1. Who this policy covers
This policy explains how GamerBFF handles information when you visit the site, access a profile, connect a supported service, import gaming activity, teach GamerBFF something, or ask for help. “GamerBFF,” “we,” and “the service” refer to this GamerBFF deployment and its operator.
A limited number of alpha places may be opened for immediate signup. When places are full or paused, existing profiles and valid invitations can still be used. Joining the email wait-list is optional, and the same privacy commitments apply before and after access is authorized.
2. Information we handle
Account and security information
We handle a profile identifier, display name, appearance preference, linked sign-in methods, verified email address when you add one, password hash for email sign-in, active sessions, and security state needed to protect account changes. We do not merge profiles because an email address, name, gamertag, or provider display name happens to match.
Steam and GitHub signup can use verified provider account IDs without you supplying an email address. GamerBFF does not map or save a GitHub email address as an account or contact address for provider-only signup.
Alpha wait-list information
If you choose to join the alpha wait-list, we store the email address you submit, when the request was made, and whether an invitation or registration was completed. An invitation reserves a place and does not create an account. The public page does not reveal queue size, position, or membership. A custom invitation can be created by the operator without consuming a standard alpha place.
Gaming information
Depending on what you choose to connect or add, this can include library relationships, public profile identifiers, play activity, playtime, achievements, platform or subscription availability, imports, preferences, progress, plans, notes, recommendations, and feedback. GamerBFF labels provider or import evidence separately from information you declare yourself.
Requests and operational information
We process the questions and updates you send, bounded context needed to answer them, meaningful in-app notification history and read state, security and abuse-prevention signals, and aggregate operational diagnostics. The active-session list keeps only a coarse browser and platform label. Hosting and security infrastructure may process ordinary request metadata, such as network addresses and request timing, to deliver and protect the service.
Feedback forms store the description you submit and safe diagnostic details for private operator review. Reports submitted while signed in are linked to your profile. Messages you email to Support are handled in the support mailbox separately from in-app feedback. Sending feedback does not give us permission to contact you about it; if you would like a reply, email Support.
AI allowance records retain estimated usage and reservations linked to your account. Clearing gaming data does not reset that allowance. Deleting your account removes this attribution; aggregate financial records, including shared research usage, remain.
3. How we use information
We use this information to manage the alpha queue and invitations, authenticate you, maintain the gaming profile you asked for, import or synchronize selected sources, answer questions, make and explain recommendations, remember approved context, secure the service, diagnose failures, and improve reliability. We do not sell personal information or use it for third-party advertising.
Alpha feedback
To decide what to fix and improve during the alpha, we use the feedback you send and look at how many people visit and use GamerBFF and at overall usage patterns, such as where visitors come from and how many get started, connect a game source, or come back. These are counted as totals, not used to track individuals, and don’t involve third-party analytics or advertising tools. Browser collection respects Do Not Track and Global Privacy Control.
You can also share feedback in the GamerBFF Discord. Anything you post there is visible to other members of the server and is also governed by Discord’s own terms and privacy policy. To send feedback privately, use the in-app feedback form instead.
4. Where information goes
GamerBFF uses service providers only for functions needed to operate the service. Which providers receive information depends on the features you choose and on how this deployment is configured.
- Hosting and storage: site requests pass through configured hosting and security infrastructure, and account and gaming information is stored in the configured application database.
- Sign-in providers: when you choose an external sign-in method, that provider receives the authentication request and returns identity evidence needed to link the sign-in to the correct GamerBFF profile.
- Gaming sources: when you connect or refresh a supported source, that service receives the requested lookup and GamerBFF receives the selected profile or activity information.
- Email delivery: when an alpha invitation or email authentication action is sent, the configured delivery provider receives the destination address and message needed to deliver it.
- AI processing: configured AI providers receive the current message and relevant gaming context for eligible requests. When OpenAI-managed Companion is enabled, OpenAI maintains the conversation and tool loop in a stored Agents session. GamerBFF supplies bounded projections of current gaming records, validates application tools, and commits durable memory only through authenticated application checks. Raw connected-provider payloads and authentication credentials are not included in those projections. Other AI features may use separate bounded request packets.
- Public research: research receives server-resolved public game titles and fixed research topics, platforms, and services. Private profile notes and the personal conversation are not public search queries. Public research results can be cached and reused across profiles; this shared cache is separate from personal conversations and gaming memories. Research sources and limitations appear with the reply.
Those providers process information under their own terms and privacy notices. GamerBFF does not treat a public catalog entry as proof that you own a game or subscribe to a service; user-declared relationships and public catalog provenance remain distinct.
OpenAI-managed Companion
When you create a GamerBFF account, you agree to this Privacy Policy and the Terms of Use. OpenAI-managed Companion stores session messages, relevant gaming context, and tool results in an OpenAI Agents session; Agents sessions are not eligible for Zero Data Retention. OpenAI's Agents data controls describe provider storage. Automatic gaming memory is on by default; you can turn it off in Account anytime. A confirmed receipt identifies each saved update, with review and undo controls. Corrections and undo update GamerBFF's authoritative records; a later reply starts with refreshed provider context when those records have changed.
Steam library sync
When you select a Steam profile, GamerBFF sends its Steam identifier to Valve’s Steam services to request available library and activity information. GamerBFF stores the selected profile identifier, normalized game identifiers, library and playtime evidence, sync history, and refresh settings. Available information depends on the profile’s visibility and the provider’s response. Manual imports and eligible automatic refreshes use the selected profile; you can turn off automatic refresh in Connections.
Deleting Steam imports removes imported Steam library data, Steam-sourced memories, and detailed sync history. It keeps the selected Steam profile and automatic refresh setting, so a future sync can import information again. Disconnecting Steam also removes the selected profile and turns off automatic refresh. A record without the Steam identifier prevents old in-flight imports from restoring disconnected data. A linked Steam sign-in method remains linked; source connections and account sign-in methods are separate. The server’s Steam API credential is not a user credential and is not returned to the browser.
PlayStation public activity
The experimental PlayStation public-profile connector is unofficial and is not affiliated with or endorsed by Sony. With your consent, GamerBFF sends the Online ID you provide to PlayStation services, resolves a stable account identifier, and requests bounded public title and activity information. It stores the Online ID, private stable account identifier, consent and refresh state, and normalized public activity evidence. This evidence does not prove ownership or entitlement, and missing activity does not prove that you did not play a game.
PlayStation scanner credentials remain deployment-only; GamerBFF does not request your PlayStation password or two-factor code. Stable account identifiers and scanner credentials are excluded from normal browser responses and operational telemetry. Manual and eligible automatic refreshes use the saved connection. You can disable automatic refresh or disconnect the profile in Connections.
Nintendo Store play activity
The experimental Nintendo connection is unofficial and is not affiliated with or endorsed by Nintendo. GamerBFF opens Nintendo’s account page for account-owner authorization; Nintendo receives that authorization and subsequent Nintendo Store play-history requests. GamerBFF never asks for, receives, or stores your Nintendo password or two-factor code.
GamerBFF stores a data-protection-encrypted Nintendo session credential, a non-reversible account fingerprint, consent and refresh state, and bounded normalized Nintendo Store title, application-identifier, playtime, and first-played evidence. It validates the Store’s platform, last-played, and recent-activity fields before normalizing play evidence. It obtains short-lived access tokens only in memory to make a request, and does not store them, raw Nintendo responses, or credentials in logs, browser responses, health output, diagnostics, or AI context.
Play activity is evidence of play, not proof of ownership, entitlement, purchase, installation, subscription, or current access. A bounded, return-triggered refresh may obtain a fresh short-lived Store token after at least a day; there is no timer-based polling or inactive-account scan.
Xbox Activity Sync
When you connect a gamertag and start Xbox Activity Sync, GamerBFF sends that gamertag to OpenXBL to resolve the matching Xbox user identifier, then requests provider-reported title history. For a bounded recent set it also requests the Xbox MinutesPlayed statistic by Title ID and service configuration ID. OpenXBL and its upstream Xbox services receive these lookup requests. OpenXBL states that it retains API request logs for usage, billing, and debugging; it and upstream services process information under their own terms and privacy notices.
GamerBFF stores the resolved Xbox user identifier only on that exact user-scoped Xbox connection so later syncs can use the stable identity without repeating the gamertag lookup. It also stores connection-scoped title identity, last-played, device or platform evidence, and known playtime. Replacing or disconnecting that connection, or deleting the account, removes the stored Xbox user identifier with the connection. The deployment's OpenXBL API key stays server-side and is not stored with a user or returned to the browser. Raw OpenXBL responses, API keys, Xbox user identifiers, rate-limit headers, and title-level provider payloads are excluded from browser responses, application logs, health output, diagnostics, and AI context.
Xbox history and device fields are activity evidence only. They do not prove ownership, entitlement, purchase, installation, Game Pass access, current ability to play, a complete library, or the exact device used for a session. In particular, provider-reported Win32 activity can reflect external PC activity. Missing playtime remains unknown rather than becoming zero.
5. Cookies and browser storage
GamerBFF uses essential cookies for authenticated sessions, sign-in safety, and request-forgery protection. New browser recovery records use a 24-hour window; expired records are discarded the next time the app uses browser storage. Older interrupted requests are migrated to that window when browser storage is writable, preserving their request IDs while the outcome is unconfirmed. Confirmed sign-out, a confirmed change of signed-in account or expired session, gaming-data deletion, or account deletion clears the previous profile's browser recovery record and tells other open tabs to clear their private view. An interrupted operation with an unconfirmed outcome keeps its recovery record until confirmation or expiry. Saved conversations remain available through authenticated server history. The browser also caches your selected appearance so the page can paint consistently while the profile preference loads; the profile value remains authoritative. If you dismiss the alpha feedback note, the browser remembers that choice on this device. To count visits as totals, the current browser tab can also remember for up to a day where the visit came from and which steps it has already counted. GamerBFF does not use third-party advertising cookies.
6. Retention, disconnection, and deletion
Personal profile data is kept while your account is active or as needed to provide a feature you chose. In-app notification history expires after 90 days and is removed with the account. You can remove individual memories or gaming-profile data in Gaming Profile, disconnect supported gaming sources or reset source-specific imports in Connections, and permanently delete the entire account in Account.
Raw guided-import and bulk-extraction payloads are not retained as separate Gaming Profile source transcripts. The browser may retain a bounded visible conversation history in the current tab. The server keeps a separate bounded conversation state for continuity: up to eight recent user turns plus small typed references, facts, constraints, and question targets. Older relevant details are condensed, inactive context stops being used after 30 days, and deleting gaming-profile data or the account removes this state. Derived profile records remain separately available to review, correct, export, and delete through the existing Gaming Profile and account controls.
Managed Companion keeps an account-scoped transcript and durable recovery state, limited to 100 conversations and 100 turns per conversation. Starting a new chat retains old chats. Delete chat removes its app transcript and queues deletion of its associated OpenAI sessions; pending deletion remains visible until API removal is confirmed. Deleting gaming data or the account also queues provider-session deletion. Remote cleanup resumes after restarts. OpenAI's physical cleanup may continue after API removal, and provider billing or security records can have separate retention. Opaque cleanup references and de-identified task usage/liability records are retained separately; unknown costs are not treated as zero. Deleting a conversation does not undo Gaming Profile memories saved from it.
A request that remains only on the alpha wait-list is retained for no more than 365 days unless it is invited sooner. Invitation access is retained while needed to honor the invitation and enforce the alpha capacity. You can ask Support to remove a wait-list request before account creation. Complete account deletion also removes the account’s matching alpha invitation record.
Disconnecting a gaming source is separate from removing a sign-in method and separate from deleting your account. A supported source disconnect stops that connection from supplying new information and removes the connection-scoped information identified by the confirmation shown before the action. Shared game-catalog facts are not personal connection data and can remain after a disconnect.
Disconnecting PlayStation stops refreshes and removes the Online ID, stable account identifier, consent details, refresh state, imported public activity, and PlayStation-derived Library projections. An opaque connection and generation tombstone remains to prevent delayed work from restoring deleted data. Shared catalog facts and context you separately supplied can remain.
Disconnecting Nintendo stops future refreshes and removes the encrypted session credential, Nintendo account fingerprint, consent and refresh state, imported activity and audit rows, and Nintendo-derived Library projections. An identifier-free generation tombstone can remain to prevent work already in flight from recreating deleted data; shared catalog facts and context you told GamerBFF can remain.
Disconnecting Xbox Activity Sync cancels queued connection work and removes that connection's resolved Xbox user identifier, accepted Xbox activity, and Library projections. Shared catalog identities and global identifier-free provider admission state can remain.
Complete account deletion removes the profile and user-scoped identity, session, notification, gaming, connection, memory, recommendation, evaluation, and legacy budget records. Managed task accounting is retained without account attribution, and opaque provider deletion references remain until cleanup is confirmed. It can preserve shared game-catalog facts, global service configuration, aggregate operational health, and a short-lived non-public security tombstone used to stop delayed callbacks from recreating a deleted identity. The tombstone contains bounded security fingerprints rather than provider account values and expires automatically.
Account deletion also removes in-app feedback linked to that profile. It does not automatically remove unsigned feedback or messages in the separate support mailbox; contact Support about those records.
7. Your choices
- Choose which sign-in methods and gaming sources to connect.
- Review and remove remembered information and supported imported connections.
- Correct gaming context by telling GamerBFF what changed.
- Export supported gaming-profile information.
- Delete gaming data separately or permanently delete the account.
- Ask Support to remove an alpha wait-list request that has not become an account.
After sign-in, use Gaming Profile to review, correct, remove, or export supported gaming information. Use Connections for gaming-source connections and disconnection. Use Account for sign-in methods, automatic-memory preferences, and account deletion. Automatic gaming memory is on by default and can be turned off in Account anytime; a conversation reply alone does not confirm that an update was saved. If you cannot use a control, see the Support page.
8. Security
GamerBFF uses secure cookies, anti-forgery protection, fresh verification for sensitive account changes, one-use expiring email actions, bounded inputs, and separation between profiles. No service can promise absolute security. Use a unique password and remove sessions or connections you no longer recognize.
9. Children’s privacy
GamerBFF is not directed to children under 13. Do not submit a child's email address to the alpha wait-list or provide GamerBFF with a child's personal information. Additional age or parental-consent requirements can apply where you live.
The alpha is limited to people who are at least 13 years old, or older where the law of their country sets a higher minimum age for agreeing to the processing of personal data (for example, up to 16 in some EU countries), as set out in the Terms of Use.
10. Changes to this policy
We may update this policy as the service changes. The effective date above will change when the policy is revised. Material changes should be explained before they take effect when practical.
11. Contact and privacy requests
For account-access help, privacy requests, security reports, or reproducible technical problems, use the official contact listed on the Support page.
Do not send passwords, sign-in links, session tokens, private provider payloads, or full exports. If you already have access, use Gaming Profile for supported exports, Connections for disconnection, and Account for account deletion when practical.