PrivacyPolicy.
This Privacy Policy explains what personal information VICTOR GAME STUDIO LTD collects, how we collect it, how we use it, who we share it with, and how long we keep it — across our website and the VGS platform, including when you connect a Steam or Epic Games account to verify the games you own. It also explains the rights you have over your information.
Who We Are & What This Covers
VICTOR GAME STUDIO LTD ("VGS," "we," "our," or "us") is the data controller responsible for your personal information. We are a company registered in England and Wales. This policy applies to our marketing website (victorgamestudio.com), the VGS platform and account dashboard (app.victorgamestudio.com), and the connected services we operate, such as game-ownership verification, in-platform support, and social features.
By "personal information" (or "personal data") we mean any information that identifies you or could reasonably be linked to you. Where this policy refers to a third-party service we rely on, we name it so you can read its own privacy notice.
Company Details
Information We Collect
We collect personal information in three ways: directly from you (for example when you create an account, link a store account, contact support, or use social features); automatically (such as your IP address and basic device information when you use the service); and from third-party services you connect or that we rely on to run the platform — for example Clerk for sign-in, and Steam and Epic Games to confirm the games you own. We only collect what we need, and the categories below explain each type.
Account & identity
When you create an account, our authentication provider (Clerk) gives us your email address, username, and profile picture, and a unique account identifier. If you sign in with or link a third-party account (such as Discord, Twitch, X, Spotify, or LinkedIn), we store the identifier for that account so we can recognise you. We also store your role on the platform (for example, player).
Connected store accounts & game ownership
If you link a Steam or Epic Games account, we collect that store's account identifier (your SteamID or Epic account ID), your public display/persona name, and — for Epic — secure access and refresh tokens. We then check, and record, whether you own the specific games published by VGS on that store, and whether each copy is a permanent purchase or a temporary/shared copy. We do not read or record the rest of your library or any games we did not publish. See the dedicated section below.
Support & communications
When you open a support ticket or message us, we store your messages, the subject, and the language detected. To let you and our team communicate across languages, the message text is sent to our AI provider (Anthropic) for translation. We also send transactional and support emails through our email provider (Resend).
Friends & social activity
If you use social features, we store your friends list and friend requests, your friend code, the content of direct messages and reactions you send, and basic presence information such as whether you are online and when you were last active. Real-time delivery of these events is handled by Ably.
Device, connection & usage data
We collect technical data needed to operate and secure the service: your IP address (including when you authorise a game or device to link to your account), browser and device information, and aggregate, privacy-friendly usage statistics about our website via Vercel Web Analytics. We do not run cross-site advertising trackers.
Connecting Steam & Epic Games Accounts
Linking a Steam or Epic Games account is optional. You start it yourself and confirm it on the store's own login screen. We use it for a single purpose: to confirm whether you own the games that VGS publishes, so we can unlock the matching content, rewards, or features on VGS. We only ever check the titles we publish — never your wider game library — and we never use store data for advertising or post or change anything on your store account.
Data we receive from Epic Games
- Your Epic account ID and public display name, obtained through Epic's official account-linking (OAuth) flow with the "basic profile" scope.
- Secure access and refresh tokens that let us re-check your ownership over time. These are stored encrypted and are never shared with anyone else.
- Ownership results from Epic's Ecommerce service: for each VGS-published title we check, whether your Epic account owns it (including the bundles or editions that grant it). We only query the specific titles we publish, never the rest of your Epic library.
- Revocation notices (refunds, chargebacks, or fraud) from Epic, so we can remove access you are no longer entitled to.
Data we receive from Steam
- Your SteamID, confirmed through Steam's official Sign-In (OpenID) flow, and your public Steam persona name.
- Ownership results from Steam's publisher API: for each VGS-published title we check, whether your account owns it, whether the copy is a permanent purchase or a shared/temporary copy (for example via Family Sharing), and, for a shared copy, the identifier of the account that owns it. We only query the specific titles we publish, never the rest of your Steam library.
Why we use it
We check ownership only for the specific games published by VGS, when you link your account and periodically afterwards, so your entitlements stay accurate. We never scan your full library or games published by anyone else — we query only our own titles. We rely on the store's authoritative ownership data rather than your private library, and we keep the raw response from the store with each ownership record for accuracy and dispute resolution.
Your control
You can unlink a store account at any time from your platform settings. When you do, we delete the stored access tokens and mark the related ownership records as revoked, so the linked content is removed. For security and to prevent abuse (such as repeatedly moving one store account between VGS accounts), we keep a minimal record that the link existed; this can be fully erased on request.
How We Use Your Information
We use the information above to operate the platform and the features you choose. Specifically, to:
- Create and manage your account and keep you signed in.
- Verify the games you own and grant the matching content, rewards, or features.
- Provide support and let you and our team communicate across languages.
- Run social features such as friends, presence, and messaging.
- Detect, prevent, and investigate fraud, abuse, refund and chargeback misuse, and security incidents.
- Maintain, debug, and improve the service, and understand aggregate usage of our website.
- Send service-related messages and meet our legal, accounting, and regulatory obligations.
Our Legal Bases
Under the UK GDPR, we rely on the following legal bases to process your personal information:
Performance of a contract
To provide the account, ownership verification, and features you ask us for under our Terms.
Legitimate interests
To keep the platform secure, prevent fraud and refund abuse, debug and improve the service, and run core social and analytics functions — balanced against your rights.
Consent
Where we ask for it — for example, when you choose to link a Steam or Epic account or connect a third-party login. You can withdraw consent at any time.
Legal obligation
To comply with applicable law, including accounting, tax, and lawful requests from authorities.
How We Share Your Information
We do not sell your personal information and we do not use it for cross-context behavioural advertising. We share data only with the service providers (sub-processors) that help us run the platform, and only as needed for them to perform their function. Our main providers are:
Legal & safety disclosures
We may disclose your information where we are legally required to do so — to comply with applicable law, a court order, or a lawful request from a public authority — or where necessary to protect the rights, safety, and property of you, us, or others. If VGS is involved in a merger, acquisition, or asset sale, your information may be transferred, and we will notify you before it becomes subject to a different privacy policy.
International Data Transfers
Some of our service providers are located outside the United Kingdom, including in the United States and the European Union. When we transfer personal data outside the UK, we rely on appropriate safeguards — such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision — so that your information remains protected to UK standards.
How Long We Keep Your Data
We keep personal information only for as long as we need it. As a general rule, we keep your account data while your account is active and for a reasonable period afterwards, then delete or anonymise it — except where we must keep certain records longer to meet legal, accounting, or fraud-prevention obligations. Store access tokens are deleted as soon as a connection is unlinked or expires. You can ask us to delete your data as described in 'Your Privacy Rights' below.
Your Privacy Rights
If you are in the UK or the EEA, you have the following rights over your personal information. We will respond to any request within the timeframes required by law.
Access
Ask for a copy of the personal information we hold about you.
Rectification
Ask us to correct information that is inaccurate or incomplete.
Erasure
Ask us to delete your personal information where there is no overriding reason to keep it.
Restriction
Ask us to limit how we use your information in certain circumstances.
Portability
Ask us to provide your information in a portable, machine-readable format.
Objection
Object to processing based on our legitimate interests, and withdraw any consent you have given.
To exercise any of these rights, email us at contact@victorgamestudio.com. Using these rights is free, and we will not discriminate against you for doing so.
If you are unhappy with how we handle your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk, though we would appreciate the chance to address your concerns first.
Cookies & Similar Technologies
We keep our use of cookies to a minimum and do not use advertising or cross-site tracking cookies. The cookies and similar technologies we use are:
Authentication
Set by Clerk to keep you securely signed in to your account.
Language preference
Remembers the language you chose (NEXT_LOCALE) so the site loads in it next time.
Analytics
Vercel Web Analytics measures aggregate website usage without profiling you or tracking you across other sites.
Security
We use administrative, technical, and physical safeguards to protect your information. Data is encrypted in transit, and sensitive credentials such as store access tokens are encrypted at rest. Access to personal data is limited to people who need it to do their job. No system is perfectly secure, but we work to protect your information and to detect and respond to incidents promptly.
Children's Privacy
The VGS platform is not directed at children, and you must be old enough to consent to this policy and our Terms in your country (and at least 13). We do not knowingly collect personal information from children below that age. If you believe a child has provided us with personal information, please contact us and we will delete it.
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or the law. When we make material changes, we will update the date at the top and, where appropriate, notify you. Please review it periodically.
Contact Us
If you have questions about this policy or want to exercise your privacy rights, you can email us or write to us at:
Postal Address
4th Floor, Silverstream House
45 Fitzroy Street, London
W1T 6EB, United Kingdom