Privacy Policy – Codex GameHawk

1. Who We Are

Codex GameHawk is developed and operated by Shinro OÜ, a company registered in Estonia ("Shinro", "we", "us"), which is the controller for the personal data described in this policy. You can reach us any time at contact@shin.ro.

2. What We Store on Our Server

When you sign in with Apple or Google, we create an account identified by a random ID and store the identifier your provider gives us, along with the email address the provider shares when you first sign in. To run the service, we additionally store:

Your wishlist: for each game, the platform, the storefront's game identifier, title, cover-art and store addresses, and the desired price you set.
Your owned games: platform, game identifier, title, cover-art address, and playtime, as synced from the storefronts you connect.
Alerts already sent: the game, price, discount, and time, so you are not notified twice.
Your storefronts: which storefronts you have connected, their region, when each last synced, and whether you have paused it.
Your devices: a push token per device, with when it was registered and last used, so deal alerts can reach you.
Your sign-in sessions: a one-way hash of each session token, the platform (iOS, Android, or web), when the session was created, last used, and ends, and the identifier of the app's attestation key (iOS) or the browser's key fingerprint (web).
Your Hawk tier: if you buy Silver Hawk or Golden Hawk, the store it was bought in (App Store or Google Play), the product, its expiry or revocation date, and the store's purchase reference so we can confirm the purchase with Apple or Google. See section 5.
Price history: current, base and lowest recorded prices per game. These are shared records about games, not about you.

Our database does not store your IP address or browser details. They appear only in server logs (section 8) and, for up to 5 minutes, while a web sign-in waits for your approval (section 11).

3. What Stays on Your Device

Storefront credentials. Connecting Steam, GOG, PlayStation, Nintendo, or itch.io happens on your device, in the storefront's own sign-in pages or with your own API key. The resulting tokens and keys are stored in the iOS Keychain or Android's encrypted, Keystore-backed storage and are sent only to that storefront, never to our servers. The storefronts' sign-in pages also keep their own cookies in the app's web storage on the device.
A local copy of your library and wishlist prices, including the storefront user name and picture shown in the app, so the app works offline.
Backups. On iPhone and iPad, the local library copy is included in your device backup; Keychain items are not restored to a different device. On Android, the app's data is excluded from Google backup, although the storefront sign-in pages' web storage may be included.

4. What Never Reaches Us

Storefront credentials (section 3).
Passwords. The service has none; sign-in is only through Apple or Google.
Payment details. Purchases are handled by Apple's App Store or Google Play. We never see your card or bank details; see section 5.

5. Purchases & Hawk Tiers

Codex GameHawk offers two optional upgrades: Silver Hawk, an auto-renewing subscription, and Golden Hawk, a one-time purchase. Payment is taken by Apple's App Store or Google Play under their own terms and privacy policies. We never receive your name, card or bank details from a purchase.

Separately from payment, we process the purchase reference. When you buy, the app sends the store's purchase record (a signed transaction from the App Store, a purchase token from Google Play) to our servers. We verify it with Apple or Google, then store the purchase reference, product and expiry date against your account so the upgrade applies to that account on every device and on the web. We also pass your random account ID to the store with the purchase, so a purchase can be tied to the account that made it and to no other. Apple sends our servers renewal, expiry and refund updates for App Store purchases, and the iPhone app sends its active purchases again when you sign in or open it, so your tier stays in step with what you have paid for.

6. How We Use It and Why

Stored data is used for syncing your games across your devices and the web, checking storefront prices for the games you track, notifying your devices about deals, and applying the Hawk tier you have paid for. We do not sell data, share it with advertisers, or use it for profiling. There are no advertising frameworks and no analytics or tracking libraries in the apps.

Legal bases under the GDPR:

Performance of our contract with you (Art. 6(1)(b)): your account, games, alerts, storefront connections, push tokens, sign-in sessions, the web companion, and Hawk tier records.
Our legitimate interest in protecting the service from abuse and keeping it stable (Art. 6(1)(f)): device attestation, server logs, web server logs, rate limiting, intrusion-prevention blocks, and crash reports.

7. App Integrity Checks

Each sign-in includes a device attestation (Apple App Attest on iOS, Google Play Integrity on Android) that proves to our server that the request comes from a genuine copy of the app on genuine hardware. On iOS we store the public key of the app installation's attestation identity. It is stored per installation, not per account, and is linked to your account only through your sign-in sessions; it is kept, with no link to you, after your account is deleted. Play Integrity results are checked and not stored.

8. Server Logs & Abuse Prevention

Our server logs each sign-in and new account with the account ID, sign-in provider, platform, and IP address; rejected attestation and web sign-in attempts with the IP address; refused purchases and store updates with the account ID; and failed requests with the address requested and the IP address. These application logs are used for security and operations only, are deleted at the first daily cleanup after 30 days (at most about 31 days), and are never linked to any marketing or profiling use.

The web server in front of it logs every request with the IP address, the time, the address requested, the response status, and the browser details your app or browser sends. These web server logs are used to secure and troubleshoot the service, rotated daily, and deleted after about 15 days.

Rate limits, keyed to accounts and IP addresses, are kept only in memory. An intrusion-prevention tool on the server reads the web server (nginx) access and error logs, the system log, the SSH login log, and the new-account log entries to detect and block abuse, such as IP addresses that create many accounts in a short time. It records each blocked IP address with the time and the reason, blocks it for up to 7 days, and deletes these records after 7 days. The tool runs only on our server and shares nothing with its developer or anyone else. These records are kept to protect the service from abuse, on the legitimate-interest basis in section 6.

9. Crash Diagnostics

Both apps use Firebase Crashlytics, a Google service, so crashes can be found and fixed. A report holds the stack trace, the app version, the device model and operating system version, and two pseudonymous identifiers (a Crashlytics installation UUID and a Firebase installation ID). The app attaches no account ID, and reports never contain your credentials, library, or searches. Because of the installation identifiers, some privacy laws still treat reports as personal data.

Crash reporting is on by default. You can turn it off at any time under Settings → Preferences → Send crash reports; this stops new reports but does not delete reports already waiting on the device. Firebase states that Crashlytics keeps crash reports and their identifiers for 90 days before beginning to remove them from its live and backup systems. We do not export them anywhere else. Google may process them outside the EU under its Firebase Data Processing and Security Terms.

10. Third Parties and Hosting

Our server is hosted by Hostinger in Frankfurt, Germany, together with its database and backups.

Price checks, game descriptions, and artwork addresses are fetched from each storefront's public interfaces by our servers using game identifiers, regions, and languages only; no account data is included. Game identities are matched across storefronts via IGDB, by title and platform only. Cover artwork is loaded from each storefront's own image servers. Purchases are verified with Apple and Google as described in section 5.

Push notifications are delivered by Apple (APNs) and Google (FCM), which receive your device's push token and the notification text: for deal alerts, the game, its price and discount, and whether you already own it on another storefront; for web sign-in approvals, the browser and operating system and the browser's IP address (section 11). Apple and Google may process this outside the EU under their own safeguards.

Your library and wishlist are read from the storefronts by the app on your device, using your own storefront sign-in; our servers never sign in to a storefront.

11. The Web Companion

The web app at game-hawk.com shows the same account. Signing in there sends a notification to your phone, showing the browser, its operating system, and its IP address, where you approve the browser in the app. While the request waits, for up to 5 minutes, our server holds the email address used for the sign-in and the browser's IP address and user agent in memory only. Web sessions are bound to the browser they were created in, end after 30 days without use, need a fresh approval from your phone every 60 days, and end at the latest 365 days after sign-in. The browser never receives your storefront credentials, because it has none to receive.

12. Retention & Deleting Your Account

While your account exists, its data is kept. App sign-in sessions end after 180 days without use, and at the latest 365 days after sign-in; records of ended sessions, alerts already sent, and purchases are kept until you delete the account. A device's push token is removed when you turn off notifications in the app, when Apple or Google reports that it is no longer valid, or when the app has not registered it for 180 days. Signing out ends that device's session and removes its GameHawk sign-in, storefront credentials and local library copy, but keeps your account and synced data on the server. The storefront sign-in pages' cookies, cached cover images, and some app settings (such as your crash-report choice) stay on the device until you uninstall the app. Signing out may also leave the device's push token registered with our server, so deal alerts can continue; to stop them, turn off notifications in the app before you sign out.

Deleting your account. Settings → Account → Delete account in the iPhone or Android app removes your account and everything attached to it, immediately and permanently: your sign-in identity and email address, sign-in sessions on every device and browser, push tokens, platform connections, wishlist, owned list, alert records, and purchase records. The app then deletes your storefront credentials and its local library copy from that device. Deleting your account does not cancel a subscription: manage that in your Apple Account or Google Play settings. You can also request deletion at game-hawk.com/delete-account, including if you no longer have the app installed.

What remains after deletion:

application log entries that mention your account ID or IP address, deleted at the first daily cleanup after 30 days (at most about 31 days) (section 8);
web server log entries with your IP address, deleted after about 15 days (section 8);
intrusion-prevention records of a blocked IP address, deleted after 7 days (section 8);
daily database backups, kept on the same server and deleted within 16 days;
the iOS attestation key, with no link to you (section 7);
crash reports already sent, kept by Firebase for 90 days (section 9);
Apple's and Google's own records of your purchases;
on the device, until you uninstall the app: the storefront sign-in pages' cookies and the cached cover images.

Uninstalling the app does not delete your account or its data on our server; delete the account first. On Android, uninstalling removes everything the app stored on the phone. On iPhone and iPad, the system keeps the app's Keychain entries after uninstalling; if you install the app again, it erases them on first launch.

13. Your Rights

You may access, correct, or erase your data at any time: most of it directly in the app, and all of it via account deletion or by writing to us. If you are in the EU/EEA, these are your GDPR rights of access, rectification, erasure, restriction, portability, and objection to processing based on our legitimate interests. You may also lodge a complaint with the supervisory authority where you live, or with ours, the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

Messages you send us are handled as described in our general privacy policy.

14. Changes to This Policy

If this policy changes, the new version is published at this address with an updated date. Material changes are called out in the app.

15. Contact Us

Questions about this policy or your data:

contact@shin.ro