information on a device. Optional technologies should not run before the required consent is given.
What a GamerID login may involve
A future GamerID account may use an account identifier and, depending on the sign-in method, an email address. We intend to use a trusted authentication service rather than store users’ passwords ourselves. The actual authentication provider and the data it handles must be named here before launch.
Two-factor authentication for GamerID will be separate from sign-in to Steam, Xbox, or another connected platform. We intend to support an authenticator app and may offer SMS as an optional method. If you choose SMS, your phone number and message-delivery information will be processed for verification. We will not ask you to give GamerID a security code issued by a gaming platform; that platform handles its own verification during its sign-in flow.
GamerID may also process account security settings, sign-in/session records, appearance and privacy preferences, and technical security logs needed to operate and protect the service. The exact data, authentication provider, and retention periods must be confirmed before launch.
You choose what to connect
Connections will be optional and separate for each service. When you choose a platform, you will be sent to that provider’s own sign-in and permission screen. GamerID will not ask you to enter a Steam, Xbox, PlayStation, Riot, Epic, EA, Battle.net, Google, YouTube, or Twitch password into GamerID. We will request only permissions needed for the feature and data the provider makes available. What can be retrieved varies by service, account privacy settings, and provider approval.
Depending on the service and permissions, connected-account data may include a provider account ID, display name, profile image, connection status, game titles, playtime, recent activity, achievements, or creator channel details. A platform may not provide all of these. We will show unavailable information as unavailable rather than infer it. GamerID will not scan your computer or console, inspect installed files, or run a local tracking app.
To keep a connection active, a provider may require GamerID to retain a provider account identifier and an authorisation token, such as a refresh token. These are sensitive credentials even though they are not your platform password. The intended design is to store any required long-lived token only on the server, encrypted at rest, and use it only to refresh the connection you approved. Tokens will not be placed in webpage code or browser storage. Disconnecting a platform should remove its saved authorisation and stop future access; you can also revoke access through the provider where supported.
Friend profiles may show game lists, activity, and achievement progress only when the account holder chooses to share those details with approved friends. Achievement sharing is off by default in the design and can be turned off again at any time. Friend and presence features are not active in this preview. YouTube or Twitch recommendations would use only connected or selected interests and information those services permit; no creator account is linked today.
Current information, without a stored play history
The intended service will fetch the latest information available when you open or refresh your library. GamerID is not intended to keep historical copies or snapshots of your game library, playtime, recent activity, or achievement progress. The information may be held temporarily while a request is processed and displayed in your active session, but it will not be used to build a stored play-history timeline.
Playtime is only as current and complete as the connected platform’s API. Some platforms may update totals after a delay, hide information, or not provide total hours at all. Without scanning your device or keeping snapshots, GamerID cannot independently time an active game session or reconstruct hours a platform does not report. We will show when a connection was last refreshed and explain when a figure is unavailable or may be delayed.
To keep your account and connections working, the planned service may retain your GamerID account record, linked platform identifiers, authentication/security settings, and encrypted platform tokens while your account or connection remains active. We intend to delete a platform token and its link when you disconnect it, and remove account data when you delete your account, subject to any limited retention that is legally required or needed to protect the service. The precise retention periods, backup deletion schedule, and security-log period must be set and published before launch.
Before launch, we intend to use encrypted connections and appropriate safeguards for stored credentials, restrict access to those credentials, and keep them out of application logs. Encryption reduces risk but cannot guarantee that a service will never be compromised. The final hosting, authentication, database, and other service providers—and any relevant international transfers—must be identified in the live notice.
You stay in control of publishing
A creator feature could suggest video concepts, titles, or outlines from games you have chosen to include. It should be off until you ask for it. Before any AI provider receives account or game information, the live service would need to identify that provider, explain exactly what is sent and why, and ask for any required permission.
Ideas in this prototype are examples only. Nothing is sent to an AI service, no video is uploaded, and nothing is posted to YouTube, Twitch, or another platform. Any future publishing action should show the destination and visibility setting and ask for your confirmation before it happens.
Privacy should be easy to change
You can reject optional storage and change your choice from the footer. In a full version, you should be able to see connected platforms, disconnect them, and request account deletion. You can also manage or revoke platform permissions through the provider where supported. Depending on where you live and how the service operates, you may have rights to access, correct, delete, restrict, or object to certain uses of personal data.
Service owner and privacy contact: To be added before launch. The operator must provide a working contact address and confirm the process for privacy requests.
For current UK information, see the ICO guidance on storage and access technologies, its guidance on privacy information, and its guidance on data minimisation and encryption and data storage.
YouTube connections will also need to follow the YouTube Terms of Service, YouTube API developer policies, and Google’s Privacy Policy. Twitch connections will need to follow its OAuth requirements.