Dragon Eye
CS Sign in

Privacy

This policy explains what personal data we process in Dragon Eye, why, on what legal basis, who we share it with and what your rights are – in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, GDPR).

1. Controller

The controller of your personal data is Purple Dragon Studios, email info@purpledragonstudios.cz.

2. What personal data we process, why and on what legal basis

2.1 Dragon Eye users

  • Account data: email, name, profile picture and Google account identifier (OpenID Connect sign-in). We store no passwords. Purpose: sign-in and providing the service. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • Your games' data: whatever you connect – Steamworks wishlists and sales, CSV uploads (including ad spend), numbers and posts from YouTube, Instagram, Facebook and TikTok, events you log. Purpose: dashboards, estimates and the weekly summary. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • Team collaboration: workspace memberships and roles, invitations (the invitee's email) and access requests (the email of the owner you send the request to and your message). Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • Emails: the weekly summary (you can turn it off in your profile) and access request notifications. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
  • App usage: which screens you open and when, so we know what is worth building. We send only a pseudonymous identifier and the name of the feature opened from the server to the PostHog product analytics (EU region) – no email, name or game data. Legal basis: our legitimate interest in improving the service (Article 6(1)(f) GDPR).
  • Server logs and a record of important actions in a workspace. Purpose: security and fixing bugs. Legal basis: legitimate interest (Article 6(1)(f) GDPR).

Public Steam data about games (store pages, reviews, player counts) is not personal data.

Providing data is voluntary, but the service cannot be used without a Google account. We make no decisions about you based solely on automated processing (Article 22 GDPR) – the app's recommendations concern your game and the decisions are yours.

2.2 Data we process on behalf of game developers

For this data the controller is the developer of the game concerned; we process it on their behalf (Article 28 GDPR) and only members of their team can see it.

  • Content creators requesting a key: the YouTube channel's name, identifier and numbers (verified by a read-only sign-in – we discard the access token after verification), email and message.
  • Creators in an outreach list that a developer records (name, channel link, email, notes).
  • Testers filling in a developer's survey: their answers. An email address only when the tester enters it and ticks the consent box (Article 6(1)(a) GDPR) – the developer may then use it to invite them to further testing. For rate limiting we store a hash of the IP address, not the address itself. Consent can be withdrawn at any time by writing to the game's developer or to us; we then delete the answer including the email.
  • Public capsule tests: only view and click counts, no personal data.

3. How long we process data

  • Account data and game data for as long as you have an account. Deleting your profile also deletes the workspaces where you are the only owner, with all their data.
  • Disconnecting a source deletes its keys, tokens and the data we downloaded from it.
  • Sent emails are deleted after 90 days.
  • Creator key requests until the game's developer decides on them; tester answers until the survey or the game is deleted, a tester's email at the latest until consent is withdrawn.
  • Data processed on the basis of legitimate interest for as long as that interest lasts or until you object to the processing.

4. Who has access to your data

  • Workspace members according to the role the owner gives them.
  • Processors that help us run the service, under a contract and only to the necessary extent: hosting by WEDOS Internet, a.s. (data centre in the Czech Republic; also email delivery – address and email content), error reporting by Sentry and product analytics by PostHog (EU region), when enabled.
  • If a processor processes data outside the European Economic Area, it does so only with appropriate safeguards under the GDPR (European Commission standard contractual clauses or the EU-US Data Privacy Framework).
  • Public authorities only when the law requires us to.

We do not sell data or use it for advertising. Nothing goes into community benchmarks without your explicit consent. We only download public YouTube data and Czech National Bank rates; we send them nothing about you.

5. Keys and tokens

We store your Steamworks key and network access tokens only encrypted, never send them to the browser or logs, and use them read-only.

6. Google and YouTube data

Dragon Eye uses YouTube API Services. By connecting a channel you agree to the YouTube Terms of Service; the Google Privacy Policy also applies. You can revoke access at any time in your Google account security settings. Dragon Eye's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. After access is revoked we delete downloaded YouTube data within 7 days (immediately when you disconnect in the app).

7. Cookies

Cookies are small files your browser stores when you visit a website. We use only two of our own, strictly necessary for the service to work, so we do not need your consent for them. No analytics or advertising cookies and no third-party scripts.

  • de_session – sign-in, expires after 30 days.
  • de_range – the chart period you chose, expires after 1 year.

8. Your rights

You have the right of access to your data, rectification, erasure, restriction of processing and portability, the right to object to processing based on legitimate interest and the right to withdraw consent at any time (without affecting processing before the withdrawal). You can download all your data with one button and delete your account there too (Profile → Download my data). Send other requests to info@purpledragonstudios.cz with the subject “GDPR”. You also have the right to lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work.

9. Children

Dragon Eye is intended for adults (18 or the age of majority in your country). We do not knowingly process children's personal data; if we find that an account belongs to a child, we delete it.