Legal

Privacy & cookies

Last updated Nov 1, 2026

We collect only what the site needs to work. No ads, no trackers, no analytics.

Who we are

The controller of your personal data is the operator of quietpicnic Good Games, named below:

Full name: Jakub Łepek
Postal address: ul. Pocztowa 8/6, 78-500 Drawsko Pomorskie, Poland
Email: contact@quietpicnic.com

Questions about this notice or your data? Write to contact@quietpicnic.com.

What we collect

Your account: your email address and any earlier ones you confirmed, username, display name and profile picture, when you joined, your sign-in sessions, and your password, which we store only as a salted hash, never in readable form. We strip hidden data, such as location, from pictures you upload.
From Discord or Google, if you sign in with them: your account id, name, email address and profile picture, which we copy to our server when you sign up. The name they share becomes your public display name and username, which you can change on the account page.
What you post: comments, forum threads and replies, bug reports, screenshots and upvotes, with when you posted or edited them. An anonymous comment carries the nickname you choose instead of your account.
Game saves: the save files a browser game sends us, linked to your account or, if you play without one, to a guest identity in your browser.
Reports and moderation: when you report content, what you report and why, and the name and email address you give us; and the moderation decisions of the team, including any suspension of an account.
Messages to us: your email address and what you write when you contact us.
Technical data: your IP address, which every website you visit receives. We use it to fight spam and abuse but never save it in our database: with a comment, guest identity or report we keep only a coded form of it (a hash), for 24 hours. Our server also logs errors and security events, and these logs can include your IP address.

To create an account you must give a username, an email address and a password, or sign in with Discord or Google. Without an account you can still play, save your progress as a guest and comment anonymously.

Why we use your data

Running the site and your account: signing you in, showing your profile and what you post, keeping your saves and votes, and emailing you about your account, such as confirmation and password reset links, or a notice to your old address when your email changes. Legal basis: our contract with you, the terms of service.
Keeping the site safe: stopping spam, abuse and automated sign-ups, limiting repeated requests and sign-in attempts, keeping earlier versions of edited comments in case they are reported, holding a released username for a while so no one can pose as its former owner, keeping the email addresses an account has confirmed so no one else can take them over, limiting how often a username or email address can change, checking new passwords against known leaked passwords, logging errors and security events, and making encrypted backups. Legal basis: our legitimate interest in a safe, working site.
Handling reports and moderation: confirming your report, deciding on it, and telling you and the author of the content what we decided and why, as the EU Digital Services Act requires. Legal basis: our legal obligations.
Recording what you agreed to: which version of the terms of service your account accepted, and when. Legal basis: our legitimate interest in showing which terms apply to your account.
Answering you: replying to your messages and handling requests about your data. Legal basis: our legitimate interest in answering you, or our legal obligation when you use your rights.
Following the law: answering requests from authorities when the law requires us to. Legal basis: our legal obligations.

We do not sell your data, show ads, use analytics or profile you, and software alone never makes decisions about you that significantly affect you.

Everyone sees what you make public: your profile, unless you make it private on the account page, and your comments, forum posts and screenshots. An anonymous comment shows only its nickname. Vote counts and karma are public; who voted is not.
Our service providers host the site, deliver its emails and store its encrypted backups. They act only on our instructions, under data processing agreements.
Discord and Google learn that you signed in to this site when you sign in with them. They act as separate controllers under their own privacy policies.
Valve (Steam) receives your IP address when you play a game trailer, which loads from Steam's servers only after you press play.
The author of reported content learns what we decided and why, but not who reported it, unless that is strictly necessary, for example for a copyright claim.
Authorities, such as the police, a prosecutor or a court, only when the law requires it.

Links to stores and social networks take you to sites with their own privacy policies.

Transfers outside the EEA

Our service providers keep data in the European Economic Area (EEA). Data leaves it only when you sign in with Discord or Google, or play a trailer from Steam. These US companies receive it as separate controllers, under the EU-US Data Privacy Framework or other safeguards they provide.

How long we keep it

Account and profile: Until you delete your account.
Sign-in sessions: Until you sign out, or close the browser if you did not tick Keep me signed in. With it ticked, 7 days, renewed while you use the site, but never more than 30 days.
Comments, forum posts and screenshots: Until you or the team remove them. Removed content is hidden at once and erased 30 days later. A removed comment with replies leaves an empty placeholder that keeps them in place, while a removed forum thread is erased with its replies. If you delete your account, your comments and forum posts stay, shown as from a deleted account, except your screenshot threads, which go at once with their pictures.
Earlier versions of edited comments: 90 days after the edit.
Votes: Until you take the vote back, what you voted for is erased, or you delete your account.
Guest identities and guest saves: Erased after 7 days without activity; anonymous comments stay, no longer linked to any browser. When you sign in, guest saves from your browser move to your account.
IP address hashes: 24 hours.
Content reports: 12 months after our decision; a report that led to an account ban, 12 months after the ban ends or is lifted; an open report until it is decided, even if you delete your account.
Released usernames: 30 days, so no one else can take over a name just given up.
Email addresses you confirmed: As long as your account exists, even after you change your email, so no one else can take over an address that was yours.
Records for rate limits: Upload and vote records for an hour; failed sign-in counts, email changes and confirmation emails for at most 24 hours; username changes for 7 days.
Terms acceptance: As long as your account exists.
Messages to us: As long as needed to deal with them; a request about your rights as long as we may need to show how we handled it.
Emails we send: We keep no copies. Our email delivery provider keeps delivery records only as long as its service needs them.
Server logs: 14 days.
Backups: 30 days, so data erased from the site is gone from every backup within 30 days.

Cookies and browser storage

We use only cookies the site needs to work, and none of them track you. With no advertising or analytics cookies there is nothing to consent to, so there is no cookie banner.

Sign-in cookies keep you signed in, end your session when you close the browser if you did not tick Keep me signed in, and check that a Discord or Google sign-in comes back to the same browser. They last no longer than your session, except one that remembers this browser signed in to your account: set when you sign in or sign up, refreshed while you stay signed in, and kept for 30 days after you last use it, so a flood of wrong passwords from elsewhere cannot keep you out. That one holds an identifier for this browser and one-way codes made from your account and its password, so a new password ends it.
The guest cookie holds a random identifier that links your browser to its guest saves and anonymous comments. It is set only when a game saves or you comment anonymously, and expires after 7 days without activity.
Preference cookies remember the language and colour theme you pick, for a year.
The profile draft cookie keeps changes you have not saved yet on the account page, such as a new display name, so a refresh does not lose them. It is set only when you change your profile without saving, and goes when you save or discard the changes, or after 7 days.

Your browser's storage also keeps the nickname of your last anonymous comment, so the comment form can fill it in; a new profile picture you have not saved yet, which the site clears once the profile draft cookie is gone; and, until you close the tab, the email address you just signed up with, so the confirmation email can be sent again. Games you play in the browser may keep their progress and settings there too.

You can delete cookies and stored data in your browser settings at any time; without the sign-in cookies you cannot stay signed in. Nothing here tracks you across websites, so a Do Not Track signal has nothing to switch off.

Your rights

You have the right to access your data and get a copy of it, to have it corrected or erased, to restrict how we use it, and to receive the data you gave us in a machine-readable format or have it sent to another service. As we are based in the EU, these rights apply wherever you live.

Right to object

Where we rely on our legitimate interests, you can object at any time, on grounds relating to your particular situation. We then stop, unless we show compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims.

To use any of these rights, write to contact@quietpicnic.com, if you can from the email address of your account. It costs nothing, and we answer within one month; for complex requests we may take two more months and will tell you why. We may ask you to confirm that the request comes from you.

You can also delete your account yourself on the account page. That erases it with its saves, profile picture, votes and screenshots; your comments and forum posts stay, shown as from a deleted account, so delete them first if you want them gone. Write to us if you want removed comments and posts, earlier versions of comments or IP hashes erased sooner than the periods above.

If you think we handle your data unlawfully, you can complain to the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or to the data protection authority in the EU or EEA country where you live or work.

Children

You must be 16 or older to create an account or post on the site, and we do not knowingly collect personal data from anyone younger. If you believe a child under 16 has given us personal data, write to us and we will delete it.

Security

We protect your data with encrypted connections (HTTPS), store passwords only as salted hashes, and encrypt backups before they leave our server. Sign-up, sign-in and some other forms may ask your browser to pass a bot check, which runs on our own server and sets no cookies.

Changes to this notice

When we change this notice, we update the date at the top. If a change affects how we use your data, we will tell you on the site or by email before it applies.