Privacy Policy

1. Who processes your data

Deskonsole is responsible for the processing of personal data described in this policy. Questions or requests about your data can be sent to suporte@deskonsole.com.

2. If you don't create an account

Your library, settings, and preferences are stored only on your computer. Organizing and launching your games does not require an account, and none of that data is sent to us.

A few honest caveats, because the app is not entirely offline:

• Update check: even without an account, the app fetches a version file hosted on our infrastructure to find out whether an update is available. Like any request on the internet, this exposes your IP address to our hosting provider. We do not tie that request to your identity or build a profile from it; it exists so you are not left running an outdated or vulnerable version.
• Steam account (manual mode): if you connect your Steam account by entering a SteamID64 and a Steam Web API key, those values are stored encrypted on your own computer (Windows DPAPI, bound to your system user) and are never sent to our servers.
• Steam account (automatic mode): if you sign in through the Steam login window inside the app, your SteamID64 is also stored on our servers, encrypted. It serves a single purpose: keeping your profile up to date (recently played games, total games and playtime) even while Deskonsole is closed. Without it, those numbers only change while the app is open. No Steam password goes through us: the sign-in happens on Steam itself, and Steam hands us neither a password nor an access token. The SteamID64 is a public identifier of your Steam profile; what newly exists on our side is the link between it and your Deskonsole account. This only happens for people who have a Deskonsole account, because that is what identifies whose profile to update. To stop it, disconnect Steam under Settings → Stores: the link is deleted and background updating stops immediately. Deleting your Deskonsole account also deletes the link.
• Game artwork and information: to build your library, the app downloads cover art directly from Steam's CDNs and queries game catalog services, such as RAWG, to fill in missing data. Those connections go from your computer straight to those services without passing through us, and they expose your IP address to them. A catalog lookup also includes the name of the game being looked up. We have no control over what those third parties record; their privacy policies govern those connections.
• Launcher installers: if you ask Deskonsole to install a launcher (Steam, Epic, GOG, Battle.net, EA, Ubisoft, or Rockstar), the download comes straight from that vendor's official site, not from us.

Inside the app, the deals store and the social features require an account; without signing in, it does not make those requests. The store open on the website is a different story, described in section 3.

3. The deskonsole.com website

Two pages on the website do more than show text, and each handles data differently.

Store (deskonsole.com/loja): open to any visitor, with no account and nothing to install. Every price lookup goes through our proxy, which applies a per-IP-address request limit to prevent abuse of our IsThereAnyDeal API key. For that, your IP address is recorded for up to 7 days, and nothing beyond it: we do not build a browsing history or a visitor profile. The lookup result is cached on our server for a while, so the same question is not asked of IsThereAnyDeal again, but with no link to who asked it. The legal basis is legitimate interest (art. 7, IX). The purchase itself happens on the destination store, under its own rules; your payment details never pass through us.

Profile (deskonsole.com/perfil): requires the same Deskonsole account used in the app, and shows the data that already exists in it, described in section 4. The site reads only your own profile, and nothing shown there is created or collected by the site. When you sign in, the browser keeps your session in its own local storage, because otherwise you would have to type your password on every page; signing out erases that session. We use no advertising or analytics cookies on any page.

The site is hosted on Cloudflare, which sees the IP address of every visitor, as happens on any visit to any website.

4. Data we collect when you create an account

Creating an account is required to use friends, chat, and the store inside the app. When you create an account, we collect:

• Registration data: email, username, display name, and password (stored hashed, never in plain text);
• Profile and presence: your avatar (if you upload one), bio, pronouns, and custom status you fill in, plus a presence indicator and last-seen timestamp;
• Game activity: the game you are currently playing, your recently played list, and your activity feed. Because these are part of the social features, they are visible to other users according to your profile's permissions;
• Wishlist: the games you flag to track prices, synced so they are available on your other devices;
• Social activity: your friends list, direct and channel messages, and reports and blocks you file;
• Purchase data: if you buy a license, we record the email used for the purchase and the transaction identifiers generated by Stripe. We never receive or store your card details;
• Security data and access logs: logs of events such as login, report, and block actions, and your IP address together with the date and time of access. Beyond limiting abuse, preventing spam, and validating CAPTCHA, this access log is required by article 15 of Brazil's Marco Civil da Internet and is what allows the author of a piece of content to be identified when a court orders it;
• Communications: emails we exchange with you (e.g., license notices or support).

5. Hardware telemetry (optional)

Settings includes a hardware telemetry option. It is off by default and is only enabled if you choose to enable it. When active, the app records CPU and GPU model, amount of RAM, operating system version, and performance samples (FPS).

Today that data stays on your computer only and is not sent to us. Our intent is to use it in the future in aggregated, anonymous form, unlinked from your account, to understand which hardware Deskonsole runs poorly on. If and when that upload starts to exist, we will update this policy before enabling it. You can turn telemetry off at any time without losing any other functionality.

6. How we use this data

• Authenticate your account and maintain your session;
• Enable friends, chat, presence, and other social features you choose to use;
• Sync your wishlist and recently played games across your devices;
• Deliver, validate, and support purchased licenses;
• Moderate the community: review reports, apply blocks, and suspend accounts that violate our Terms of Use;
• Prevent abuse, fraud, and automated misuse (rate limiting, CAPTCHA, account enumeration detection);
• Send operational communications, such as confirmations and account notices.

7. The legal basis for processing

Brazil's LGPD requires a legal basis for each purpose. Ours are:

• Performance of a contract (art. 7, V): creating and authenticating your account, enabling the features you asked to use, delivering and validating purchased licenses;
• Consent (art. 7, I): hardware telemetry, which is optional, off by default, and can be withdrawn at any time;
• Legitimate interest (art. 7, IX): preventing fraud, abuse, and spam (security logs, rate limits, and CAPTCHA) and the update check, which protects you from running an outdated version;
• Compliance with a legal obligation (art. 7, II): keeping access logs for 6 months, as required by article 15 of the Marco Civil da Internet, and responding to orders from competent authorities.

8. Who we share data with

We do not sell your personal data. We share data only with service providers that operate Deskonsole's infrastructure, to the extent necessary:

• Supabase: database, authentication, and backend hosting;
• Cloudflare: hosting for the website and support panel, plus the CAPTCHA (Turnstile) used to protect sign-up and login;
• Stripe: payment processing. We do not sell anything yet, so none of your data has ever been sent to it. If paid features are offered, your payment details will be provided directly to Stripe and will never pass through us; in return we will receive only the purchase email and the transaction identifiers;
• Resend: delivery of transactional email, such as sending your license key.

To display game prices, artwork, and information in the store, we query third-party APIs (Steam, IsThereAnyDeal, RAWG, and HowLongToBeat) through our own proxy, used both by people signed in to the app and by anyone opening the website store without an account. The proxy uses our own API credentials, and these lookups do not send your personal data to those services.

9. International data transfers

The providers listed above (Supabase, Cloudflare, Stripe, and Resend) operate servers outside Brazil, primarily in the United States and the European Union. This means your account data is stored and processed abroad, which the LGPD permits (art. 33), relying on the contractual clauses and protection safeguards those providers offer. By using features that require an account, you acknowledge that transfer.

10. Retention and deletion

We keep your account data for as long as your account exists. You can delete your account at any time from the app itself, under Settings > Account > Delete account. The account is deactivated immediately and permanently deleted after 30 days; signing in before that cancels the deletion. That window exists to protect you from an accidental deletion, or one made by someone who took over your account. If you prefer, we also handle the request at suporte@deskonsole.com.

Two things do not disappear with the account, and it is only fair you know before deciding. The messages you sent stay visible to the people you talked to, because the conversation is theirs too, but your name is no longer attached to them. And for the 6 months set by article 15 of the Marco Civil da Internet, we keep the information linking those messages to an identifier, so that we can answer a court order if one arrives. After that period, that link is erased and the anonymization becomes permanent.

Security logs may be retained for an additional period for fraud and abuse prevention, and purchase records may be kept for the period required by tax law.

Access logs (IP address, date, and time) are kept for 6 months and deleted afterwards. That period comes from article 15 of Brazil's Marco Civil da Internet. Because it is a legal obligation, these records are preserved for the full period even if you delete your account before it ends, which the LGPD permits under article 16, I.

11. Your rights

Under Brazil's General Data Protection Law (LGPD), you may request at any time:

• Confirmation that we process your data, and access to it;
• Correction of incomplete, inaccurate, or outdated data;
• Deletion of your data, subject to the retention described above;
• Portability of your data to another provider, where applicable;
• Information about who we share your data with;
• Withdrawal of the consent given to optional telemetry, without affecting the rest of the app;
• Objection to processing carried out on the basis of legitimate interest.

Requests can be made at suporte@deskonsole.com.

12. Children and adolescents

Deskonsole is not directed at children. Under Brazilian law, a child is anyone under 12, and the LGPD (art. 14, §1) requires specific, prominent consent from at least one parent or legal guardian to process data in that age range. We do not offer such a consent flow, so we do not create accounts for children and do not knowingly collect their data.

Data belonging to adolescents is processed in the data subject's best interest, as the same article requires. If you are a parent or guardian and find that a child has created an account, write to suporte@deskonsole.com and we will remove the account and associated data.

13. Changes to this policy

We may update this policy as Deskonsole evolves. Material changes will be communicated through the app or by email.

14. Contact

Questions about this policy? Write to suporte@deskonsole.com.