Privacy and community rules

What data we collect

• Browsing: the site does not use profiling cookies or advertising tracking tools. Only if you accept, we use Google Analytics for visit statistics (see Statistics with Google Analytics). The site is hosted on Cloudflare Pages (Cloudflare, Inc.): to deliver the pages and protect them from abuse, Cloudflare processes the IP address and other technical data of each request (for example the browser and the page requested), which it keeps in its own logs for a limited period, including in the United States, where Cloudflare participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission (see the Cloudflare privacy policy). The home page shows a background trailer from YouTube in privacy-enhanced mode (youtube-nocookie.com): to play it, YouTube receives technical data such as the IP address from your browser. Trailer previews, including in the indie showcase, are images loaded from i.ytimg.com (YouTube): the browser contacts that domain to download the thumbnail, even before you press play.
• Praise, constructive criticism and “helpful” votes: when you post a comment we save the text, the name you choose (optional), the hours played (optional) and the date, plus the IP fingerprint described below. We do not ask for email, passwords or other personal data (only the indie showcase requires an email account).
• Global chat: when you write in the chat we save the message, the name you choose, the room (General, PC, PlayStation, Xbox, Switch or Mobile), your gaming ID if you decide to share it and the date, plus the IP fingerprint described below. Messages are public: share your gaming ID only if you want anyone to see it.
• Random identifier (pseudonym): to limit spam, the first time you write, vote or report, the browser receives a random identifier (a Supabase session without registration) linked to your content. It does not contain your name, your email or your phone number, but it is not anonymous: it distinguishes your browser and links your content together.
• Reports: we save which comment or message was reported, the random identifier of the person reporting it, to prevent repeated reports, and the IP fingerprint described below.
• IP fingerprint: to limit spam from the same network, we link to every comment, chat message and report a fingerprint calculated with a secret key (HMAC-SHA256) from the IP address and the date, as in the piazza. We do not store the IP in clear, the fingerprint changes every day, is not public and is deleted after 2 days (proposed value; the automatic clean-up of the fingerprint runs every hour); on reports only a generic marker remains, which does not distinguish one network from another.
• Indie showcase: to submit or vote for a game you need an account with email and password. The details are below, in Indie showcase.

Indie showcase

The indie showcase collects independent games submitted by their developers. This is how it works:

• Account: submitting a game or voting for one requires a Statcade account with email and password, managed by Supabase Auth. We save the account email, the password in encrypted form (hash, never in clear) and the dates of creation and last access. The session without registration used by chat and comments is not enough.
• Submissions: we save title, description, trailer link (YouTube or Vimeo), link to the game page (Steam or itch.io), cover link if you provide it, the name of the developer or team e l'contact email, together with the date, the identifier of the account that sent the submission and its status (pending, published, rejected).
• Votes: for each vote we save the game, the account identifier and the date. You can vote for a game only once and remove your vote whenever you want.
• Daily IP hash: to limit abuse (at most 5 submissions and 30 votes a day from the same network) we save, linked to each submission and each vote, a fingerprint encrypted with a secret key (HMAC-SHA256) from the IP address and the date. The key stays only in the database and is not public: without it the IP cannot be traced back from the fingerprint. We do not store the IP in clear, the fingerprint changes every day and we delete it after 2 days (at the latest at the next clean-up). If the request does not allow it to be calculated, the submission or vote is rejected.
• Who sees what: after approval by the editorial team, title, description, links, developer name and number of votes are public. The contact email, the account identifier, the IP hash and who voted for what are not public: only the editorial team sees the contact email, to write to you about the submission; the account identifier stays in the database to apply the limits and the single vote; the IP hash is used only for the limits of the day on which it is calculated.
• Third-party content: YouTube trailer previews come from i.ytimg.com as soon as you open the page; covers come from the Steam or itch.io image servers given by whoever submits the game. The trailer starts only when you press play, from youtube-nocookie.com or from the Vimeo player (player.vimeo.com, with the “do not track” option on). In all these cases your browser contacts those servers, which receive technical data such as the IP address. Links to Steam and itch.io open their websites, with their own privacy notices.
• Why: to publish the submitted games, count votes and protect the showcase from spam and repeated votes (legitimate interest); the contact email and account data are needed to handle the request you make when you submit the game.
• For how long: a published game stays in the showcase, with its votes, until you ask for it to be removed or we remove it. Pending submissions stay until the editorial team reviews them. Rejected submissions, with the contact email, are deleted automatically 30 days after rejection (at the latest at the next clean-up). The IP hash of submissions and votes is cleared after 2 days (at the latest at the next clean-up). When a submission is deleted, its votes are deleted too. The account stays until you ask for it to be deleted: write to contatti@statcade.com and we will delete the account and the linked submissions and votes.

Piazza

The piazza is the space for publishing short posts, replying, liking and following other players. This is how it works:

• Session without registration: as for chat and comments, the piazza uses the Supabase session without registration saved in your browser (the random identifier described in “What data we collect”). We do not ask for email or password. If in the same browser you have signed in with an indie showcase account, the piazza uses that account.
• Profile: to publish you create a profile with a username (handle, for example @mario_92), a display name, an optional bio , an optional avatar and, if you want, your platforms with their gaming IDs. We also save the date of creation and last change. All these profile data are public: share a gaming ID only if you want anyone to see it.
• Reserved usernames: every username you use stays tied to your profile and nobody else can take it, so an old @mention or an old link never leads to someone else’s profile. You can use at most 5 different usernames. If the profile is deleted (by you or by us), the list of names already used stays saved without any link to your account and those names are not reassigned to anyone, not even to you.
• Avatars from Gravatar only: as an avatar we only accept a Gravatar address (www.gravatar.com or secure.gravatar.com); without an avatar we show your initials. The Gravatar address contains a fingerprint (hash) of your email and is public like the rest of the profile: someone who knows your email could recognise it. When someone opens the piazza, their browser downloads the image from Gravatar, which receives technical data such as the IP address (without the address of the referring page). Gravatar is a service of Automattic: see its privacy policy.
• Posts, replies, likes and mentions: we save the text, the date, the linked game if you choose one, the post you are replying to, the hashtags and the people you @mention. The text, date, game, your username, display name and avatar, the number of likes and replies, the hashtags and the usernames mentioned, with a link to their profile, are public. For each like we save who gave it and when, but only the total is public: only you can see the list of posts you liked.
• Follows and blocks: only the numbers of your followers and of the people you follow are public. Only you can see the list of people you follow and the list of people you have blocked. Someone you block receives no notice, but from that moment, in their respective sessions, neither of you sees the other’s profile and posts in the piazza any more, and the block removes mutual follows.
• Reports: when you report a post we save the post, the reason (spam, hate, personal data, other), your account identifier, the IP hash described below and the date. The person reporting is never public. For the last 30 days, moderators see an excerpt of the post, the username of the person who wrote it, the number of reports and the reasons, but not who made them. A post is hidden automatically when at least 3 accounts with email and at least 24 hours old report it, from at least 3 different networks. Reports from sessions without registration or from newer accounts are saved and read by moderators, but are not enough to hide a post. If the author deletes the post, the reports already made remain with the moderators, who see that the post was deleted by its author (text and username are already deleted). When a moderator has decided on a post (hidden or republished), or the author has deleted it, its reports are “closed” and are deleted automatically 30 days after they were made (proposed value, see below); those still open remain as long as the post exists.
• Anti-spam limits and IP hash: to prevent abuse we limit how many actions an account can take and how many can come from the same network (for example at most 2 posts a minute per account and 15 pieces of content a minute from the same network). For the network limits we save, linked to each post, report and profile change, a fingerprint calculated with a secret key (HMAC-SHA256) from the IP address and the date. The key stays only in the database and is not public: without it the IP cannot be traced back from the fingerprint. We do not store the IP in clear and the fingerprint changes every day. After 2 days (proposed value) the fingerprint is deleted automatically from posts, reports and records of profile changes, and also from chat messages and comments; on reports only a generic marker remains, which does not distinguish one network from another. The records of profile changes (account, fingerprint and date) are used only to count the changes, are not public and are deleted after 30 days (proposed value). So that publishing and deleting straight away does not get around the limits, when you delete a post written less than an hour earlier (including by deleting the profile) we keep the account, fingerprint and date in an internal, non-public register for 1 hour (proposed value; the hourly clean-up deletes it at the latest an hour later) and count them in the limits as if the post were still there.
• Moderators: moderators are people enabled by the controller directly in the database. They can hide or republish piazza posts, chat messages and comments. A hidden post is no longer visible to anyone, and replies to a hidden post also stop being visible. A post already deleted by its author cannot be hidden (other people’s replies would stay hidden with it): the individual replies are moderated instead. The hidden post stays saved for 30 days from when it was hidden (proposed value); then it is deleted automatically together with its replies, likes and reports.
• Who sees what: your account identifier, the IP hash, who reported or liked something and the moderation status are not public and do not leave the piazza pages.
• Changing and deleting: at any time you can change your username, display name, bio, avatar and platforms, remove a like, unfollow someone and remove a block. You can also delete by yourself, from the piazza and after a confirmation: one of your posts or replies with “Delete”, or your whole profile with “Delete profile” in the Profile window. For a deleted post we immediately remove the text, the link to your account, the game, the IP fingerprint, likes, hashtags and mentions (except for the one-hour anti-spam register described above, for posts written less than an hour earlier). If other people have replied, a “Post deleted” placeholder remains in its place, with no text or author, and their replies stay visible (nobody can reply under it any more, but those replies can still be reported); when no visible replies are left, the placeholder disappears from the piazza. The placeholder row, which contains no personal data, is deleted by the clean-up when it has no more replies or reports, that is at the latest about 30 days later, when the reports and hidden replies expire. If nobody else has replied, the post disappears straight away together with your replies under it. Reports already made on the post remain with the moderators as described above. When you delete your profile we remove the profile, platforms and gaming IDs, we delete all your posts and replies in the same way (where others have replied, the placeholder remains with their replies), your likes, the people you follow and who follow you, the blocks you set and the @mentions of your name in other people’s posts (the text remains, without a link). What remains: the username, reserved and not linked to your account (see above); the record of the deletion among the profile changes, which is used for the anti-spam limits; the reports you made on other people’s posts, as long as the post exists or until they are closed and deleted as described above; the blocks other people have set against you, which remain their choice; the session without registration in your browser, whose account is then deleted by the automatic clean-up when it no longer has any linked data and you have not used it for 30 days (see below). To delete the account as well, or if you cannot use the piazza, write to contatti@statcade.com stating your username.
• Why and for how long: to show what you choose to publish, make follows and blocks work and protect the piazza from spam and abuse (legitimate interest). Profile, posts and replies remain until you delete them, ask for them to be deleted or we delete them because they break the rules; likes, follows and blocks until you remove them or delete the profile. An automatic clean-up, once a day (and every hour for the IP fingerprint and for the one-hour register of deleted posts), applies these periods: 2 days for the IP fingerprint; 30 days for hidden posts (from when they were hidden), for closed reports and for the records of profile changes; 30 days for unused sessions without registration, that is created more than 30 days ago, with no access or writing (comments, messages, reports, actions in the piazza) in the last 30 days, according to the last date of use that we record, and with no content, vote, report or profile linked anywhere on the site. We keep this date only for sessions without registration, it is not public, is updated at most once an hour and is used only for this clean-up: it remains as long as the session exists and we delete it if the session becomes an account with email. These are proposed values: the piazza is not open yet and we will confirm them, updating this page, before it opens. The piazza follows the same community rules (at the bottom of this page) and the same minimum age of 14.

What stays saved in your browser

Here is everything Statcade can save in your browser:

• Local storage (localStorage, not cookies): the session without registration and the comments you have already marked “helpful”, used with Supabase for comments, votes and chat; for convenience, the name, gaming ID and last room used in chat; the processor, graphics card, RAM and operating system you enter in “Can I run it?” (sc-hw, saved only when you press “Check” or leave a field; the “Forget my PC” button deletes them); your choice about statistics cookies (sc-consent), which lasts 12 months. If you sign in with an indie showcase account, its session takes the place of the session without registration in this same storage. The editorial team’s moderation login stays only in the browser tab (sessionStorage), until you close it. These are necessary for the features you use and do not require consent.
• Google Analytics cookies, only if you accept: _ga e _ga_<ID>, which last up to 2 years (details below).

You can delete everything at any time from your browser settings, by clearing the site data for statcade.com.

Statistics with Google Analytics

To understand how many people visit Statcade and which pages are most useful we use Google Analytics 4, provided by Google Ireland Limited, which acts as data processor on behalf of Statcade. We turn it on only if you click “Accept” in the cookie banner: until you accept, or if you click “Decline” or close the banner with the “X” (same as “Decline”), the Google script and the page speed measurement are not loaded and no statistics cookie is saved.

• Legal basis: your consent (Art. 6(1)(a) GDPR). You can refuse it without losing any feature of the site.
• What is collected: pages visited, device and browser type, approximate city and country, plus technical data about the visit such as where it came from (for example a search engine or a social network) and its duration. We use these data only in aggregate form and not to identify you.
• Page speed (Core Web Vitals): with the same consent your browser measures some page timings, that is how long it takes to show the main content, how quickly it responds to clicks and taps and how much the layout shifts while loading, and sends them to Google Analytics together with the visit data described above (with the same random identifier as the cookie _ga). The measurements themselves are only technical performance numbers and do not contain any text you write or other information about you; we look at them in aggregate form to make the site faster. The measurement uses the open-source web-vitals library, served directly from statcade.com: without consent, or if you click “Decline”, it is not even downloaded.
• IP address: Google Analytics 4 does not store IP addresses; it uses them only to derive the approximate location and then discards them.
• No advertising: Google Signals and ad personalisation are turned off, and advertising consents always remain denied.
• Cookies used: _ga, which distinguishes one browser from another with a random number, and _ga_<ID>, which keeps the state of the visit. Both last up to 2 years.
• Retention: statistics data stay in Google Analytics for 14 months and are then deleted automatically.
• Transfers: the data may be transferred to the United States; Google participates in the EU-U.S. Data Privacy Framework, recognised as adequate by the European Commission.
• How to withdraw consent: click “Manage cookies” at the bottom of any page and choose “Decline”: Google Analytics stops and the cookies _ga e _ga_<ID> are deleted. Alternatively you can delete cookies and site data for statcade.com from your browser settings.

To find out more about how Google processes these data you can read its privacy policy at policies.google.com.

Where data are stored

Comments, chat messages, votes, reports, accounts and indie showcase submissions are stored on Supabase, on a server in the European Union (Frankfurt, Germany). For security reasons Supabase records request data such as the IP address in its technical logs, kept for the short period set by the provider.

Why and for how long

We use these data only to show publicly what you choose to publish and to protect the site from abuse (legitimate interest). Comments and messages stay online until they are deleted by you, on request, or by us if they break the rules. Votes are kept as long as the content they refer to exists; reports too, but closed ones (a moderator has already decided on the content) are deleted automatically 30 days after they were made (proposed value). The IP fingerprint is deleted after 2 days (proposed value). The random identifier remains as long as you use it: if you have not used it for 30 days and no data remain linked to it, it is deleted automatically (proposed value, see Piazza); on request we delete it together with your content.

Minimum age

Comments, votes, chat and the indie showcase are reserved for people aged at least 14, the age set in Italy for consenting to online services. If we find out that content was published by a younger person, we delete it. Parents can ask for its removal at contatti@statcade.com.

Your rights

Under the GDPR you can request access to your data, rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. Write to contatti@statcade.com. Since comments and messages are not linked to a name or an email, to help us find them please give the game or the chat room, the approximate date, the name used and part of the text. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, garanteprivacy.it).

Community rules

• To write comments, vote and use the chat you must be at least 14 years old.
• Only write about games you have actually played.
• Constructive criticism means explaining what does not work and, if you can, how to improve it. No insults to developers, players or other users.
• No spam, advertising, links to third-party sites, illegal content, hate or discrimination.
• Do not publish your own or other people’s personal data (addresses, phone numbers, emails).
• Do not post spoilers without a warning.
• In the chat share only your own gaming IDs and do not ask other users for personal data, money or accounts.
• A comment reported by several people is hidden automatically and may be removed.
• In the indie showcase submit only a game you develop yourself, or for which you have permission, and vote for each game only once.

Last updated: October 17, 2026.