Privacy Policy
SubSort collects minimal personal information for its login and game tracking features. This policy explains what we collect, why, how long we keep it, and how to delete it.
1. Information We Collect
SubSort collects the following personal information to provide login and game tracking features:
Account Information (at login)
- Email Address: Account authentication and service provision (Google account or email magic link)
- Name and Profile Picture: For account display (provided by Google when you sign in with a Google account)
This information is a snapshot of what Google provided at sign-up, and no password is collected (passwordless login).
Service Usage Information
- Game Tracking: Information you mark yourself, such as to-play, playing, and completed status or ratings (for personalized curation)
- Filter and View Preferences: Game list filter, sort, and display settings saved to your account (for UI state restoration)
- Play Receipt Settings: which games go on each month’s receipt, the receipt’s currency, and prices entered by the user for individual games (used to build the receipt; not a record of actual purchases)
- Profile Settings: your account avatar (the picture shown for your account, chosen from a set we provide; you do not upload an image)
- Shared Play Receipts: a copy of the receipt for each month you share — games, ratings, tags, prices (including the receipt currency and prices you entered yourself), and the month (created so you can share it by link; anyone with the link can view it, and it does not appear in search results. Sharing the same month again replaces it with the receipt as of that moment)
Legal basis: Account information is processed to provide the service (performance of a contract); game tracking, filter settings, play receipt settings, and profile settings are processed on the basis of our legitimate interest in personalized curation and service operation; shared play receipts are processed to provide the sharing you request (performance of a contract).
2. Automatically Collected Information
The following information may be automatically collected for service operation:
- Access Logs: IP address, access time, browser information (automatically collected by Firebase and Vercel)
- Device Information: Operating system, screen resolution, language settings
- Essential Cookies: Language preference storage (using cookies, valid for 1 year)
- UI Preferences: Theme (light/dark) and game list filter/sort settings (using localStorage, stored per device)
- Security and Technical Data: IP address, email, and account identifier used to prevent abuse of login email delivery and of creating and deleting share links. Based on legitimate interest, this data is retained briefly (up to 2 days) and then automatically discarded. It is not used for behavioral tracking.
- Login Security Records: Sign-in and sign-out times and the authentication method used (Google account or email magic link) are recorded in your account. The purpose is account security and detecting unusual activity. These records are automatically deleted after 90 days, and are deleted together with your account when you delete it.
- Error Diagnostic Records: When a service error or unusual condition occurs, the time, path, and error details are recorded in SubSort's own storage. An account identifier may be included where necessary to determine the cause (email addresses and IP addresses are not recorded). These records are automatically deleted after 90 days.
Note: Automatically collected information is used only for service operation, security, and error investigation, and is never used for advertising or behavioral tracking. Access logs, security records, and error diagnostic records are processed on the basis of our legitimate interest in the stable and secure operation of the service.
3. Web Analytics (Service Improvement)
This service uses Umami Analytics to understand how the service is being used. It is a cookieless analytics solution that operates without consent banners.
Data Collected
- Aggregated page views
- General device/browser statistics
- Screen resolution
- Aggregated geographic information (city level)
- Referrer information
- In-service feature usage
Data Not Collected
- No analytics cookies are installed
- IP addresses are not stored
- Individual browsing history is not tracked
- No device fingerprinting is performed
- No cross-site tracking is performed
- No personally identifiable data is collected
All analytics data is aggregated and anonymized, and cannot be used to identify any individual. Data is processed on Umami servers in the United States. In addition, because SubSort does not track users, it does not respond separately to browser 'Do Not Track (DNT)' signals.
4. Data Retention and Deletion
The retention period and deletion method for collected personal information are as follows:
Retention Period
Account information and service usage information are retained until you delete your account (for shared play receipts, see below), and are immediately destroyed upon deletion. Security and technical data is automatically discarded within 2 days, and login security records and error diagnostic records within 90 days.
Shared play receipts are automatically deleted one year after the link was first created. Sharing the same month again, even with changed content, does not extend this period. If you delete a link from the account menu, the receipt content is deleted immediately, and only a record used to tell visitors that the link was deleted (link address, account identifier, month, and share and deletion times) is kept for 30 days and then automatically deleted. Link previews already shown in messengers, social media, or other services are stored by those services, so SubSort cannot recall them.
Right to Erasure (Account Deletion)
You can delete your account directly at any time from the account menu. Upon deletion, your account information, game tracking, settings, and shared play receipts (including records of deleted links) are immediately and permanently deleted and cannot be recovered (no grace period). However, to evidence that the deletion request was carried out and to prevent abuse, only a deletion record (account identifier, authentication method, outcome, and time) is retained for 90 days and then automatically deleted; your email address, name, and profile picture are not retained. For deletion-related inquiries, please contact contact@subsort.gg.
5. Your Rights
You may exercise the following rights regarding your personal information:
- Access: Access your personal information and request a copy
- Rectification: Correct inaccurate personal information
- Erasure and Restriction: Delete your personal information or restrict its processing
You can delete your account information directly from the account menu (see 'Data Retention and Deletion' above). For other access, rectification, or restriction requests, contact contact@subsort.gg and we will respond to the extent required by applicable law.
You have the right to lodge a complaint with, or request dispute mediation from, the data protection authority in your country or region of residence.
6. Information We Do Not Collect
SubSort does not collect the following information:
- Passwords: Only passwordless login (Google, magic link) is used
- Payment Information: No paid services
- Platform Play History: No direct integration with Xbox or PlayStation accounts
- Location and Biometric Data: No precise location (e.g., GPS) or biometric data such as fingerprints or facial recognition (anonymized, approximate regional data is described under Web Analytics above)
7. External Services and International Transfers
This service uses the following external services, and their respective privacy policies apply:
Google Firebase (Authentication and Data Storage)
Login authentication and hosting/storage of account and game data. When you sign in with a Google account, the email, name, and profile picture provided by Google are used solely for account authentication and display. Firebase may automatically collect IP addresses, access logs, etc.
Privacy Policy: firebase.google.com/support/privacy
Vercel (Web Hosting)
Website hosting and deployment. Vercel may automatically collect server logs (IP addresses, access times, etc.). Login email requests and play receipt sharing (reading the game tracking and receipt settings of the month you share to create the copy, and caching shared receipt pages to display them) are also processed on Vercel servers (United States).
Privacy Policy: vercel.com/legal/privacy-policy
Upstash (Security — Rate Limiting)
A rate-limit store used to prevent abuse of login email delivery and of creating and deleting share links. For login emails it keeps IP addresses and email, and for share links the account identifier and IP address, briefly (up to 2 days; up to 2 hours for the IP address of share links) and then automatically discards them. It is not used for behavioral tracking.
Privacy Policy: upstash.com/trust/privacy
Resend (Email Delivery)
Used to send login links (magic links) and account-related notification emails. Your email address is processed for delivery.
Privacy Policy: resend.com/legal/privacy-policy
IGDB (Game Cover Images)
Game cover images are loaded directly from IGDB (Twitch Interactive, an Amazon subsidiary) servers. When loading images, your IP address, browser information, and other data may be transmitted to their servers.
Privacy Policy: twitch.tv/p/en/legal/privacy-notice
Umami Analytics (Web Analytics)
A privacy-focused web analytics service that does not use cookies. Only aggregated data (page views, browser type, country, etc.) that cannot identify individuals is processed. IP addresses are not stored and are immediately discarded after hashing.
Privacy Policy: umami.is/privacy
Data Processing Location: United States (Umami Software Inc., San Francisco)
Ko-fi (Donation Platform, English and Japanese Locales)
The donation link on English and Japanese pages redirects you to Ko-fi, an external service. Payment information and personal data during the donation process are handled by Ko-fi and its payment providers (PayPal, Stripe). SubSort does not collect or store any of this information.
Privacy Policy: more.ko-fi.com/privacy
Littly (Donation Platform, Korean Locale)
The donation link on Korean-locale pages redirects you to Littly (litt.ly), an external service. Payment information and personal data during the donation process are handled by Littly and its payment providers (KakaoPay, Naver Pay, Toss Pay, etc.). SubSort does not collect or store any of this information. Littly pages include a subscription feature provided by the platform, through which your email address may be collected. Collected information is processed according to Littly's privacy policy.
Privacy Policy: litt.ly/privacy
Note: SubSort has limited access to data collected by these services, and such data is managed according to each service's privacy policy.
International Transfers of Personal Information
To provide the service, SubSort transfers personal information overseas (processing, entrustment, and storage) as set out below. Transfers occur over the network at the time you use the service.
Google (Firebase)
Data transferred: Email, name, profile picture, access IP and logs
Country: United States (authentication data), Republic of Korea (service data)
Purpose & retention: Account authentication and data storage / until account deletion (fully deleted from the processor's backups within up to 180 days)
Contact: support.google.com/policies
Vercel Inc.
Data transferred: Access IP, server logs, email for login email requests, shared play receipts (including the game tracking and receipt settings read to create them)
Country: United States
Purpose & retention: Web hosting and security, processing login email requests, creating and displaying shared receipts / server logs retained short-term; data used to process requests is not retained afterward; shared receipt caches are kept while the link is live (invalidated right away on deletion and usually replaced by a notice within seconds; after expiry, replaced at the next daily refresh)
Contact: privacy@vercel.com
Upstash
Data transferred: Email, access IP, account identifier
Country: United States
Purpose & retention: Rate-limiting login email delivery and share link creation and deletion (abuse prevention) / up to 2 days (up to 2 hours for the IP of share links)
Contact: privacy@upstash.com
Resend (Plus Five Five, Inc.)
Data transferred: Email
Country: United States
Purpose & retention: Sending login and notification emails / for the period necessary to process delivery
Contact: support@resend.com
You may refuse the international transfer of your personal information. However, because these transfers are essential to providing the service, refusing will limit your use of member features (login and game tracking); you can stop the transfers by deleting your account.
Where the personal information of users in the European Economic Area (EEA) or the United Kingdom is transferred to the United States, such transfers rely on the EU-US Data Privacy Framework (DPF) certification or Standard Contractual Clauses (SCC).
8. Security Measures
SubSort takes the following measures to keep your personal information secure:
- Encryption in transit: HTTPS (TLS) and HSTS across the entire service
- Passwordless authentication: Only Google login and email magic links are used, so no password is stored; re-authentication is required for sensitive actions such as account deletion
- Access control: Server security rules restrict access to your own account data, and administrative privileges are used only on the server side. Shared play receipt copies cannot be read or modified directly by anyone; the server reads them and displays them only as the public page
- Security records: Security events such as sign-in and sign-out are recorded in a tamper-evident form
- Encryption at rest: Stored data is encrypted by default
SubSort processes some personal information on overseas cloud services; the countries of processing and the recipients are described under 'External Services and International Transfers' above.
9. Contact and Policy Changes
If you have any questions about this privacy policy, please contact us below:
Data Protection Officer: SubSort operator
Email: contact@subsort.gg
Changes to this policy: If this privacy policy changes, we will update this page and change the Last Modified date in the Addendum below. For features that process data only when you use them yourself, such as sharing a play receipt, we also explain what is made public and retained on the screen where you use the feature.
Addendum
Last Modified: October 3, 2026