The Gamer Bros is a community-driven gaming review and discovery platform currently operated as a personal project by Sabih Khan, based in Edinburgh, Scotland, United Kingdom. The platform holds a registered copyright and is in the process of formal company registration.

For the purposes of UK GDPR, Sabih Khan is the data controller responsible for your personal data. If you have any questions about this policy or your data, please contact us at thegamerbros.tgb.2022@gmail.com.

We collect the following categories of personal data when you register, use, or interact with the Platform:

Account and identity data

• Email address — collected during registration and used for account authentication, email verification, and password reset.
• Password — stored securely in hashed form via Firebase Authentication. We do not have access to your plain-text password.
• Display name / username — chosen by you during onboarding.
• Profile picture — uploaded voluntarily by you.
• Date of birth — collected during onboarding and used solely for age-gating access to content featuring mature (18+) games.

Third-party sign-in data

If you choose to sign in using Google, we receive your name, email address, and profile picture from Google as part of the OAuth authentication process. We do not receive your Google password or any other Google account data.

User-generated content

• Game reviews, including score, text, platform played on, spoiler flags, and recommendation status.
• Comments and replies on reviews.
• Game library entries, including play status, progress, and completion count.
• Wishlist entries.
• Console collection.

Usage data

• Game page click counts — we record when a game page is visited to power our trending algorithm. This data is not linked to your identity.
• Reaction data (likes and dislikes on reviews) — linked to your user account.

We use your personal data only for the following purposes, each supported by a lawful basis under UK GDPR:

• To create and manage your account (Contractual necessity).
• To verify your email address and enable password reset (Contractual necessity).
• To display your profile, reviews, and community activity on the Platform (Contractual necessity).
• To gate access to mature content using your date of birth (Legitimate interests / Legal obligation).
• To personalise your experience and show relevant game recommendations (Legitimate interests).
• To improve the Platform by understanding which games and features are most used (Legitimate interests).
• To comply with applicable laws and enforce our Terms of Service (Legal obligation / Legitimate interests).

We do not use your data for advertising, profiling for commercial purposes, or sell your data to any third party under any circumstances.

We use a minimal number of cookies and browser storage mechanisms strictly necessary to operate the Platform. We do not use advertising, analytics, or tracking cookies.

Authentication cookies

Firebase Authentication uses browser cookies and local storage to maintain your login session. These are essential for the Platform to function and cannot be disabled while you are signed in. They do not track your activity across other websites.

Session storage

We use browser session storage in limited cases to preserve draft content (such as an in-progress review) across authentication redirects. This data is stored locally on your device only and is cleared when your browser session ends. It is never transmitted to our servers.

Because we use only strictly necessary cookies, we are not required under UK GDPR or PECR to display a cookie consent banner. If our cookie usage changes in future, this policy will be updated accordingly.

Your data is stored using Google Firebase, a cloud platform operated by Google LLC. Firebase infrastructure is hosted in data centres governed by Google's security standards and ISO 27001 certification. Data may be processed in the United States and other countries where Google operates. Google maintains Standard Contractual Clauses (SCCs) to ensure adequate protection for data transferred outside the UK and EEA.

We implement the following security measures to protect your data:

• Passwords are hashed using industry-standard algorithms via Firebase Authentication — we never store or access plain-text passwords.
• All data transmission between your browser and our platform is encrypted using TLS (HTTPS).
• Access to the Firebase console and production database is restricted to authorised team members only.
• Firestore security rules are in place to ensure users can only access and modify their own data.

Despite these measures, no method of internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security but are committed to using best practices to protect your information.

We do not sell, rent, or trade your personal data. We share data only in the following limited circumstances:

Google Firebase

Firebase Authentication and Firestore are provided by Google LLC and process your data on our behalf as a data processor. Google's use of your data in this context is governed by their Data Processing Addendum.

Vercel

The Platform is hosted on Vercel, Inc. Vercel processes web request data (such as IP addresses) in the course of serving the Platform. Vercel does not have access to your personal profile data stored in Firestore.

Legal requirements

We may disclose your data if required to do so by law or in response to valid legal requests by public authorities (e.g. a court or government agency).

We retain your personal data for as long as your account remains active. Specifically:

• Account data (email, display name, profile picture) — retained for the lifetime of your account.
• User-generated content (reviews, comments, library) — retained for the lifetime of your account and deleted upon account deletion.
• Authentication logs — retained by Firebase for up to 180 days in accordance with Google's standard retention policies.
• Click and usage data — retained indefinitely in aggregated form and is not linked to your identity.

When you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required by law to retain it for longer.

As a data subject under UK GDPR, you have the following rights with respect to your personal data:

• Right of access — you may request a copy of the personal data we hold about you.
• Right to rectification — you may request that we correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") — you may request that we delete your personal data, subject to certain legal exceptions.
• Right to restriction of processing — you may request that we limit how we use your data in certain circumstances.
• Right to data portability — you may request your data in a structured, machine-readable format.
• Right to object — you may object to processing based on legitimate interests.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at thegamerbros.tgb.2022@gmail.com. We will respond to your request within 30 days. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

The Platform does not knowingly collect personal data from children under the age of 13. If you become aware that a child under 13 has provided us with personal data, please contact us at thegamerbros.tgb.2022@gmail.com and we will take steps to delete such information promptly.

Certain game pages on the Platform are restricted to users aged 18 and over. We use the date of birth provided during onboarding to enforce this restriction. This data is used solely for age verification purposes.

Your data may be transferred to and processed in countries outside the United Kingdom, including the United States, where Google's Firebase infrastructure operates. These transfers are governed by Standard Contractual Clauses approved by the UK Information Commissioner's Office, ensuring your data receives an equivalent level of protection to that provided under UK GDPR.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this policy periodically. Continued use of the Platform after any changes constitutes your acceptance of the revised policy.

If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us at: