Privacy
Effective from 18 October 2026.
Controller
The controller of your personal data is Yumemi s.r.o., company ID 23577827, VAT CZ23577827, registered at Příčná 1892/4, Nové Město, 110 00 Prague 1, Czech Republic. Questions and requests: [email protected].
What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| E-mail, name; with Steam, Discord and Google also the account ID and avatar (Steam sends no e-mail) | account and sign-in | contract (Art. 6(1)(b) GDPR) |
| Content you publish, reviews, comments, votes | running the marketplace | contract |
| Sign-in record (IP address and browser of the session) | account security | legitimate interest (Art. 6(1)(f)) |
| Downloads and votes with a one-way fingerprint (HMAC) of the IP or account, never the readable IP | statistics and protecting ratings from fraud | legitimate interest |
| When signed in: what you downloaded and which version, items you follow | My downloads, notifications about new versions (auto-follow can be turned off in Settings, e-mails separately) | contract |
| Reports and moderation decisions with reasons | handling notices and appeals | legal obligation (DSA) and legitimate interest |
| Favourites, password (stored only as a secure hash) | your favourites list, password sign-in | contract |
| Credit and promotion: top-ups, bids, won hours and prices, payment status, transaction number | running the credit and the auction, accounting | contract and legal obligation (accounting and tax law, 10 years) |
We do no advertising profiling and never sell data.
Cookies
Only necessary cookies: the sign-in session and your language choice. No analytics or advertising cookies, so no cookie consent is needed. Recent searches are remembered only by your browser (localStorage) and never sent anywhere. Views and clicks of ads and promoted items are counted anonymously, without cookies or a visitor identifier.
YouTube videos
Videos added by creators play through youtube-nocookie.com (privacy-enhanced mode). YouTube (Google) may process data under its own policy when you play a video. Video thumbnails load from i.ytimg.com.
Recipients and processors
- Hosting: the operator's servers in the Czech Republic.
- Card payments for promotion: Stripe Payments Europe Ltd. (Ireland) processes the card details; we never see them.
- Crypto payments: NOWPayments (Change NOW LLC) processes the transaction; it only gets the top-up number and amount from us.
- Cloudflare, Inc.: network protection, encrypted connections and content delivery. Data may be transferred to the USA under the EU–US Data Privacy Framework.
- An e-mail delivery provider for sign-in links and notifications.
- Discord, Inc., Valve Corporation (Steam) and Google Ireland Ltd., if you sign in with their account.
How long we keep data
- Account and published content: while the account exists. After closing the account, data is deleted within 30 days; reviews and comments are anonymised.
- Sign-in sessions: until sign-out, at most 7 days after the last activity.
- Moderation decisions: 3 years (appeals and the DSA).
- Database backups: 7 days.
Your rights
You have the right of access, rectification, erasure, restriction, portability, and to object to processing based on legitimate interest. Send requests to [email protected]; we answer within 30 days. You can complain to the Czech Office for Personal Data Protection (www.uoou.cz).