Prices and catalogue pages need nothing from you. Your country, your platform filter and your cookie choices are kept in your own browser so the site opens where you left it; none of them is sent to us as a cookie, and none identifies you. Cloudflare, which delivers the site, may set a short-lived security cookie to keep automated traffic out. If you sign in to an account, our own cookies keep you signed in; none is set before you sign in or press a sign-in button, and they are described with accounts below.
Everything else waits for your choice, and none of it loads until you make one. The cookie banner, and Cookie settings in the footer of every page, offer four things, each off until you turn it on: analytics (Google Analytics counts visits and pages), ad measurement (Google Ads measures whether our ads bring visitors), personalised ads (Google may show our ads to you on other sites; only together with ad measurement) and partner content (the Instant Gaming offer banner, and game trailers and our own videos played by YouTube). A YouTube video also plays if you press play on it, which loads that one video from YouTube. The legal basis is your consent (Art. 6(1)(a) GDPR, and Regulation 5(3) of S.I. 336/2011). You can withdraw it at any time in Cookie settings, as easily as you gave it; the Google cookies this site set are then deleted. We ask again after six months.
Google, Instant Gaming and YouTube (Google) receive what their tags and players record, including your IP address, and handle it under their own privacy policies. Game screenshots and trailers load from Steam's servers (Valve Corporation, delivered by Akamai), or, for some Nintendo Switch games, from Nintendo's (Nintendo of America Inc.), which receive your IP address as any image host does. Google LLC, Cloudflare, Inc. (which delivers this site), Valve and Nintendo of America are based in the United States and may process data there: Google and Cloudflare under the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback, and Valve, Nintendo and Instant Gaming as their own privacy policies describe. Google Analytics keeps its data as configured in Google Analytics, at most 14 months. Cookies set on Instant Gaming's or YouTube's own domains can only be removed in your browser or with them.
Each choice you make is also recorded on our side, as proof of consent: a random ID your browser makes for it, what you chose, which version of each question you answered, and when. That record holds no IP address, no browser details and no cookie, and it is deleted after 13 months.
When you open an offer we record that a click happened, which store it went to and the total price at that moment. That record holds no IP address, no browser details and nothing about you: it exists so the commission a store reports can be checked against the clicks we sent. Links in our social posts and on our link-in-bio page are counted the same way: that one was followed, and from which post. The Claim and Play now buttons on our free games are counted the same way: which game, which button, which store and where on the site, and when — that record holds nothing about you.
We have three email lists, each joined on its own: giveaway alerts, sent when a store starts giving a game away to keep; the weekly deals email, on Thursdays; and news from getcheapgames, about new features on the site, on which nothing has been sent yet. For each list you join we keep your email address, your country (so the emails are in your language and currency) and when you signed up, confirmed or unsubscribed, for that list and nothing else; the basis is your consent (Art. 6(1)(a) GDPR, and Regulation 13 of S.I. 336/2011). You join the first two with a form and confirm from your inbox. With an account whose email address is confirmed, the email switches on your account page join and leave all three for that address, and they are the same subscriptions: on adds it at once, with no second confirmation email, and off is the same as the unsubscribe link in that list's emails. An address never confirmed is deleted after 30 days, and the unsubscribe link in every email, or the list's switch on your account page, takes you off that list at once.
An account is optional: you can create one to keep a wishlist of games and be emailed when one reaches a price you set, and to post reviews of games; nothing else on the site needs one. It holds only what that needs: a username; your email address, if you give one, and whether you have confirmed it; your password, if you use one, only as a salted hash that cannot be read back; and, with two-factor authentication on, your authenticator key, encrypted, and your recovery codes as keyed hashes; and whether your price alerts are switched on. If you pick the platforms you play on (PC, PlayStation, Xbox or Nintendo), the account keeps that choice too: the deals pages open filtered to it, and the price alerts keep to it, as do the giveaway alerts and the weekly deals email if you joined them with the address you confirmed on your account. Your wishlist is the games and the target price you set for each, with a record of the price alerts we sent you (which game, when, at what price) so that nothing is sent twice. If you sign in with Google, Steam or Epic Games, you do so on their own site and under their own privacy policy; we keep only that provider's id for you, no token, and never post or read anything on your behalf. Epic Games, Inc. is in the United States too.
Four cookies of ours make signing in work, all strictly necessary, and none is set until you sign in or press a sign-in button: gcg_session keeps you signed in, and only our server can read it; gcg_signedin only tells the page that you are signed in, so scripts you have allowed can read it, and says nothing else; gcg_oauth and gcg_2fa last fifteen minutes at most, while a sign-in finishes. We keep no record of the device or network you sign in from. No sign-in, wishlist or account action is reported to Google, X or any advertising partner, and your account is not linked to the record of your cookie choices.
An account gets only the emails it needs: confirming your address, a password reset, a link to a new address before it replaces the old one, a notice when your password or address changes, and the price alerts you set, which go only to a confirmed address and each carry a one-click way to stop them; the price alerts' switch on your account page pauses them all and keeps your targets. The others have no switch and always go. Resend, Inc., in the United States, sends them and receives your address only to deliver them. The legal basis is the contract you enter by creating the account (Art. 6(1)(b) GDPR). An account whose email address is never confirmed is deleted after 30 days; pressing Remove in its confirmation email deletes it at once, and the address is then remembered, as a keyed hash, for 30 days so that it is not emailed again. Each sign-in ends after 90 days; the record of alerts sent is kept for 90 days. Otherwise the account is kept until you delete it. On your account page you can download everything it holds and delete it, which deletes all of it at once, its reviews included; copies in our nightly backups are gone within two weeks. The email lists are kept by address, not by account: deleting the account or changing its address leaves the address on the giveaway alerts and the weekly deals email, each of which ends with the unsubscribe link in its emails. News from getcheapgames, which sends nothing yet and so has no such link, ends with the account, and for the old address when you change it.
A review you post is public: your stars, your text if you wrote any, and when you posted and last changed it are shown on that game's page to everyone, under your current username, and search engines may show them too. Nothing else about you is shown with it. You can change or delete it on the game's page at any time, and it is kept until you do, or until you delete your account; it is in the download of your account data. A review we hide for breaking our terms is shown to no one but you and left out of the game's rating. To slow down spam, our server counts each account's review changes in the last hour in its own memory only. The legal basis is the contract you enter by creating the account (Art. 6(1)(b) GDPR).
Apart from an email address you give us for an email list or an account, an account's username and any review you choose to post, we do not ask you for anything about yourself: no name, no date of birth, no payment details — you pay the store, never us. No price, page or store link needs an account. Nothing we hold is sold, and we do not build a profile of anyone.
You can ask to see the data we hold about you, to have it corrected or deleted, or to object to its use, and you can withdraw consent at any time. With an account you can do the most common of these yourself on your account page: change your username and email address, choose which of our emails you get, download your data, and delete the account. You can also complain to the Data Protection Commission in Ireland.
getcheapgames is operated by Midfeed Limited, which is responsible for this data (the controller). Questions and requests to hello@getcheapgames.com.