Privacy Policy
The short version
- You sign in with Steam. We get your SteamID, public profile name and avatar. Never your Steam password, email, friends list or games.
- We do not ask for your email, real name or any payment information, and we have no advertising, no analytics and no tracking cookies.
- Other signed-in users can see your name and avatar, and which Events you entered. If you win, the organizer sees your SteamID to deliver the prize.
- We keep your IP address and browser details only for your signed-in devices (so you can see and revoke them) and for security.
- You can download all your data and delete your account yourself, from the Account page.
- We do not sell your data and do not share it for advertising.
1. Who is responsible
The controller of your personal data is Goldenapple3619, an individual, [REDACTED], operating MoonReward. Privacy contact: [email protected]. Representative in the EU/UK (where required): Not applicable.
Organizers who deliver prizes also receive some of your data (section 5); they handle it as independent controllers under the Organizer Terms.
2. What we collect, why, and on what legal basis
| Data | What it is and where it comes from | Why | Legal basis (GDPR / UK GDPR) |
|---|---|---|---|
| Steam identity | Your SteamID64, profile name and avatar link, from Steam when you sign in (and refreshed at each sign-in). The name and avatar are your public Steam profile. | To create your account, recognise you, show who entered and won, and let organizers deliver prizes. | Contract (providing the Service you asked for). |
| Account records | Internal user number, role, date you joined, last sign-in, and which version of the Terms you accepted, when, and that you confirmed your age. | To run the account, show your role, prove consent to the Terms, and keep the age rule. | Contract; legitimate interests (keeping a record that you accepted the rules); legal obligation where it applies. |
| Activity | The Events you enter, scores recorded for you in competitions, results, prizes won and their delivery status, notes you write in a prize dispute, and (organizers) the Events you create and their delivery record. | To run Events and draws, make them verifiable, track prizes and settle disputes. | Contract; legitimate interests (fair, checkable draws; resolving disputes). |
| Notifications | Messages the Service sends you about Events, prizes, reports and applications. | To tell you what happened. | Contract. |
| Sessions and devices | For each signed-in device: a random session identifier (stored only as a hash), the IP address and browser/OS description at sign-in, and when it was last used. | To keep you signed in, show you your devices so you can sign them out, and protect your account. | Contract; legitimate interests (security). |
| Security and server logs | IP address, time and result of requests to the Service, and failed or refused sign-ins. Rate limiting uses your IP address, in memory. | To protect the Service from abuse, bots and attacks and to investigate incidents. | Legitimate interests (security and fraud prevention). |
| Reports and moderation | Reports you make or that are made about you (reason, details, status, moderator notes), organizer applications (what you write in them), warnings and bans (SteamID, reason, dates). | To keep the Service fair and safe, review organizer requests, enforce bans and decide appeals. | Legitimate interests (a safe, fair Service; keeping bans effective); legal obligation (handling notices of illegal content). |
| Messages to us | What you write to us by email, with your email address. | To answer you. | Legitimate interests; contract; legal obligation (answering a rights request). |
What we do not collect: your email address (unless you write to us), real name, postal address, phone number, date of birth (you only tick that you are old enough), payment data, precise location, your Steam password or login codes, your friends list, game library or Steam inventory, and no biometric or other sensitive data. We do not use analytics, advertising or tracking tools.
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects. Giveaway winners are drawn at random, which is not a decision about you personally; bans and prize disputes are decided by people. An automatic filter may refuse an Event text that asks entrants to pay; the organizer can edit and resubmit it.
3. Who can see what
- Other signed-in users: your Steam name, avatar and role; your profile (when you joined, number of prizes won and, for organizers, Events organised and delivery record); which Events you entered and your score in competitions, and the results. When you join or leave an Event, signed-in users who have the app open also see it in the live activity feed (name and avatar), and the number of people online is shown. Events, profiles and entrant lists are not visible to people who are not signed in.
- The organizer of an Event you won a prize in: your SteamID and a link to your Steam profile, so they can hand over the prize. In return you can see the organizer’s SteamID.
- Moderators and administrators: your SteamID, role, sign-in dates, reports about you, bans and the history of your activity, as needed for moderation.
- Never shown to other users: your IP address and devices, your notifications, and who reported whom.
4. Who we share data with
- Valve (Steam): when you sign in, Steam authenticates you and tells us your SteamID. We then ask Steam for your public profile (through the Steam Web API or your public profile page). Your browser also loads avatars from Steam’s content servers, which means Valve and its network providers see your IP address when you use the Service. Valve acts under its own privacy policy.
- Our hosting provider, OVH SAS (2 rue Kellermann, 59100 Roubaix, France), which stores the data and runs the servers on our behalf (a processor) under a contract that requires it to protect the data.
- Organizers, as in section 3, only to deliver prizes.
- Authorities and advisers: where the law requires (for example a valid legal request), to establish, exercise or defend legal claims, or to protect people and the Service; and professional advisers bound by confidentiality.
- A successor, if the Service is transferred to another operator; we would tell you and the same protections would apply.
We do not sell your personal data, and we do not share it for cross-context behavioural advertising (as those terms are used in US state privacy laws). We have no advertising partners.
5. Transfers outside your country
Our servers are in Beauharnois (BHS) - Canada. Valve is based in the United States. If your personal data goes to a country without an equivalent level of protection, we rely on the safeguards the law allows, such as the European Commission’s standard contractual clauses or an adequacy decision, and you can ask us for a copy at [email protected]. Organizers and other users may be anywhere in the world: that is how a worldwide service works.
6. How long we keep data
| Data | How long |
|---|---|
| Account and activity | While your account exists. When you delete it, or if you do not sign in for 36 months, your identity is removed (see section 7). |
| Sessions (with IP and browser) | Until the session ends: up to 7 days without use and at most 30 days in total; ended sessions are deleted within a day. Signing out deletes it from your list at once. |
| Notifications | Read ones are deleted after 60 days, all of them after 12 months. |
| Server and security logs | A short rolling period (rotated automatically and overwritten, in principle no more than 30 days), longer only if needed to investigate an incident. |
| Resolved reports | 24 months after they were handled. Open reports until handled. |
| Bans | While the ban is in force, then 24 months after it ends or is lifted. A permanent ban is kept until it is lifted. |
| Organizer applications | 12 months after the decision (deleted at once if you delete your account). |
| Prize delivery log (who handed over what, disputes) | 36 months. |
| Record that you accepted the Terms | As long as the account exists, and afterwards only as part of the anonymised account record. |
| Emails to us | As long as needed to deal with your request, then up to 12 months (longer if a dispute or legal claim is pending). |
7. Your rights, and how to use them
Wherever you live, you can use the controls below. If you are in the EU/EEA, the UK, Brazil, Switzerland or another place whose law gives you data protection rights, you have the rights listed; if you are in California or another US state with a privacy law, you have the equivalent rights to know, access, correct and delete, and not to be discriminated against for using them. We apply them to everyone.
- Access and portability: Account page → Your data → Download my data. You get everything we hold about you as a JSON file (profile, consent history, devices, entries, prizes, reports you filed, applications, notifications, and the count of reports about you).
- Deletion (“right to be forgotten”): Account page → Your data → Delete my account. Immediately, we sign you out everywhere, delete your sessions, notifications and applications, remove you from open Events, and replace your name, avatar and SteamID with a placeholder (“Deleted user”). If you are an organizer with open Events or prizes still to hand over, you must finish or cancel them first. If you still have prizes on the way, deleting means giving them up; we ask you to confirm.
- What stays after deletion: records of finished Events (their entrant list, results and prizes) stay under “Deleted user” so that draws remain verifiable and prize history stays consistent, and a ban record keeps the SteamID it was issued against until its retention period ends, so that a ban cannot be avoided by deleting the account (our legitimate interests). Data we must keep by law stays as long as the law requires. After a deletion we cannot link the remaining records to you.
- Correction: your name and avatar come from Steam; change them there and sign in again to refresh them. For anything else, write to us.
- Restriction and objection: you may ask us to restrict processing, or object to processing based on legitimate interests (security, moderation), on grounds relating to your situation. We will stop unless we have compelling legitimate grounds, or need the data for legal claims.
- Withdrawing agreement: you can stop using the Service and delete your account at any time. We do not rely on consent for processing your data; accepting the Terms is a contract, not consent under data protection law.
- If you cannot sign in (for example because you are banned) or prefer email, write to [email protected]. We may ask you to show you control the Steam account concerned, for example by briefly putting a code we give you in your public profile summary, so that nobody can obtain or delete someone else’s data.
- Timing: we answer within one month (45 days in the US states that give that time), extended only where the law allows and with an explanation. It is free unless a request is manifestly unfounded or excessive. You can use an authorised agent where your law allows.
- Complaints: you can complain to the data protection authority of the country where you live, work, or where you think your rights were violated (in the EU, see the list at edpb.europa.eu; in the UK, the ICO). We would appreciate the chance to fix it first.
8. Children
The Service is for people aged 16 and over, and for younger people over the age of majority only with a parent’s or guardian’s permission (see the Terms). It is not directed to children under 13 and Steam does not allow them. If we learn that someone under 16 has an account, we will delete it. If you think this has happened, tell us.
9. Security
We protect your data with encrypted connections (HTTPS), HttpOnly session cookies, session tokens stored only as hashes, strict origin checks and rate limits, restricted access to the database and administrator functions, and a design that does not collect more than needed. No system is perfectly secure. If a breach is likely to harm you, we will notify you and the authorities as the law requires.
10. Cookies
We use only two strictly necessary cookies, to keep you signed in and to protect the sign-in. No tracking. Details in the Cookie Notice.
11. Changes
If this policy changes, we update the version and date at the top, and for material changes we tell you in the Service before they apply. Previous versions are available on request.
12. Contact
Privacy questions and requests: [email protected]. Postal address: Goldenapple3619, [REDACTED]. Everything else: contact page.