Privacy Policy

This policy explains what HourIdler collects, why we use it, who receives it, and how long we keep it. We do not sell personal data or use it for advertising.

Privacy contact

Privacy questions and rights requests can be sent through our support center or to [email protected].

What we collect and why

• HourIdler account and service use - username, email, hashed HourIdler password, plan, settings, connected games, idle history and support messages. We process these to create and perform our contract with you under GDPR Article 6(1)(b).
• Steam login material - session tokens and, only if you choose password login, the Steam password and Steam Guard material needed to establish the session. This is necessary to perform the idling service you request under Article 6(1)(b).
• Payments - order number, plan, price, currency, status and payment-provider references. This supports the purchase contract under Article 6(1)(b), fraud prevention under Article 6(1)(f), and any applicable accounting obligations under Article 6(1)(c).
• Security data - IP address, authentication events, device sessions and rate-limit records. We use this to protect users and the service from abuse under our legitimate interests in Article 6(1)(f).
• Optional public and linked features - profile picture, public profile, leaderboard entry, review, or linked Google/Discord identity. We process these when you enable or submit them; you can hide, unlink or delete them again.

Your Steam credentials

To idle for you, our servers establish a Steam session for your account. With QR login, we receive a session token and never receive your Steam password. If you choose password login, the password is encrypted at rest and is not displayed in the dashboard; the service decrypts it in memory when needed to authenticate with Steam. The operator controls the service and encryption keys, so encrypted storage does not mean login material is inaccessible to the operator. We do not access Steam payment details.

How it's protected

The public service is HTTPS-only. Steam credentials, tokens and Steam Guard secrets are encrypted at rest, with encryption keys kept separately from the database. Authentication cookies are HttpOnly, Secure in production and SameSite=Lax. Our application servers are hosted in Germany.

Keeping & deleting your data

• Steam accounts and credentials: kept while that Steam account is connected; removing it deletes its stored login material.
• HourIdler account, usage, support and order rows: kept while the account is active. Starting account deletion immediately stops idling and revokes sessions. A recovery link remains valid for three days, after which scheduled cleanup permanently deletes the account and associated HourIdler database rows.
• Verification and recovery codes: usable for 15 minutes to one hour depending on the flow. They are stored only as hashes and removed by routine expiry cleanup.
• Security audit records: removed by routine cleanup after 365 days. Deleting an account does not immediately erase every security audit record.
• Cookies: retained for the periods listed below.

Leaderboard & reviews

The public leaderboard shows your username and total idle hours; you can hide it under Profile, then Account settings. Reviews show your username and can be deleted by you. We do not make decisions with legal or similarly significant effects solely through automated processing.

Cookies

• session - keeps you securely signed in for up to 30 days. It is strictly necessary for an authenticated account.
• houridler_lang - remembers a language you selected for up to 12 months.

We do not use advertising, analytics or cross-site tracking cookies. Because these cookies provide login and an explicitly selected preference, the site does not display a tracking-consent banner.

Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. Where processing depends on your optional choice, you can withdraw that choice without affecting earlier lawful processing.

You may also complain to Datatilsynet or the data-protection authority where you live. We may need to verify your identity before completing a request.

Children

You must be 16 or older (or the minimum age in your country) to use HourIdler.

Contact

Contact the controller through our support center or at [email protected]. Account deletion is available directly under Dashboard, Profile, Account settings.