Privacy policy

1. Scope and controller

This policy applies to the Oruvai website, web application, mobile applications and related support services.

The controller is Kerim Akgül, trading as Oruvai, Nienkamp 30, 48599 Gronau, Germany. Privacy enquiries can be sent to [email protected].

2. Our data principles

• We collect data for a defined product or security purpose, not because it might be useful someday.
• Private library, profile and group information stays private unless you deliberately change its visibility.
• A skipped game is not treated as a dislike. Stable preference profiles change only through meaningful signals.
• We show uncertainty where game, compatibility or recommendation data is incomplete.
• We do not sell personal data.

3. Website access and infrastructure

When you open Oruvai, technical data is processed to deliver and protect the service. This may include IP address, time of access, requested URL, referrer, browser, operating system, device class, response status, Cloudflare Ray ID and internal diagnostic identifiers.

This processing delivers the requested service, protects transport and system security, limits abusive requests and diagnoses failures. Data is retained longer only where an incident needs investigation or a legal obligation applies.

4. Account and authentication data

For account access, Oruvai processes in particular email address, internal account and profile IDs, username, verification state, accepted policy versions, sessions, timestamps, security events, recovery data and email-change records.

Public production sign-in supports a time-limited email code and the external identity providers Google and Discord. For an external sign-in, Oruvai receives the provider account identifier, verified email address where supplied, display name and avatar where supplied, together with security metadata needed to link the identity to the Oruvai account. Oruvai does not receive the provider password.

The web session and CSRF protection use Secure, HttpOnly, SameSite=Lax cookies; the matching CSRF value remains in browser memory. Native access tokens are kept in protected device storage. Password login is not available in production.

• Purpose: account creation, login, recovery, session management, abuse prevention and support
• Legal basis: contract and pre-contract steps, plus legitimate account and system-security interests
• Retention: for the account lifetime; consumed or expired email challenges are removed after a short follow-up period

5. Library, activity and Gaming DNA

Oruvai may process games you own or can access, platform, library source, play status, progress, ratings, favourites, play history imported with permission, games you want to play and the context you choose for a recommendation.

Gaming DNA is a preference profile derived from deliberate positive and negative feedback, experience reasons, selected games and recommendation outcomes. It may include preferences relating to pace, challenge, freedom, learning effort, stress, session length, cooperation, competition, story and replayability.

After analytics consent, Oruvai records structured product-measurement events for onboarding, libraries, recommendations, result actions, groups and Pro access. These records contain the event type, time, session and journey identifiers, app platform and version, and limited context values. Events are linked to the private profile and may be reviewed by authorised administrators together with separately stored account and game-activity data. Access tokens, passwords and raw IP addresses are not stored as properties of these product-measurement events.

6. Profiling and automated recommendations

Oruvai uses automated profiling to rank possible games and explain why a title may fit. The main factors include technical compatibility, access, selected context, explicit feedback, Gaming DNA, data confidence and diversity constraints.

Recommendations do not produce legal or similarly significant effects. They are suggestions, not binding decisions. You can ignore them, change their context, remove feedback, correct your profile and choose games manually.

If Oruvai later introduces automated decisions with materially different effects, this policy and the product controls will be updated before that feature is used.

7. Profiles, friends and groups

Oruvai assigns a private pseudonymous profile at account creation. A member chooses a username before using social features; choosing one does not make the profile, library or activity public. Profile data may later also include an avatar, biography, platforms, deliberately showcased games, released Gaming DNA traits and social connections.

Groups may process membership, invitations, compatibility answers, suggested games, private votes, availability and limited activity needed to reach a group decision. Private group information is not intended for public discovery.

• Every social visibility starts private. Profile, showcased games, Gaming DNA traits, platforms and activity are initially hidden from other people.
• For a newly chosen username, exact-username discovery and friend requests are enabled by default so people who already know that exact username can connect. Friend comparison remains switched off. A username is not discoverable by a broad people search.
• You can enable or disable each offered release separately later. A release only exposes the area it describes.
• A public profile does not by itself publish your full library, private group content, private votes or negative taste traits.
• Invite links may be used by anyone who receives them; users should share them carefully.
• Blocking prevents the blocked account from using supported social interactions with you.
• Reports and moderation records are processed to keep the community safe and comply with law.

8. Connected gaming platforms

Steam library import is available. A user can identify a Steam account or confirm the account through Steam OpenID. Oruvai then processes the SteamID64, owned-game list, Steam application identifiers and playtime returned by Steam, subject to that account's Steam privacy settings.

Steam authentication confirms the account identity; Oruvai does not receive the Steam password or store a Steam access or refresh token. Imported games remain associated with their source. A user can review an import before applying it and can disconnect Steam or remove provider-derived library access in the available connection controls.

Other platforms remain manual unless the product explicitly marks their connection as available and shows the provider, data fields, permissions, synchronisation behaviour and deletion effect before authorisation.

9. Radar, news and deals

Radar is currently disabled and is not available on the website. Previously saved followed-game interests and preferences remain stored; this pause does not delete them. Browser and mobile push delivery, verified market prices and affiliate attribution are not enabled in the current production service.

Any compensated deal link must be labelled next to the link. A purchase may generate commission, but the underlying interest and recommendation profile is not sold to the merchant.

10. AI-assisted processing

The production AI capability is disabled. Personal and user-generated content is therefore not sent to an AI provider. Oruvai may later use AI to structure game information, propose experience attributes, detect inconsistencies or generate short recommendation explanations.

Before activation, Oruvai will document the provider, region, purpose, affected data, retention, training settings, safeguards and any objection or consent controls. Data must be minimised and pseudonymised where possible.

AI output can be wrong. It will not be the sole basis for account sanctions, legal decisions or similarly significant decisions, and source-backed catalogue and compatibility facts remain separate.

11. Subscriptions and payments

Oruvai Pro is a paid subscription offered with monthly or yearly billing. Direct web checkout, recurring billing and subscription management are provided through Stripe.

Stripe processes the customer reference, account email, payment instrument, payment status, fraud and risk signals, and invoice or address data where required. Oruvai receives the customer, checkout and subscription references needed for access, accounting, cancellation, withdrawal and support. Full card or bank credentials are not stored in the Oruvai database.

A disabled technical preparation using RevenueCat exists for possible future app-store purchases. Direct web subscriptions are currently sold by Oruvai and processed by Stripe; no app-store subscription is offered.

12. Service messages, support and marketing

We process contact details and message content when you request a login code, use support, report content or contact us. SMTP2GO (Sand Dune Mail Ltd) delivers login, security, confirmation and support messages; Hostinger provides the @oruvai.com mailboxes.

Marketing email and optional promotional notifications are sent only after a separate, optional affirmative choice. Oruvai records the consent time, version and source after account-email verification. Consent can be withdrawn at any time without affecting necessary service messages.

13. Legal bases

• Contract and pre-contract steps: providing accounts, libraries, recommendations, groups, support and subscriptions.
• Legal obligations: tax, accounting, consumer protection, lawful authority requests and dispute records.
• Legitimate interests: service security, fraud prevention, minimal diagnostics, defence of claims and carefully balanced product improvement.
• Consent: non-essential device storage, optional analytics, marketing and any optional processing presented as consent-based.
• Vital or public interests: only in exceptional cases permitted by law.

14. Recipients, processors and transfers

Oruvai shares data only where required for the stated purpose, based on valid consent or required by law. Advisers and authorities receive only the data needed on an appropriate legal basis.

For transfers outside the EEA, Oruvai must verify the recipient, its role as controller or processor and the permitted transfer mechanism. Depending on the service, this may include an adequacy decision, standard contractual clauses and supplementary safeguards.

15. Retention and deletion

• Account, core profile, library and Gaming DNA: normally until account deletion. The delete function removes the profile and dependent account data from the active database immediately unless a narrow exception applies.
• Product and usage measurement events: no more than 180 days; production collection occurs after active analytics consent.
• Friend activity: stored for no more than 90 days and shown in the activity feed for no more than 30 days.
• Expired or revoked social shares, session groups and technical retry records: normally a further 30 days.
• Social reports: normally up to 365 days while open and a further 180 days after resolution or dismissal. Associated admin audit records: 730 days.
• Support and contact cases: 730 days by default. The sender receives a case ID when the message is accepted.
• Oruvai mail outbox and delivery events: 180 days. SMTP2GO may retain email headers and sampled messages for up to 35 days under its own policy.
• Prepared browser-push records are not used for delivery while the feature is disabled. If push is activated later, this policy will identify the active provider, purpose and retention before delivery begins.
• Completed email-change records: 180 days. Expired or consumed login challenges: a further 7 days.
• Local PostgreSQL backups on the VPS: a daily rolling schedule currently retaining 7 days.
• Billing and tax records: applicable statutory periods once paid contracts exist.

16. Your rights

Depending on the conditions of applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent for future processing. Requests can be sent to [email protected].

You may also lodge a complaint with a data protection supervisory authority. For the establishment in North Rhine-Westphalia, this is in particular: Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen. We may need to verify identity before disclosing or changing account data.

17. Age and younger users

The minimum age for an independent Oruvai account and social features is 16. Oruvai Pro may be ordered only by people aged 18 or older unless a separate lawful guardian process is introduced.

Age confirmation is currently a self-declaration rather than identity verification. If Oruvai learns that an account was created below the permitted age without the required authorisation, it may restrict or delete it.

18. Security and incidents

Oruvai uses access controls, encrypted transmission, secret management, least-privilege permissions, backups, monitoring and documented incident response appropriate to the service. No online service can promise absolute security.

If a personal data breach creates a legal notification duty, affected users and the competent authority will be informed as required.

19. Changes to this policy

The current version and review date appear at the top of this page. Material changes will be communicated in an appropriate way before they take effect. Previous versions will be archived where needed to document the information that applied at a particular time.