Privacy

Who handles your data

IndexHub (indexhub.it, account.indexhub.it and the related services) is run by Nicola Sabaini, a private individual, who is the controller. For any question about your data, write to privacy@indexhub.it: we reply within 30 days.

What data, and why

Account (on account.indexhub.it). First name, last name, email address and the confirmation of that address. We don't know your password: we only keep a cryptographic fingerprint of it. If you use a passkey, we keep its public key. To keep your sessions open, we record the date, IP address and browser of each sign-in. We need this to create your account and let you sign in (performance of the contract).

Sign in with Google (optional). If you sign in with Google (the "Google" button on the sign-in page), Google gives us your first name, last name, email address (already confirmed by Google) and profile picture. We don't receive your Google password or any other data from your Google account. We use this data to create your IndexHub account, or to link it to the one you already have with the same email, and from then on it works like any other (performance of the contract). For the sign-in, Google acts as an independent controller under its own privacy policy (policies.google.com/privacy). You can disconnect IndexHub from your Google account settings or by writing to us.

Store. Email address and its confirmation status, language, your library (the games you added and when), download requests, and the consents you gave or withdrew, with the date and the version of the document. If you answer the optional profile questions (how you heard about us, operating system, the device you play on, favourite genres), your answers too. We need this to manage your library, downloads and updates (performance of the contract). We use the optional answers to understand which games to make and for which systems (consent: you can delete them whenever you like). If you play from the launcher with your account signed in, also the achievements you unlock and your best score on the leaderboards of games that have them; if you choose a public name, that name and your scores appear on the leaderboards, visible to everyone (without a public name you only see your own place). They make achievements and leaderboards work (performance of the contract); you can remove the name at any time from the Account page.

Launcher and game usage data. Only if you allow it in the launcher or in the game (consent, which you can withdraw at any time):

• games: start-up, session length, errors and performance;
• play time: which game you start and how long each session lasts;
• installs, updates and uninstalls: outcome, duration, size in MB, speed and error code;
• your computer, at most once a week: operating system and version, processor model with cores and threads, memory in rounded GB, graphics card model, screen resolution and scale, number of connected gamepads, language.

These data are linked to a random identifier of the installation. We link them to your account only if you have also given consent from your account. With these data we store neither IP address nor name, and we never collect your files or the list of installed programs. We use them to fix problems, to learn which computers the games must run well on, and to improve them. We delete them after 90 days; after that only anonymous totals remain (for example how many installations use a given graphics card).

The launcher on your computer. The launcher keeps its settings, the installed games and a copy of the catalogue images on your PC so that it also works offline. The code that keeps you signed in is stored in the system keychain (Windows Credential Manager), never in plain text on disk. Signing out deletes it.

Security. Every request to our servers leaves a log line with the IP address, date, page and outcome, without parameters or tokens. When you sign up, we check that your email address is not a disposable mailbox and that its domain receives mail. The sign-in pages ask your browser for a small proof of computation to keep out automated programs. IP addresses that hammer the services are blocked for an hour. All this is there to protect the accounts and the store (legitimate interest). Logs are kept for 14 days.

Email. We write to you from noreply@indexhub.it only for what your account needs: confirmation codes, password recovery, security alerts. No newsletters, no advertising.

We don't sell or hand over your data. We don't use advertising, profiling or third-party tracking tools.

Where it is stored

On a server dedicated to IndexHub in Milan, Italy (Oracle Cloud Infrastructure). Domain, DNS and email are provided by OVHcloud, in the European Union. These providers process the data only on our behalf and only to run the service. The data does not leave the European Union. If you sign in with Google, the sign-in also goes through Google, which processes that data under its own privacy policy and may do so outside the European Union.

How long we keep it

• Account and store data: as long as the account exists.
• After the account is deleted: store data is deleted immediately; only an anonymous fingerprint remains for 30 days, to stop old sign-ins from being reused.
• Encrypted backups: at most 14 days on the server and 90 days in the separate copy, then they are overwritten.
• Launcher and game usage data: 90 days, then only anonymous totals. Technical logs: 14 days.

How we protect it

Connections always encrypted, passwords never stored in plain text, separate databases and secrets for each service, encrypted backups, limited administrative access. No measure makes a system invulnerable: if a breach put your data at risk, we would notify you as the law requires.

Your rights

You can ask to see your data, correct it, delete it, restrict its use, receive it in a machine-readable format, or object to its use. You can withdraw a consent at any time; this does not affect what was done before. From the Account page you can download, straight away, a file with everything the store knows about you. From there you can also delete your account: your store data goes straight away, your sign-in within a few minutes. For anything else, write to privacy@indexhub.it.

If you think your data is being handled improperly, you can lodge a complaint with the Garante per la protezione dei dati personali (garanteprivacy.it), the Italian data protection authority.

Age

You must be at least 14 to create an account. If you are under 18, you need a parent's permission.

Changes

If this notice changes in an important way, we'll tell you by email before the changes take effect. The date at the top shows the version in force.