Privacy.

Loan Forneris, sole trader operating under the trade name Shypiard, 70 avenue des États-Unis, 63300 Thiers, France (SIREN 106 490 451). For any question about your data: contact@shypiard.com.

• Diagnostic: game name, Steam URL, genre, launch window, wishlists, marketing budget, goals, current strategy, email, optional attachments.
• Creator application: handle, channel link, genres covered, subscribers, publishing frequency, email, optional message.
• Game submission: title, studio, Steam ID, email.
• Page claim: the studio's work email and the game concerned.
• Field Report: email address and proof of the confirmation click.

Why

Answering your request: a written diagnostic within 48 hours, a channel review within 72 hours, adding or claiming a game page. Field Report: sending the monthly newsletter.

Legal basis

Steps taken at your request before a contract. Field Report: your consent, confirmed by a second click.

Kept for

Three years after the last contact. Field Report: until you unsubscribe; the address then stays on a suppression list so nothing more is sent.

Email address, password (stored hashed by the authentication service, never in plain text), studio name, display name, invited members, followed games, data you import (a Steamworks wishlist export, for example), prepared actions and software usage history.

Why

Providing the software: reading your Steam pages and the market around them, preparing your actions, sending account emails (sign-in, weekly summary, usage tips).

Legal basis

Performance of the contract. Tip emails rely on our legitimate interest and can be turned off from any of them.

Kept for

As long as the account is open. After it is closed, the data is deleted within 30 days, except invoices.

Stripe processes payments. We never receive your card number: we keep the Stripe customer ID, the plan, the subscription status and the invoices.

Why

Taking payment, issuing invoices, computing taxes.

Legal basis

Performance of the contract, and a legal obligation for invoices.

Kept for

Invoices and accounting records: ten years (article L123-22 of the French Commercial Code).

Signing in with Steam is voluntary. Steam confirms your ID to us and never sends us your password. We keep your Steam ID, your persona name, your avatar, and: owned games, hours played, and when you last played.

Friends, purchases, and messages are never read.

Depending on what you use: the groups you create or join, your library card if you share it, your Discord ID if you link your account with the /link command, and your email if you ask to be invited to playtests.

No aggregate figure under 50 players. Individual data is never sold or shown to a studio.

Why

The player tools, and anonymous market studies.

Legal basis

Your consent, given when you sign in. Playtest invitations need a separate consent, which you can withdraw from any invitation.

Kept for

The snapshot stays until you delete it. A group lasts 7 days. The playtest address is kept until you unsubscribe.

Deletion and export. Signed-in players do both from their Steam account page. If you are under 15, ask a parent before connecting your account.

For games followed by a studio customer and a few similar games, we read public Steam reviews and public YouTube comments through the official Steam and YouTube interfaces. The aim is to find what players ask for or dislike in a game, as figures aggregated per game.

Before anything is stored, the author is replaced by a keyed hash specific to each platform: the same player on Steam and YouTube gives two different hashes, and we never link accounts. We keep no name, handle, avatar or profile link. Email addresses, links, phone numbers and @mentions are removed from the text. A studio sees figures and excerpts without authors, never who wrote them. No decision is made about a person.

Why

Studying player demand for a game or a genre.

Legal basis

Legitimate interest: market research on text its authors made public, limited by pseudonymisation and the retention period.

Kept for

24 months after collection, then automatic deletion.

To object, write to contact@shypiard.com with the link to your Steam profile or YouTube channel: we recompute the hash and delete your texts.

On the public “games like” pages, we also count how many of the most helpful English Steam reviews of a game name another game, and quote a short excerpt from one of them. We keep only the excerpt, whether the review recommends the game, and the hours played: no author, no hash, no profile link. Excerpts with a link, an email address, a phone number, an @mention or an insult are not quoted. To have an excerpt removed, write to contact@shypiard.com with the page address.

On the public game pages, we show aggregates computed from recent Steam reviews: the languages they are written in and the total hours their authors played. For the “players also play” list, we read the public Steam libraries of a sample of those authors and keep only shares, such as “34% of these players also played this game”. Steam IDs are used during the computation and never stored; a private Steam profile is skipped.

Public data from YouTube and Twitch channels: channel name, link, public statistics (subscribers, views) and games covered. If you join the network, the details of your application and your creator space are added.

Why

Suggesting creators whose audience plays a studio's genre, and introducing games to creators in the network.

Legal basis

Legitimate interest for public channel data. Performance of the contract for registered creators.

Kept for

As long as the channel is active. Deleted on request to contact@shypiard.com.

Work addresses published by studios themselves (Steam page, studio website: addresses such as press@, contact@ or business@), studio name, game concerned, date and content of the emails, replies received. The emails go out from a domain separate from shypiard.com, through Microsoft 365. Each one has an unsubscribe link.

Why

Offering our services to studios whose game fits what we do.

Legal basis

Legitimate interest: business-to-business prospecting related to the studio's activity.

Kept for

Three years after the last contact. After an unsubscribe, the address stays on a suppression list so it never receives another message.

When it runs, a watch collects public Reddit posts about indie game launches: an excerpt and the link. It helps us find discussions to answer by hand. Nothing is posted automatically.

Why

Taking part in discussions about indie game launches.

Legal basis

Legitimate interest.

Kept for

24 months, then deletion.

Two tools, with no Google Analytics, GTM or Meta pixel:

PostHog (hosted in the EU, eu.i.posthog.com) measures page views and interactions. By default, and if you choose “Continue without cookies”, measurement stays anonymous: no cookie, no local storage, no durable identifier, so nothing links two visits together, or this site to another. No session recording, no automatic capture of your clicks, and a closed list of measurements whose properties are filtered before sending (no email, no identifier, no free text). This is the scope French data protection rules exempt from consent for audience measurement alone.

If you accept, PostHog switches to a first-party cookie (sessions, return visits, attribution). Session recording and automatic interaction capture are then enabled. No named profile is created: we do not send your email to PostHog.

Vercel Analytics measures traffic and performance, without cookies and without an advertising identifier. It stays on regardless of your banner choice.

Short /go/ links count clicks with a fingerprint computed for the day. It is not your IP address, and it cannot follow you from one day to the next.

To limit abuse, forms and sign-in count requests by a keyed hash of the IP address. These counters expire automatically. The host keeps technical logs to run the site.

Until you accept, or if you refuse, this site sets no tracking cookie and writes nothing to your device for audience measurement. A technical lang cookie remembers your language choice. If you sign in, session cookies (studio account or Steam account) keep you signed in: they are needed for the service and are not used for tracking.

If you accept, a first-party PostHog cookie is set to link your visits. The HttpOnly shy_attr cookie (180 days) then remembers the landing page and campaign parameters. It is never set without that consent, and a refusal deletes it. The choice is stored locally under shypiard_analytics_consent. You can change your mind by clearing this site's data in your browser, or by writing to contact@shypiard.com.

No data is sold or rented. These providers process data on our behalf, each for its own task:

• Vercel Inc. (United States): site hosting.
• Supabase Inc. (United States), data stored in the EU (Frankfurt, Germany): database, accounts and authentication.
• Resend Inc. (United States): account, authentication and Field Report emails.
• Stripe Payments Europe Ltd. (Ireland): payments, invoices and tax computation.
• PostHog Inc. (servers in the EU): audience measurement.
• Microsoft Ireland Operations Ltd.: sending prospecting emails through Microsoft 365.
• Google Ireland Ltd.: sign-in with Google, if you choose it.
• Discord Inc. (United States): Discord commands, if you use them.

We also read public sources through their official interfaces: Steam (Valve), YouTube, Twitch and Reddit. IsThereAnyDeal receives only game IDs, to return official prices. Anthropic receives only the public description of a Steam game, to suggest one email sentence that is reviewed by hand. No personal data is sent to them.

When a provider is based outside the European Union, the transfer relies on the EU–US Data Privacy Framework if the provider is certified, or on the European Commission's standard contractual clauses.

You can ask for access to your data, its correction, its erasure, restriction of processing and portability. You can object to any processing based on our legitimate interest, and withdraw your consent at any time, without affecting what was done before.

Write to contact@shypiard.com. We answer within one month. If the answer does not satisfy you, you can complain to the CNIL, the French data protection authority (cnil.fr).