What we collect
- Account. Your email address, a display name, and a hashed password if you set one. We also log security-relevant auth events (sign-ins, failed sign-ins, password resets, two-factor changes) with the IP address and browser user-agent, to protect your account.
- Optional Steam link. If you connect Steam, we store your SteamID64, public persona name, and profile URL, and — only after you explicitly consent — your owned-games list and playtime totals. We never ask for your Steam password and never expose a private library publicly. You can unlink and delete this data at any time in your account settings.
- Content you submit. Reports, comments, and votes. Reports and comments are public and shown with your display name until you delete your account.
- Automatically.Your IP address and basic request metadata (requests reach us through Cloudflare’s edge), used for security, rate limiting, and abuse prevention.
Cookies and local storage
We use a session cookie, set when you sign in and cleared when you sign out, to keep you logged in. Your theme and detail-level (“View”) preferences are kept in your browser’s local storage and are never sent to our servers. We do not use advertising or cross-site tracking cookies.
Analytics
We use Umami, a privacy-friendly analytics tool, to understand aggregate usage such as page views and referrers. Umami does not set cookies, does not track you across sites, and does not collect personal data; it is served via Umami Cloud.
Third-party services we use
We share the minimum necessary with these processors, each only to provide the service:
- Vercel — application hosting.
- Neon — database hosting.
- Cloudflare — DNS, edge delivery, and bot protection (processes your IP address before requests reach us).
- Upstash — cache and rate-limit counters.
- Resend — sends our transactional email and therefore receives your email address (e.g. for sign-in links and verification).
- Inngest — runs background jobs.
- Umami Cloud — privacy-friendly analytics.
- Valve / Steam — only when you choose to link your Steam account.
Donations are handled by third-party platforms (Ko-fi, GitHub Sponsors) under their own privacy policies; Protondex does not receive your payment details.
How we use your data
To operate and secure the site, authenticate you, prevent abuse and spam (rate limiting), compute and display compatibility, send transactional email, and — if you link Steam — show your library compatibility. We do not sell your personal data.
Imported historical data
Imported historical compatibility records contain no personal data. Protondex imports only an anonymized compatibility tier, the Linux compatibility path, and the original report date from ProtonDB’s ODbL export. No usernames, free-text notes, system details, or other personal information are imported.
How long we keep it
Reports are kept indefinitely as append-only history, and are detached from your identity if you delete your account. Your account email, password, and any synced Steam library are deleted when you delete your account or ask us to. Security-event and operational logs are retained only as long as needed for security and abuse prevention.
Your rights and choices
You can export your data (Account → Export my data), edit or delete reports you’ve submitted, and delete your account and associated personal data. Depending on where you live (for example the EU/UK or California), you may have additional rights to access, correct, delete, or port your data and to object to certain processing. To exercise these, use your account settings or email privacy@protondex.gg.
Children
Protondex is not directed to anyone under 16, and we do not knowingly collect personal data from children under 16.
International users
Protondex is operated from the United States. By using it you understand that your data is processed in the United States and in the regions of the processors listed above.
Changes and contact
We’ll post any changes here and update the “last updated” date. Questions or requests? Email privacy@protondex.gg.