PRIVACY,
WITHOUT THE FOG.

Controller and contact

The controller for Pick My Next Game at pickmynextgame.com is Leif Aspbäck. Privacy questions and requests can be sent to aspbyte.dev@gmail.com.

Last updated: 5 August 2026 — anonymous game ratings.

No account and local preferences

The public game finder does not provide visitor accounts and does not ask for a name, email address or password. If you allow preference storage, platform choices and played or dismissed game identifiers are stored only in local storage on the current device.

Search

Search happens inside your browser. After two characters, the browser downloads one small, static catalogue segment from this same Firebase Hosting site. Search text is not sent to IGDB or another search service, and no server-side search log is created by the application.

Game covers

Recommendation cover images are cached and served from this same Firebase Hosting site. Viewing a recommendation does not make your browser contact IGDB or reveal your IP address to IGDB's image service.

Public site configuration

The browser may retrieve one small public configuration document from this project's Cloud Firestore service. It contains only site text and game identifiers selected by the operator, not visitor identifiers or search terms. It does not contact IGDB or create a user profile.

Optional YouTube video

The operator may feature one YouTube video on the home page. The initial page contains only a local placeholder and makes no request to YouTube. If you choose “Load video”, the browser creates a privacy-enhanced player from youtube-nocookie.com. YouTube or Google then receives technical request data such as the IP address, browser information, page address and requested video, and may use browser storage during or after playback under its own terms and privacy policy. Loading the video is voluntary and is not required to use any part of the game finder.

Optional AI Game Match

The Guided Finder is the default and works without AI. AI Game Match is used only when you select it, enter a description and submit the request. Pick My Next Game then sends the description (maximum 240 characters), selected platform and budget through a protected Firebase callable function to Google's Gemini 2.5 Flash-Lite model on Vertex AI in Google Cloud's europe-west1 (Belgium) region. The first response is restricted to validated genre, theme, mood, session, freshness and play-mode filters plus short English search concepts. Pick My Next Game searches its own stored IGDB description index and may send the same model a shortlist of at most 12 candidate titles with public IGDB descriptions, release years, genres and themes. The second response may contain only known IGDB game identifiers. The model does not receive your name, email address, local game preferences, browsing history or the full catalogue. It cannot use tools, browse the web or contact other services. Do not include names, contact details, health information or other personal or sensitive information in the description.

AI security and rate limiting

When you submit an AI request, Firebase App Check starts an invisible, score-based reCAPTCHA Enterprise assessment. Google processes technical signals such as the IP address, browser and device information, hostname, interaction and risk signals, and returns a short-lived App Check token. No puzzle is shown. The protected function also uses the network address and browser information to derive a secret-keyed, one-way abuse-prevention value. Pick My Next Game does not write the raw network address, browser information or App Check token to its AI database. Rate counters expire after about two days. If App Check, a usage limit or AI processing fails, the browser uses the local interpreter instead. You can avoid all AI and App Check processing by using the Guided Finder.

AI input, output and provider retention

Pick My Next Game does not store the raw description. It may retain a secret-keyed, one-way cache identifier, the controlled intent and up to six selected IGDB game identifiers for seven days so that an equivalent request does not create more model calls. Candidate descriptions come from the public game catalogue and are not personal data supplied by the visitor. Google states that Vertex AI customer data is not used to train or fine-tune its AI models without the customer's prior permission or instruction. Google may nevertheless log prompts for abuse monitoring under its cloud terms, and its published Gemini models use project-isolated in-memory caching with a default retention of up to 24 hours unless the customer disables it. This provider-level handling is separate from Pick My Next Game's own database retention. Pick My Next Game does not use grounding, web search, session resumption or model training with these requests.

Google Vertex AI data retention documentation · Firebase App Check documentation

Recommendations, not significant decisions

AI Game Match only converts your current request into catalogue filters and produces entertainment recommendations. It does not build a cross-visit profile, decide access to the service or make a decision that has legal or similarly significant effects. You choose whether to use AI, which game to view and whether to follow any recommendation.

Anonymous game ratings

A visitor may give a game one to five stars without an account or written review. Pick My Next Game stores the selected star value, the IGDB game identifier, submission and update times, and public totals. To prevent repeated votes, the server creates a secret-keyed, one-way value from the network address and browser user agent. The raw network address and browser user agent are not written to the ratings database. The value cannot be used to sign in or reveal the original network address, and it is scheduled to expire after about one year. A visitor can change an earlier rating during that period without increasing the public rating count. Up to 20 rating submissions or changes are accepted during a rolling 24-hour period from the same technical source.

Messages to the operator

If you choose to use the contact form, the message topic, message text, optional reply email and submission time are stored in Cloud Firestore for the operator to read. The form is voluntary and the information is used only to handle your request. Messages are marked for deletion after 90 days and can be deleted earlier from the private admin panel. Abuse prevention uses a keyed, one-way value derived from the network address; the message itself does not store the network address. Up to three messages per hour are accepted from one network address.

The contact form and game-rating form use Google reCAPTCHA Enterprise as a necessary abuse-prevention measure. Google is contacted only after you choose to load contact verification or select a rating star. Google then receives technical data such as the network address, browser user agent, page hostname and a short-lived verification token. The server verifies the token before storing a message or rating; the token is not stored with either record. The legal basis is the controller's legitimate interest in protecting the inbox, ratings and service from automated abuse. You can use the site without sending a message or rating.

Hosting, delivery and security

Google Firebase and Google Cloud host the site, catalogue, configuration, protected functions and private operator data. Cloudflare provides authoritative DNS, delivery and security at the edge. These providers process technical request data such as IP address, timestamp, requested URL, browser information and security signals to deliver the service, prevent abuse and diagnose faults. Optional AI Game Match uses Google Vertex AI in Google Cloud's europe-west1 (Belgium) region only when the visitor selects that method. The legal basis is the controller's legitimate interest in providing and protecting the requested service (GDPR Article 6(1)(f)).

Advertising and consent

Pick My Next Game is prepared to use Google AdSense to fund the service. When advertising is active, Google and vendors selected through Google's certified IAB TCF consent management platform may process device identifiers, IP address, browser information, consent signals and interactions with ads for the purposes and vendors shown in the consent message. In the EEA, United Kingdom and Switzerland, consent is requested before optional advertising storage or personalised advertising processing. You may refuse without losing access to the game finder and may later withdraw or change the choice through “Ad privacy choices” in the footer. Contextual advertising may be shown where allowed by the recorded choice and applicable law.

Purposes and legal bases

The site, anonymous game ratings deliberately submitted by visitors, an AI match deliberately requested by the visitor, App Check, rate limiting and service security are operated on the basis of the controller's legitimate interests in providing the requested features and protecting them from automated misuse (GDPR Article 6(1)(f)). The non-AI Guided Finder remains available as a less data-intensive alternative. Optional local preference storage and eligible advertising processing use consent (Article 6(1)(a)). Voluntary messages are processed to answer your request, based on legitimate interests or steps requested before a possible agreement (Article 6(1)(f) or 6(1)(b)); privacy requests are also handled to meet legal obligations (Article 6(1)(c)). Consent can be withdrawn at any time without affecting processing that occurred before withdrawal.

Processors and recipients

Personal data is disclosed only as needed to service providers acting for the operator or as independent controllers where their service requires it: Google Cloud and Firebase for hosting, functions, ratings and messages; Google Vertex AI for an AI match explicitly requested by the visitor; Cloudflare for delivery and security; Google reCAPTCHA for abuse prevention after user action; and Google AdSense plus the vendors listed in the advertising consent message when advertising is active. Data may also be disclosed when required by law. Pick My Next Game does not sell contact messages, AI descriptions, rating security values or local game preferences.

Google Privacy Policy · Cloudflare Privacy Policy

Retention

Local preferences remain on the device until you delete them or browser storage is cleared. Public rating totals are retained as part of the service. Secret-keyed per-game rating receipts are scheduled to expire after about one year, and keyed rating rate-limit values after about two days. Contact messages are scheduled for deletion after 90 days unless a longer period is needed to resolve the request or meet a legal obligation. Contact rate-limit values expire after about one hour. Pick My Next Game does not store raw AI descriptions, raw AI network addresses, browser information, or reCAPTCHA or App Check tokens in its application database. AI cache entries expire after seven days and keyed AI rate-limit values after about two days. Google may separately retain or cache AI data for the limited provider-level purposes described in the AI section above. Hosting and security records are retained only for the periods configured in Google and Cloudflare services or required for security, billing and legal compliance. Advertising consent and storage durations are shown by the Google consent message and its vendor list.

International transfers

Google, Cloudflare and advertising vendors may process data outside Finland or the EEA. Where a transfer is not covered by an adequacy decision, the relevant provider states that it uses safeguards such as the European Commission's standard contractual clauses. The provider privacy notices and the advertising vendor list contain current details.

Your rights

Depending on the circumstances, you may request access, correction, erasure, restriction, portability or objection, and you may withdraw consent. Send a request to the contact address above. Identity may need to be verified proportionately. You may also complain to the Finnish Office of the Data Protection Ombudsman (tietosuoja.fi).

Finnish Office of the Data Protection Ombudsman

Children

The service is about games but is not designed to collect personal data from children. It has no public accounts. A child should use the contact form only with appropriate guardian involvement and should not include unnecessary personal information.

Controls on this site

Use “Delete local choices” on the home page to remove saved game preferences. Use “Local storage settings” in the footer to change preference storage. When advertising is active, use “Ad privacy choices” to review or withdraw advertising consent. The privacy and cookie pages intentionally do not load the AdSense or Google consent tag.

Changes to this notice

Material changes are published on this page with a new update date. If a change requires a new consent choice, the site will ask again before the affected optional processing begins.