Privacy policy
What GoffMeta keeps about you, why, for how long, who sees it, and how to have it corrected or deleted.
Who is responsible
The data controller for GoffMeta is the private individual who runs it as a non-commercial fan site. GoffMeta is not a company, so it has no registered business address or registration number; every request is handled by email.
You can reach us about your personal data at privacy@goffmeta.com. This notice is given under Article 10 of Law No. 6698 on the Protection of Personal Data (KVKK) and, for users in the European Union, under Articles 13 and 14 of the General Data Protection Regulation (GDPR).
Users in the European Union exercise their GDPR rights through the same address. Where Article 27 of the GDPR requires us to appoint a representative in the Union, we will appoint one and name it on this page.
What we keep
We keep only what the features you use need. The table lists every kind of personal data the service stores.
| Kind | What exactly | Where it comes from |
|---|---|---|
| Account | Email address, username, password (stored only as a one-way hash), date of birth, that you accepted the terms, account language, sign-up date, two-factor settings (the secret and recovery codes are encrypted) | You, when you sign up or change your settings |
| Profile | Display name, bio, avatar, banner, location, website, the gaming handles you add (Twitch, YouTube, Discord, X, Steam, Riot ID, Battle.net, PSN, Xbox), favourite genres and platforms, languages, time zone, the hours you play, voice chat, looking-for-group status, profile colours, your privacy choices, when you were last online | You |
| Linked accounts | Which platform (Discord, Twitch, Steam, Riot Games, Battle.net), your account ID and name there, your avatar, and the platform's access tokens (encrypted) | You and the platform, when you link it |
| Steam playtime | The name and hours of the Steam games you played for at least an hour, read only when you ask. See Steam playtime | Steam, when you press the read button |
| Library and activity | Games in your library, their status, play sessions and notes, your lists, ratings, reviews, saves and votes | You |
| What you publish |
Account
- What exactly
- Email address, username, password (stored only as a one-way hash), date of birth, that you accepted the terms, account language, sign-up date, two-factor settings (the secret and recovery codes are encrypted)
- Where it comes from
- You, when you sign up or change your settings
Profile
- What exactly
- Display name, bio, avatar, banner, location, website, the gaming handles you add (Twitch, YouTube, Discord, X, Steam, Riot ID, Battle.net, PSN, Xbox), favourite genres and platforms, languages, time zone, the hours you play, voice chat, looking-for-group status, profile colours, your privacy choices, when you were last online
- Where it comes from
- You
Linked accounts
- What exactly
- Which platform (Discord, Twitch, Steam, Riot Games, Battle.net), your account ID and name there, your avatar, and the platform's access tokens (encrypted)
- Where it comes from
- You and the platform, when you link it
Steam playtime
- What exactly
- The name and hours of the Steam games you played for at least an hour, read only when you ask. See Steam playtime
- Where it comes from
- Steam, when you press the read button
Library and activity
- What exactly
- Games in your library, their status, play sessions and notes, your lists, ratings, reviews, saves and votes
- Where it comes from
We do not ask for your real name, and we do not collect payment details: nothing on GoffMeta is paid today. A guild's treasury records what its staff declare; it moves no in-game items and no money.
Steam playtime
When you link Steam, we receive your Steam ID from Steam's sign-in. Linking alone reads nothing else.
Your Steam library is read only when you press “Read my Steam library” or “Read again” on the connections page. Nothing reads it in the background. From that read we keep, for each game you played for at least an hour: Steam's app ID, the game's name, your total hours, the matching game in our catalogue if there is one, and when it was read. We also keep when you last read it and how many games were kept. We do not read your friends, achievements or anything else from Steam.
Every game read is hidden until you turn it on, one game at a time; turning a game on is your explicit consent to show it, and turning it off withdraws that consent. A game you turn on is shown to people who can see your profile, on the looking-for-group board (up to three), and to a guild's owner and moderators while your application to that guild is pending (up to three). Hidden games are seen by you alone.
We keep the data until you press “Remove my Steam games”, unlink Steam, or delete your account. Removing your games or unlinking Steam deletes all of it at once; deleting your account deletes it with the rest of your account data. No copy is kept elsewhere. It is stored on our servers in Germany (Frankfurt, European Union).
Steam data comes from Valve Corporation, whose own privacy policy covers what Steam does with it. Steam and the Steam logo are trademarks and/or registered trademarks of Valve Corporation in the U.S. and/or other countries.
Why we use it
| Purpose | Legal ground |
|---|---|
| Creating and running your account, and providing the features you use: profiles, guilds, guild applications, events, treasury records, builds, guides, messages | Necessary to set up and perform the contract between us (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) |
| Sending the emails you asked for: sign-in codes, security notices, the notifications and digests you turned on | Performance of the contract (KVKK Art. 5/2-c; GDPR Art. 6(1)(b)) |
| Showing the Steam games you choose to show | Your explicit consent, given game by game when you turn one on and withdrawn when you turn it off, remove your Steam games or unlink Steam (KVKK Art. 5/1; GDPR Art. 6(1)(a)) |
| Keeping accounts safe: sessions, the security log, sign-in risk checks, rate limits, preventing abuse and spam | Our legitimate interest in a secure service, which does not override your rights (KVKK Art. 5/2-f; GDPR Art. 6(1)(f)) |
| Moderating what is published and answering reports and takedown notices | Our legitimate interest, and our obligations under Law No. 5651 (KVKK Art. 5/2-f and 5/2-ç; GDPR Art. 6(1)(f) and (c)) |
Who sees it
- Other people on GoffMeta, as your privacy settings allow. Your profile, published content and shown Steam games follow the switches on your privacy and connections pages.
- A guild's owner and moderators see your application and answers while it is pending. Only the guild's active members see its treasury, and only staff see every member's dues status; a member sees their own.
- A guild's Discord server, when its staff have connected one: the bot may give you the guild's roles through your linked Discord account and announce applications, approvals and rejections by your username in the guild's channel.
- Our service providers, who process data only on our instructions and under a written contract: hosting by DigitalOcean, LLC (Germany (Frankfurt, European Union)) and email delivery by Twilio SendGrid (the United States). Any error-monitoring service we use receives only technical error reports, from which application answers, passwords and tokens are removed.
- Google, if you allow analytics: Google Analytics receives the visit data described on the cookie page and processes it for us as a processor.
- The platforms you link (Valve, Discord, Twitch, Riot Games, Blizzard) receive the sign-in request you start. We never post anything on your behalf.
- Courts and authorities, when the law requires us to answer them.
Transfers abroad
Our servers are hosted by DigitalOcean, LLC in Germany (Frankfurt, European Union), and our emails are sent through Twilio SendGrid in the United States. Where a provider is outside Türkiye, using the service transfers your personal data to that country.
We make these transfers under Article 9 of the KVKK as amended in 2024 (Law No. 7499). Where the Personal Data Protection Board has decided that the country offers adequate protection, we rely on that decision. Where it has not, we sign with the provider the standard contract published by the Board and notify it to the Personal Data Protection Authority within five business days of signing. For users in the European Union, transfers outside the European Economic Area rely on an adequacy decision of the European Commission or on its standard contractual clauses (GDPR Chapter V).
Occasional transfers that these safeguards do not cover are made under Article 9/6 of the KVKK. Loading a YouTube or Twitch player sends data to providers based in the United States only on your explicit consent, given after being told that the country may not protect data to the same standard. Google Analytics also sends visit data to Google in the United States only on your explicit consent, given after being told that the country may not protect data to the same standard. When you link Valve, Discord, Twitch, Riot Games or Blizzard, the sign-in you start with them is a transfer necessary for the service you asked for.
How long we keep it
| Data | Kept until |
|---|---|
| Account and profile | You delete your account. The deletion takes effect at once: every session ends; your profile, linked accounts, library and lists, the records of who you follow and who follows you, blocks, profile visits, guild memberships and applications, event attendance and badges are deleted; and your username becomes free for others to register. Your avatar, your banner, the images of your posts and the other items the rows below name are destroyed by the daily destruction run a week after the deletion, so everything is done within 30 days at the latest. Only what the law requires us to keep for longer (the rows below) remains. |
| Content you published | Builds, tier lists, guides and wiki pages, with their revision history, stay after you delete your account, without your name on them. Comments you wrote stay under an anonymised account that has no public name, and are shown as “Former member”. Your posts and polls, your clips, and your likes, votes, ratings and saves are deleted. Mentions of your former username in other people's writing are their text and are not changed, but the username no longer leads to anyone. |
| Direct messages | The messages you sent are deleted when you delete your account. A conversation stays visible to the other participant without your messages, and you appear in it as “Former member”. A conversation left with no messages is deleted. |
| Steam playtime | You remove your Steam games, unlink Steam or delete your account, whichever comes first. |
Your rights
Under Article 11 of the KVKK you may ask us whether your personal data is processed; request information about it; learn why it is processed and whether that is in line with the purpose; learn who it is transferred to in Türkiye or abroad; have incomplete or wrong data corrected; have it deleted or destroyed; have those corrections and deletions passed on to recipients; object to a result against you that comes from automated analysis alone; and claim compensation for damage caused by unlawful processing.
Under the GDPR you also have the rights of access, rectification, erasure, restriction, data portability and objection, and you may withdraw consent at any time without affecting what was done before.
- Download everything the account holds about you, and delete your account, from Settings → Account.
- Choose what others see on Settings → Privacy, and which Steam games are shown on Settings → Connections.
- See and end your sessions on Settings → Sessions.
- Anything else: apply by email from the address registered to your account to privacy@goffmeta.com. Tell us who you are and what you ask for. We answer within 30 days at the latest and free of charge.
If we refuse your application, answer late or answer insufficiently, you may complain to the Personal Data Protection Board within 30 days of learning our answer, and in any case within 60 days of your application (KVKK Art. 14). In the European Union you may also complain to the data protection authority where you live.
Age
GoffMeta is for people aged 15 and over. We ask for your date of birth when you sign up, by email or through a linked platform, and refuse registration under that age. If we learn that an account belongs to someone younger, we close it and delete its data.
Law No. 7578 requires platforms to verify their users' age. We will apply the verification method that law and its implementing regulation prescribe, from the date they require it, and may then ask existing accounts to verify their age as well.
How we protect it
We take the technical and administrative measures Article 12 of the KVKK and Article 32 of the GDPR require. Passwords are stored only as one-way hashes. Platform access tokens and two-factor secrets are encrypted. Connections to the site are encrypted. The cookie that keeps you signed in cannot be read by the page's scripts and is sent only to our API. Access to the servers is limited to the people who run them, and application answers and credentials are kept out of error reports. You can turn on two-factor sign-in on Settings → Security.
If personal data is obtained by others unlawfully, we notify the Personal Data Protection Board within 72 hours and the people concerned as soon as possible.
Cookies
We use the cookies and browser storage the site needs, including the language and theme you pick, which need no consent. Google Analytics and the video players from YouTube and Twitch load only with your explicit consent. The full list and your choice are on the cookie page.
Changes to this policy
When we change this notice, we publish the new text on this page with its date. We announce a change that affects you on the site, and by email to account holders, before it takes effect. Where a change needs your consent, we ask for it again.