Privacy Policy

imho.run is a Steam-game recommendation service. We collect only what we need to surface relevant picks:

• Steam profile (public data only). If you sign in with Steam or paste a SteamID, we read your public game library and profile via Steam's official Web API. We never see your password, private messages, or anything your Steam privacy settings hide. If your friends list is public, our crawler may read it too: see “Public Steam profiles we read without sign-in” below.
• Recommendation feedback. Likes / dislikes / “already played” that you give us. Tied to your SteamID (signed-in users) or to an anonymous random ID (anonymous Swipe Mode).
• Impression logs. Which recommendations we showed you, in what order. Used to measure model quality offline; not shared with third parties.
• “Can I run it?” hardware. When you use the “Can I run it?” block on a game page, the hardware you pick (graphics card, processor, RAM, operating system — model names only, nothing that identifies you) and the resulting verdict are recorded together with the game, so we can improve the check.
• Standard server logs. Timestamps, status codes, IP-derived country code (for currency / regional pricing). No raw IPs are stored.

Most of the libraries behind our recommendations and statistics belong to people who have never visited imho.run. Our crawler finds public Steam profiles by following public friends lists from profiles it already knows, and reads them through the Steam Web API. If your Steam profile and game details are public, we may hold the data below about you.

• What we store. Your SteamID; your profile name, profile link and avatar links; whether your profile is public and set up; the country on your profile, if you set one; when the account was created; which profile led us to yours; your games with total playtime, playtime in the last two weeks, playtime per operating system, when you last played each one and when we first saw it; your wishlist (the games, their order and when you added them); and your friends list as pairs of SteamIDs with the date we saw each link. We don't collect your real name, even when your profile shows it, and we are deleting the ones collected earlier.
• Where it comes from. Only the Steam Web API, and only what a profile makes public. A private profile, or one whose game details are private or friends-only, gives us nothing to store. Valve's own privacy policy tells Steam users that data on a public profile can be read this way.
• What we use it for. Recommendations (which games tend to be played together) and aggregate statistics such as the audience pages and the Steam Graveyard report. Published statistics are aggregates and never show one person's profile or library. We never contact you through this data and never sell it.
• Legal basis. Legitimate interest (GDPR Art. 6(1)(f)): building recommendations and statistics from data people chose to make public on Steam. You can object at any time, as described below.
• Where it is stored. In our database on a server in Germany (netcup, EU). The crawler that collects it runs on a server in the Czech Republic (EU).
• How long we keep it. For as long as we use it for recommendations and statistics. When we read a profile again, we update what we hold. If you've made your profile private and want the old copy gone, write to us.
• How to object or have it erased. Email [email protected] with your SteamID64 or Steam profile link. Within 30 days we delete the profile, library, wishlist and friend links we hold for that SteamID, plus any site activity tied to it, and put the SteamID on a block list so the crawler never collects it again. The block list holds only the SteamID. The block also stops us storing your library when you or anyone else enters your SteamID on the site; write to us if you want it lifted. Statistics already published are not recomputed on the spot: your data drops out of them at the next rebuild.

To make the recommendations and tools better, we keep a log of how the site is used. It includes:

• What you type. Descriptions you enter on Find a game, and searches in the site's search boxes (game search, the "game you love" box on the mobile games page, the Steam profile lookup). Before storing them we mask email addresses, phone numbers and link parameters, and cut long text at 2,000 characters. Please don't put personal details in these boxes.
• What we showed you and what you did with it. Which games appeared in each list and in what order, which ones you opened, liked, disliked or followed to Steam, and on Find a game which answer you marked as the right one, how long you waited for the answer and whether you left before it arrived.
• An anonymous browser ID. A random ID kept in your browser's local storage, so the events of one visitor can be grouped. It is not linked to your name, email or IP address.
• Your SteamID, if you sign in. Signed-in activity is linked to your SteamID, and so is earlier anonymous activity from the same browser.
• Technical data. Page views, time on page and scroll depth, page-speed measurements (Core Web Vitals) from a sample of visits, JavaScript errors and failed requests with the page they happened on, and a country code that Cloudflare derives from your IP. We don't store IP addresses.
• Watch subscriptions, if you start one. When you ask us to watch for new similar games, we store the games you picked, your filters, the language, and either your Telegram chat ID or your email address, plus a log of which games we sent. An email address is used only for that digest and its confirmation, through our email provider Resend. Unconfirmed sign-ups are deleted after 7 days, and unsubscribing (one tap in any message, or /stop in Telegram) deletes the address.

We use this to see which recommendations actually help people, to test changes to the recommender and to Find a game against real searches, and to find bugs. The log stays with us; the only thing we may share is aggregated statistics, as described under “How we use it”.

If you press “Reject” in the cookie banner, your browser stops sending these events and your Find a game searches are not stored.

Find a game works on the descriptions people type, so this part of the site keeps more than the rest. Here is exactly what happens to yours.

• Your description is stored. We don't ask for your name, email address or phone number, and we don't collect them. We keep the description you type, cut at 2,000 characters, together with the games we showed you, the ones you marked “That's it!” or “Not it”, the links you opened and your answers to the “Narrow it down” question. If your description happens to contain an email address or a phone number, we mask it before storing; from a link we keep only the address and drop its parameters, where login tokens usually sit. There is no fixed deletion date: we keep searches for as long as we use them to improve the search.
• It is used to improve and train the search. We use stored searches to measure and improve Find a game, including training our own search model on descriptions paired with the game that turned out to be right. Before training we remove duplicates, cap the length and use only the masked text.
• The language model. To answer, your description is sent to the language model service that powers Find a game (Ollama Cloud).
• Searching the web (not live yet). We are preparing an optional “Also search the web” button; it is not on the site yet. Once it is, pressing it will send a shortened version of your description (at most 300 characters, masked the same way) to Ollama's web search to look for more candidates. Nothing goes to a web search unless you press it.
• Links that take your description elsewhere. Some buttons open another site with your description already filled in, for example the “Ask ChatGPT / Claude / Perplexity” buttons that some visitors see. The text is shortened and masked the same way, and your browser opens that site directly: we don't send it there ourselves. Some of those sites start answering as soon as the page opens. After a search that found nothing, “Write a post” drafts a post for the r/tipofmyjoystick community on Reddit from your description (and, only if you tick it, the games you marked “Not it”); you can edit it, and “Open on Reddit” opens Reddit's posting page with it. We never post anything for you: nothing appears on Reddit until you press Post there, and once posted it is public. From then on, that site's own privacy policy applies.
• Legal basis. We process searches on the basis of our legitimate interest in running and improving the tool. You can object at any time, as described below.
• How to opt out. Press “Reject” in the cookie banner. From then on your searches are not stored, so they are never used for training, and the web search button will not be offered to you.
• Erasure. Email [email protected] with your SteamID or the anonymous ID shown under “Your choices”. Within 30 days we erase the text of your Find a game searches and mark them so they are never used for training. What a model has already learned cannot be removed for one person, which is why we train only on masked, de-duplicated text.
• A weekly check. Once a week we count, without reading them, how many stored descriptions still contain something that looks like an email address, a phone number, a link, an attempt to give the model instructions, or adult content. It tells us whether the masking works.

ChatGPT, Claude and other assistants can call our public API (imho.run/api/agent/…, also at api.imho.run, and the MCP server at imho.run/mcp). It needs no account and no key. For each call:

• What we log. The tool that was called, REST or MCP, the assistant's family read from the User-Agent header (for example ChatGPT or Claude), the language, the filters, the game we matched and a country code from Cloudflare. This log has no IP address and no request text.
• Rate limits. To limit how often one caller can ask, we keep short-lived counters keyed by the caller's IP address in Redis. Each counter deletes itself when its window ends, at most 24 hours later.
• Describing a game you can't name. Text sent to the find_game_by_description tool is handled like a Find a game search on the site: it is stored in that search log (with email addresses, phone numbers and link parameters masked) and sent to the language model that powers Find a game (Ollama Cloud) to produce the answer.
• Recommendations from your Steam library. If you give an assistant your SteamID or profile link for the library_recs tool, we use it only to read the public library we already hold for that profile. We make no Steam call for it, the call log does not contain the ID, and the answer is cached for 15 minutes under a salted one-way hash of the ID.
• Not linked to you. An assistant call carries no account, cookie or ID of yours, and we don't keep its IP address, so we can't pick out one person's calls to show or delete them. Please don't put personal details in what you ask an assistant to send us.
• Your conversation. Our answers contain only public data about games. We never see the rest of your chat. What the assistant's provider does with your conversation is covered by that provider's privacy policy.
• The “Need more?” form on /developers. Only if you send it and tick the consent box: we store your email address, the message you typed, the page language, the time you gave consent, a salted one-way hash of your IP address (to spot abuse; the address itself is not kept) and your browser's User-Agent. We use it only to reply about API access and to decide what to build. No newsletter and no automatic emails. Write to the contact address below to have it deleted.

We sometimes advertise imho.run on Google Search. To tell whether an ad is worth paying for, we use two things:

• Our own log. If you arrive from a link with campaign tags (utm_source, utm_campaign and the like) or a Google click ID (gclid, gbraid, wbraid), we keep them in your browser's local storage for 30 days and add them to the usage log described above. That lets us count, per campaign, how many visitors used a tool, signed in with Steam or opened a Steam store page. This data stays with us.
• The Google tag (gtag.js). It tells Google Ads when one of these happens: a recommendation list appears after you do something on the page, you mark a Find a game result as the right one, you look up a profile in My Steam in numbers, you sign in with Steam, or you open a game's Steam store page. Google receives the event name and its own identifiers. It does not receive your searches, your SteamID or your library.

In the EEA, the UK and Switzerland the tag starts with every storage and ad signal denied: Google sets no cookies and gets only cookieless pings until you press Accept. Elsewhere it starts allowed. Pressing Reject, here or in the banner, denies everything, and from the next page load the tag is not loaded at all. Google's own handling of this data is described at policies.google.com/privacy.

The imho.run for Steam browser extension is a thin client. It only reads:

• The appid in the URL when you open a Steam store page, so it can ask our API for similar games. That request carries no cookies.
• Your own SteamID — only on your own Steam library page, while you are signed in to Steam. We then import your public Steam library (games and playtime) to work out picks, the same as when you enter your profile on imho.run. On anyone else's profile the extension sends nothing.
• Its settings (which rows are on, the card-count slider, the imho/Steam switch), stored in your browser's chrome.storage.local. They never leave your machine. The extension keeps no client ID and runs no analytics.

The extension does not read your browsing history, other tabs, cookies, form input, passwords, or financial data.

Library + feedback feed the recommender that picks your games. Aggregated, anonymised statistics inform model training. We do not run any advertising network and do not sell personally identifiable data.

Audience pages. For some games we publish aggregated statistics on what else their players play, computed from the public Steam libraries we read. A game gets such a page only when at least 1,000 of its players are in the sample; pairs shared by fewer than 20 players are dropped, and no profile, SteamID or individual library is ever shown. Developers can ask us to take their game's page down at [email protected].

We may share aggregated, anonymised statistics about how recommendations perform — for example, genre uptake rates by region, click-through rates across model versions, or cohort retention — with research or commercial partners. Aggregation is always at the cohort level (50+ users per bucket) and cannot be linked back to an individual account or device. Your individual library, playtime, swipes, or SteamID are never shared with third parties.

We rely on a small set of infrastructure providers:

• Steam Web API (Valve) — to read public Steam profiles, libraries, wishlists and friends lists, including yours when you sign in.
• Cloudflare — DNS, edge caching, DDoS protection.
• Sentry — error tracking (no user data attached to events beyond SteamID for crash attribution).

The browser extension talks directly to api.imho.run and Steam's public storefront API for prices. It does not call any third-party analytics or tracking service.

• Delete your data. Email [email protected] and tell us your SteamID, or the anonymous ID shown below if you never signed in. Within 30 days we will delete your feedback, impressions and event log, and erase the text of your Find a game searches so they are never used for training. If you give us a SteamID, we also delete the Steam profile, library, wishlist and friend links we stored for it and stop collecting them (see “Public Steam profiles we read without sign-in” above).Your anonymous ID in this browser: none yet
• Use anonymously. Anchor mode and the extension's anchor row both work without any account.
• Disable the extension in chrome://extensions (Firefox: about:addons), or turn either row off in the extension popup.

Questions? [email protected].