Privacy Policy

This policy explains what HourIdler collects, why we use it, who receives it, and how long we keep it. We do not sell personal data or use it for advertising.

Who is responsible

HourIdler is the controller responsible for the processing described here.
No_Current_address

Privacy questions and rights requests can be sent through our support center or to [email protected].

What we collect and why

• HourIdler account and service use — username, email, hashed HourIdler password, plan, settings, connected games, idle history and support messages. We process these to create and perform our contract with you under GDPR Article 6(1)(b).
• Steam login material — session tokens and, only if you choose password login, the Steam password and Steam Guard material needed to establish the session. This is necessary to perform the idling service you request under Article 6(1)(b).
• Payments — order number, plan, price, currency, status and payment-provider references. This supports the purchase contract under Article 6(1)(b), fraud prevention under Article 6(1)(f), and any applicable accounting obligations under Article 6(1)(c).
• Security data — IP address, authentication events, device sessions and rate-limit records. We use this to protect users and the service from abuse under our legitimate interests in Article 6(1)(f).
• Optional public and linked features — profile picture, public profile, leaderboard entry, review, or linked Google/Discord identity. We process these when you enable or submit them; you can hide, unlink or delete them again.

Your Steam credentials

To idle for you, our servers establish a Steam session for your account. With QR login, we receive a session token and never receive your Steam password. If you choose password login, the password is encrypted at rest and never stored or displayed in plain text; it is decrypted in memory only when needed to authenticate with Steam. We do not access Steam payment details.

How it's protected

The public service is HTTPS-only. Steam credentials, tokens and Steam Guard secrets are encrypted at rest, with encryption keys kept separately from the database. Authentication cookies are HttpOnly, Secure in production and SameSite=Lax. Our application servers are hosted in Germany.

Keeping & deleting your data

• Steam accounts and credentials: kept while that Steam account is connected; removing it deletes its stored login material.
• HourIdler account, usage, support and order rows: kept while the account is active. Starting account deletion immediately stops idling and revokes sessions. A recovery link remains valid for three days, after which the account and associated HourIdler database rows are permanently deleted.
• Verification and recovery codes: usable for 15 minutes to one hour depending on the flow. They are stored only as hashes and removed by routine expiry cleanup.
• Security audit records: retained for up to 12 months unless they are needed longer to investigate an active security incident or legal claim.
• Server logs: kept in size-limited rotating files and overwritten as the rotation fills.
• Cookies: retained for the periods listed below.

Payment, email, hosting or identity providers may keep their own records for longer where their law or contracts require it.

Leaderboard & reviews

The public leaderboard shows your username and total idle hours; you can hide it under Profile, then Account settings. Reviews show your username and can be deleted by you. We do not make decisions with legal or similarly significant effects solely through automated processing.

Cookies

• session — keeps you securely signed in for up to 30 days. It is strictly necessary for an authenticated account.
• houridler_lang — remembers a language you selected for up to 12 months.

We do not use advertising, analytics or cross-site tracking cookies. Because these cookies provide login and an explicitly selected preference, the site does not display a tracking-consent banner.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. Where processing depends on your optional choice, you can withdraw that choice without affecting earlier lawful processing.

You may also complain to Datatilsynet or the data-protection authority where you live. We may need to verify your identity before completing a request.

Children

You must be 16 or older (or the minimum age in your country) to use HourIdler.

Contact

Contact the controller through our support center or at [email protected]. Account deletion is available directly under Dashboard, Profile, Account settings.