Privacy policy

The short version

This summary is not the policy, but nothing below contradicts it.

• Furxel works without an account. Signed out, nothing about you goes to a Furxel server.
• Nothing is sold, and there are no advertising trackers and no third-party analytics. Signed in, Furxel counts which of its own pages you use and for how long, and one switch turns that off.
• With an account, Furxel syncs your game titles, your playtime and your progress. Not your game files, your saves, your screenshots, or where your games are installed.
• Your profile, including your username, level and picture, is public. What your friends see of your play is yours to choose, in Settings, Privacy.
• Direct messages are stored in plain text on the server. They are not end-to-end encrypted, and they can be read by whoever operates the database.
• Paid plans are sold by Lemon Squeezy, which takes the payment. Furxel never sees your card number.
• You can delete your account from inside the app, and it really deletes, 30 days after you ask: until then you can sign in and take it back. The few records that stay are named below, with the reason.

Who runs Furxel

Furxel is made and operated by Yahya Amsddar (Furx), an individual based in Morocco. For anything in this policy, including a request to see or delete your data, write to [email protected].

Furxel is not affiliated with, endorsed by, or connected to any of the stores it detects: Valve, Epic Games, GOG, Microsoft, Blizzard, Ubisoft, Electronic Arts, Riot Games, Rockstar Games or itch.io.

What never leaves your PC

Furxel is a desktop application, and most of what it knows about you it keeps in one folder: %APPDATA%\Furxel. Nothing in this section is sent anywhere, whether you have an account or not.

• The paths to your games. Furxel needs them to launch things; a server does not. What syncs instead is a one-way fingerprint of the path, used only to recognise the same game on another PC.
• Your game files. Furxel launches them and never reads their contents.
• Your game saves. If you turn on the Save Vault (in beta, off until you turn it on), it copies a game's save folder into %APPDATA%\Furxel\vault after you play. Those copies stay on your PC.
• Screenshots you take. They are written to %APPDATA%\Furxel\screenshots and stay there. Removing a game from your library does not delete them; only you do.
• Your notes and your Chronicle.
• Cached cover art, in %APPDATA%\Furxel\art.
• Your settings, any per-game tweaks or emulator configuration you write yourself, and any library backup you make.
• Your sign-in tokens and email address, in furxel-native-session.json, so you stay signed in between launches. Anyone with access to your Windows account can read that file, which is the same as for any desktop app that keeps you signed in.

What Furxel sends

Without an account

Scanning, launching and playtime tracking all work signed out, on your machine, and send nothing to Furxel. Three things still involve another party, and none of them says who you are to Furxel:

• Steam store pages and news, when you open a Steam game's page. These go from your PC straight to Valve, so Valve sees your IP address the same way visiting the Steam store in a browser would. This is deliberate: routing it through a Furxel server would show every user the wrong regional prices.
• An update check, which fetches a small file listing the current version. The server hosting it sees your IP address, as any download does.
• Discord Rich Presence. While a game is running, Furxel tells the Discord app already running on your PC what you are playing, over a local connection rather than the network. Discord then shows it on your Discord profile according to your Discord settings, and what happens to it after that is Discord's policy rather than this one. It is on by default, says nothing when no game is running, and Furxel tells you the first time it shows. In Settings, Discord, you can turn it off, or keep it and hide the game's name or how long you have played.

Cover art needs an account, because the service Furxel fetches art from is rate-limited per key and an open door to it gets abused.

With an account

Signing in adds a sync. From then on Furxel sends, and the server keeps:

• Your email address, to sign you in and to send account mail such as confirmation, password resets and email changes. If you sign in with Google or Discord, that service tells Furxel's account provider your email address, your name and picture there, and its id for you, and those are kept with your login.
• Your library: each game's title, which store it came from, that store's own id for it, whether you have hidden it, how long and how often you have played it, and when you last did. Not the file paths: a fingerprint stands in for those.
• Play sessions: which game, when it started, when it ended, and how long it counted.
• That you are online, every two minutes while Furxel is open, and which game is running.
• Progress: XP, level, achievements, quests, your streak, the Circuit, your Marks, and anything you own or wear from the Vault.
• Your profile: username, display name, bio, picture, banner and frame, and your country if you choose one.
• Social activity: friends, friend requests, blocks, direct messages, and any report you file.
• Your SteamID, if you connect a Steam account, so your Steam achievements and playtime can be fetched for you and only for you.
• Usage and bug reports, plan and payment records, and a Discord link if you make one. Each has its own section below.

Who sees what

Anyone using Furxel can see your profile: username, display name, picture, banner and frame, bio, country, level, total playtime, achievement count, leaderboard position, and your plan's badge unless you hide it. Your streak and the hours on your showcase are shown too, unless you turn off Share my play history.

Your friends can also see the following, and each has a switch in Settings, Privacy:

• Show friends what I'm playing (on by default): the game you are in, and for how long.
• Share my play history (on by default): what you played and unlocked. Turned off, it hides all of that from everyone at once, and what you play while it is off stays private even after you turn it back on. Play you keep private is also left off the public leaderboards.
• Appear offline (off by default): everyone sees you as offline, with "last seen" stopped where it was, and no game.
• Share Threads and Offer Session Capsules (on by default): when you and a friend were in the same game at the same time, and for how long. Only the two of you see it, the server works it out only from play you both share, and either of you turning it off hides it from both.

Nobody else sees your email address, your full library, your messages, your usage, your bug reports or your payment records.

Everything held, in one table

This is the whole list. If something is not here, Furxel does not keep it.

Data in Supabase is stored in Ireland, in the European Union. Data in Cloudflare R2 is stored in Western Europe. Furxel is run from Morocco. Some of the companies in Who else is involved are based in the United States and may handle what passes through them there, under their own safeguards for international transfers.

Steam data

Furxel uses the Steam Web API, and Valve's terms require this to be spelled out rather than folded into the table above.

• What is fetched: your Steam profile summary, the games your Steam account owns and your playtime in them, and your achievement unlocks for a game, plus that game's achievement list and the global percentage of players who have unlocked each one.
• How: through Furxel's art service, which runs on Cloudflare and asks Valve on your behalf. It passes your answers back to the app and does not keep them.
• When: when you connect a Steam account, and when you open a game that has Steam achievements.
• What is kept, and where: the achievement lists and global unlock percentages, which describe games and not people, are cached in Cloudflare R2 in Western Europe, with a note of which SteamID is connected to your Furxel account. Which achievements you have unlocked, and your playtime, are held in Supabase in Ireland, in the European Union, and on your own PC.
• Whose data: Furxel requests Steam data for your own account only. Once your SteamID is connected to your Furxel account, the art service refuses to look up any other SteamID for you.

Steam data is provided as is. Neither Furxel nor Valve warrants that it is accurate, complete or available, and Valve may withdraw access to it at any time, in which case those features stop working.

Usage and bug reports

Usage

While you are signed in, Furxel counts how long you spend on each of its own pages while its window is in front and you are at it (it stops counting after five idle minutes), and how many times you open each one. Once a day it also notes the app's version and your operating system's family. It adds these up on your PC and sends them at most every fifteen minutes, as one row per page per day.

It never records what you type, which games you play, or anything about other people. Only Furxel's operator can see it, and the app shows it to them as totals across everyone. It is on by default, and turning it off in Settings, Help & feedback stops it at once: nothing is counted or sent.

Bug reports

Only when you send one: the title and description you write, and the details listed under the form before you send it (the app's version, your operating system, the page you were on and the window's size).

Plans and payments

Paid plans are sold by Lemon Squeezy, which acts as the merchant of record: it is the seller on your receipt, it takes the payment, handles tax and sends your receipts. What you type at checkout, including your card, goes to Lemon Squeezy under its own privacy policy, and Lemon Squeezy keeps your invoices and tax records.

To open a checkout, Furxel gives Lemon Squeezy your email address and your Furxel account id (and, for a gift, the account it is for), so the payment can be matched to you. Lemon Squeezy then tells Furxel what happened, and Furxel keeps only what it needs to give you your plan:

• Lemon Squeezy's ids for you, your subscription and your orders.
• Your plan, whether it is monthly or yearly, its status, and when it renews or ends.
• What each order cost and in which currency, and any refund.
• Gift codes you bought or redeemed, and trials you started.
• Lemon Squeezy's notifications about each payment, with your name, email address, address and card details removed before they are stored.

Furxel never sees your card number and keeps none of your payment details.

Discord

• Rich Presence is described above. It goes to the Discord app on your PC, not to Furxel.
• Linking your Discord account (Settings, Discord) gives you roles in the Furxel Discord server. Discord tells Furxel your Discord user id and username, and Furxel keeps them, along with a log of when you linked or unlinked. Your roles come from your plan (only a paid plan, and only while you show its badge) and from your place in the community. Unlink at any time from the same place.
• Your profile on Discord. While you are linked and leave show my profile on, members of the Furxel Discord can look up your Furxel profile as a stranger would see it, and see you on the monthly board. Nobody who has not linked appears there, and a profile is never looked up by name.
• Support tickets opened through the Furxel bot keep your Discord user id, the topic, and when the ticket was opened and closed. What you write in the server is held by Discord.

Who else is involved

Furxel is a small project and does not run its own servers. These are the companies that hold or handle data on its behalf, and there are no others.

Nothing is sold, and nothing is shared with advertisers, data brokers or analytics companies.

This website

furxel.com sets no cookies and runs no analytics or advertising trackers. Cloudflare serves it and sees your IP address, as any web host does. Downloads of the installer are counted as a single running total, with no visitor ids and no IP addresses.

How long it is kept

• Your account and everything attached to it is kept until you delete it. There is no automatic expiry, because a library and a playtime history are the things you came for. When you ask to delete it, it is closed and hidden at once and deleted 30 days later, unless you sign in and restore it first.
• A new sign-in's IP address and device label, held for the email that tells you about it, are deleted after a week. The list of devices your account has signed in from is kept until the account is deleted.
• Usage counts are deleted after 180 days.
• Rate-limiting records, which hold your IP address or your account id against a day's count, are deleted after 2 days. The note of which SteamID is connected to your account is deleted after 30 days and written again the next time it is needed.
• Lemon Squeezy's payment notifications, already without your personal details, are deleted after 25 months: long enough to answer a card dispute, which can arrive up to 18 months after a payment.
• Orders (what was bought, for how much, and whether it was refunded) are kept as the record of what Furxel sold. When you delete your account they stop being linked to you, and they hold no name, email address or card details.
• The log of Discord links is deleted after 90 days, and a closed support ticket in the Furxel Discord after 180 days.
• Email you send to support is kept as long as the conversation is useful, then deleted.
• Moderation records outlive the account, deliberately. When you delete your account the link to your profile is broken, but the record of a ban or an upheld report keeps your former account id so somebody cannot clear a moderation history by deleting and signing up again.

Your rights

Wherever you live, you can do all of the following. If you are in the UK or the EEA these are rights under the GDPR; Furxel offers them to everybody rather than checking which country you are in.

• Delete it. In the app, in Settings, My account, Delete account asks for your email address and password (and a code from your authenticator app, if you use one). The account is closed at once: signed out on every device and hidden from everyone. 30 days later Furxel removes your profile, library, sessions, achievements, quests, progress, Marks, items, friends, messages, blocks, settings, usage, bug reports, Discord link and sign-in devices, and your login itself, including your email address. Until that day, signing in and choosing Restore my account takes it all back. While a subscription is still running it asks you to cancel it first, so the store does not go on charging for an account that no longer exists; your plan runs to the end of the period you paid for. What stays is listed in the section above.
• Correct it. Profile fields, your email address and your password can be changed in the app.
• Choose who sees it. The switches in Settings, Privacy, and the usage switch in Settings, Help & feedback.
• See what is held about you, or take it elsewhere. In the app, on the Account page, Download my data saves everything Furxel's servers hold about you as one file, in a format other services can read (JSON). It says what it leaves out and why: mainly other people's messages and reports, which are theirs. Or ask, and you are sent the lot.
• Object, or restrict how it is used. Ask.
• Complain to a regulator if you think this is being handled badly. Furxel is run from Morocco, where that is the CNDP (Commission Nationale de contrôle de la protection des Données à caractère Personnel). In the UK it is the Information Commissioner's Office, and in the EEA your national authority.

Anything that is not a button in the app goes through email, to [email protected], and is answered within 30 days.

Security

• Everything travels over HTTPS.
• The database enforces row-level security, so one account cannot read another's private data even if the app asks it to.
• Playtime, XP and achievements are calculated by the server, not asserted by the app, so they cannot be edited by tampering with a local file.
• Passwords are handled by Supabase and never seen by Furxel. Changing your email address or password asks for your password again, and deleting your account needs it typed in the last ten minutes.
• Uploaded profile pictures are re-encoded before they are stored, which strips any embedded metadata such as camera or location information.
• You can sign out of every device at once from the Account page, and changing your password signs every other device out on its own.
• Two-factor sign-in, with a code from an authenticator app on your phone, can be turned on in Settings, Sign-in & security. Changing your email or password, or deleting the account, then asks for a code too.
• A sign-in from a device your account has not used before is emailed to you, with the device and where it signed in from.
• Gift codes bought by an account without two-factor sign-in wait three days before they can be used, so a stolen account cannot give its owner's plan away.
• Furxel will never ask for your password or your codes, by email or anywhere else.

No system is perfectly secure, and Furxel is one person's project rather than a company with a security team. If you find a problem, write to [email protected] and it will be taken seriously.

Children

Furxel is not intended for children under 13, and accounts are not knowingly created for them. If you believe a child has an account, write to [email protected] and it will be removed.

Changes

When this policy changes the date at the top changes with it. If a change means Furxel starts collecting something it did not collect before, that will be said plainly in the app rather than quietly edited in here.