Privacy Policy

Last updated: 27 September 2026

Effective 11 October 2026. This updated policy takes effect on 11 October 2026; until then, the previous version continues to apply (a copy is available on request at contact@loadia.app). What changes: the policy now covers photos on profile cards, public profile pages on the web and the critic program (Section 11), and PlayStation and Xbox library imports and Loadia Plus gifts (Section 10).

1. Who is responsible for your data (Data Controller)

The data controller for the Loadia mobile application and website ("Loadia", "the service", "we", "us") is:

• Init Consulting
• Head office: 11 passage Marivaux, 77185 Lognes, France
• SIRET 913 339 362 00018
• Registered with the RCS of Meaux, SIREN 913 339 362
• Intra-community VAT: FR25913339362
• Share capital: €250
• Represented by: Chedli Ben Hassine
• Contact / data protection requests: contact@loadia.app

Data Protection Officer (DPO): Chedli Ben Hassine, reachable at contact@loadia.app.

2. Scope and our privacy-first design

Loadia works with an optional account. Without an account (guest mode), your library, diary, ratings, reviews, lists and preferences stay in local storage on your device and are not synced to our servers. When you create an account, your collection and profile are synced to our servers (hosted by our processor Supabase in an EU data centre in Ireland) so that you can sign in on the app or web and get your collection back, and so that community features (public profiles, reviews and feeds) work (see Sections 10 and 11). While public sharing is on, your public profile, published reviews and public lists are also published on public pages of loadia.app that anyone can open and search engines can index (see Section 11).

We do not send your library, diary, reviews, profile content or custom in-app events to a third-party analytics service, and we never sell your data. The limited technical data processed by AppsFlyer for install measurement and by AdMob for advertising is described in the Advertising section. Web AdSense advertising remains disabled: it will be enabled only after a certified consent platform is installed and will not apply to Plus accounts (see Advertising and our Cookie Policy).

3. What personal data we process

Loadia does not request a device-location permission, collect precise location, or receive or store a user- or device-level copy of the approximate location that Google and AppsFlyer may infer from an IP address. We do not process special-category data, contacts, or biometric data. Please do not put that kind of information, or pictures of other people without their consent, in your profile, your card photo or your reviews. We do not knowingly collect data from children (see Section 13). In guest mode, your library and account content are not stored on Loadia's account servers; catalog/search delivery, crash reporting and the advertising SDKs described here may nevertheless transmit limited technical data.

4. Purposes and lawful bases (Article 6 GDPR)

We do not use your Loadia library or activity to choose ads. The free mobile tier uses AdMob; web AdSense advertising is prepared but inactive, as described below.

5. Recipients and processors

We share personal data only with the processors and recipients strictly needed to run the app:

• Apple (App Store / StoreKit), processes your purchase of Loadia Plus or of a Plus gift on iOS. Apple is the merchant of record. See Apple's privacy policy.
• Google (Google Play Billing), processes your purchase of Loadia Plus or of a Plus gift on Android. Google is the merchant of record for Play purchases. See Google's privacy policy.
• RevenueCat, Inc. (USA), manages subscription entitlements, hosted web checkout and the Plus access granted by a gift, on our behalf. We send your account identifier to associate purchases with your Loadia account and receive subscription events; when a gift is activated, RevenueCat grants Plus to the recipient's account identifier. We do not send your library or reviews for billing. When you delete your Loadia account, we have RevenueCat delete its customer record.
• Stripe / Link (web billing) processes checkout, recurring payments, tax, fraud prevention and payment support. For web purchases labelled Sold through Link, Stripe is the merchant of record (Stripe Managed Payments) and acts as an independent controller for its Link consumer services. It processes the contact, billing, payment and order details you supply; relevant order information is available to Loadia for billing and support. Card entry is hosted by Stripe. See the Link Privacy Policy.
• Game artwork CDN (IGDB / Twitch), game cover and hero images are loaded from a third-party image CDN. It necessarily receives your device IP address and which game's artwork is requested. No account, library, or profile data is sent there.
• Game catalog and search (Supabase, EU region), the game catalog and in-app search are served by our database host. It necessarily receives your device IP address and the search or filter terms you type in order to return matching games. No library or profile data is sent with catalog or search requests.
• Google (AdMob) serves ads in the free tier. Its SDK automatically collects and shares an IP address (which may be used to infer an approximate location), app interaction and diagnostic data, and device or advertising identifiers for advertising, analytics and fraud prevention. Subject to your consent, Google may use the advertising identifier for personalised ads and measurement (see the Advertising section below). Google acts as an independent controller for the advertising data it collects. Loadia does not receive or store a user- or device-level copy of Google's inferred location; aggregate regional reporting may be available.
• Google (AdSense, web: inactive) may serve and measure ads on some free public pages after activation and collection of the required choices through a certified consent platform. No AdSense tag is currently loaded on the site.
• Cloud accounts, sync and community content (Supabase, EU region), our database host stores your account, your synced collection, the community content you share, your avatar and banner images, your profile card and its photo, and critic-program applications, as our processor, in an EU data centre (Ireland) (see Sections 10 and 11).
• Push delivery (Expo, Apple Push Notification service and Firebase Cloud Messaging): when you allow notifications, they process the device push address, platform and payload strictly needed to deliver the alerts you request.
• Valve / Steam authenticates you on the official Steam website and, only when you request a library preview, supplies your Steam numeric identifier, visible owned games, titles and playtime. Loadia never receives your Steam password. Valve acts under its own privacy policy. The raw response is processed transiently by our Cloudflare Worker and is not retained as a provider copy.
• Sony Interactive Entertainment / PlayStation Network authenticates you on the official PlayStation sign-in page and, only when you request a preview, supplies your numeric account identifier, online ID, the list of games you played with their play time, and your trophy-title summaries. Loadia never receives your password; the single-use sign-in code is exchanged once and the resulting token is discarded at the end of that request. Sony acts under its own privacy policy.
• Microsoft / Xbox network authenticates you on the official Microsoft sign-in page and, only when you request a preview, supplies your Xbox user identifier, gamertag and the list of games you played with minutes played. Loadia never receives your password; the sign-in token is used once and discarded at the end of that request. On a phone, Microsoft's own sign-in cookies stay in the app's browser storage (see Section 10). Microsoft acts under its own privacy policy.
• Crash reporting (Sentry, EU region): when the app crashes or hits an error, Sentry (Functional Software, Inc., USA) receives a diagnostic report on our behalf, stored in its EU region. The report contains the technical error and the device model, OS version and app version it happened on. We have deliberately configured it so that it is not tied to your account and carries none of your content: no email address, no user identifier, no library, reviews or profile. It necessarily receives your device's IP address at the point of transmission. Its only purpose is to let us find and fix faults (Article 6(1)(f) - our legitimate interest in a working, stable app).
• Install measurement: AppsFlyer Ltd. (14 Maskit St, Herzliya, Israel) tells us which advertising campaign an install came from, so that we know what our advertising is paying for. It may receive your device's advertising identifier, when available, your IP address (from which it derives an approximate city, region and country), and the fact that the app was installed or opened, but no Loadia account id. It receives nothing about your library, diary, reviews or profile. Where consent is required it is asked for first and the resolved UMP answer is passed on to AppsFlyer (Article 6(1)(a) - your consent); see the Advertising section below.
• Website hosting and delivery: Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA), serves the public pages (including public profile, review and list pages), the web application and the server boundary used for optional Steam, PlayStation and Xbox connections, and sends critic-program emails through its email service. Cloudflare receives technical data needed to deliver and protect the site, including IP addresses and request logs, processes a Steam, PlayStation or Xbox library response transiently when you request a preview, and carries the content of critic-program emails; synced account data remains with Supabase.
• The public, search engines and link previews: while public sharing is on, anyone, including search engines and the link-preview services of messaging apps and social networks, can read the public pages described in Section 11. They are not our processors and act on their own account.

We never sell your personal data.

6. Advertising

Mobile app. The free tier shows ads served by Google AdMob. Its SDK automatically collects and shares technical data such as an IP address (which Google may use to infer an approximate location), app interactions and diagnostics, and device or advertising identifiers. Google uses these data for advertising, analytics and fraud prevention; Loadia does not request location permission or receive a user- or device-level copy of Google's inferred location, although aggregate regional reporting may be available. Google's User Messaging Platform (UMP) manages the advertising consent choice where one is required. That choice determines whether AdMob may personalise ads and whether Google permits an ad request. If you do not consent to personalisation, any ad Google permits is non-personalised. On iOS, App Tracking Transparency (ATT) is a separate choice: refusing ATT prevents access to Apple's advertising identifier (IDFA), but does not by itself decide whether an otherwise permitted ad is personalised. You can remove ads entirely with a Loadia Plus subscription. Google acts as an independent controller for the advertising data it collects; see Google's privacy policy.

We also measure our own advertising. When we pay to advertise Loadia, AppsFlyer tells us which campaign an install came from, so that we know what we are paying for. It may receive your advertising identifier, when available, your IP address (from which it derives an approximate city, region and country), and the fact that the app was installed or opened, never your Loadia library, diary, reviews or profile. AppsFlyer stays stopped while UMP consent is required and has not been granted. It starts only after consent is granted or UMP says consent is not required; refusal or later withdrawal stops it, as does an active Loadia Plus entitlement. On iOS, ATT separately determines whether the IDFA is available. You can change the UMP choice at any time with Manage ad choices in Settings.

Website: inactive feature. We plan to use Google AdSense on some free public pages. No AdSense tag or web advertising tracker is currently active. Before activation, a Google-certified consent management platform compatible with IAB TCF v2.3 will let affected visitors accept, refuse or manage purposes before any non-essential storage. Refusal will not prevent access to the site. A permanent link will then reopen those choices. Confirmed Plus accounts receive no ad request; an unknown Plus status also blocks ads as a safety measure. See our Cookie Policy.

7. International transfers

Apple, RevenueCat, Stripe / Link, Google, Expo, Cloudflare and Functional Software, Inc. (Sentry, which stores Loadia's diagnostics in its EU region) may process limited data in the United States. Transfers outside the EU rely on appropriate safeguards (Standard Contractual Clauses and/or the EU-US Data Privacy Framework). AppsFlyer Ltd is established in Israel, a country recognised by the European Commission as providing an adequate level of protection. Valve, Sony and Microsoft process the data of your platform account under their own policies. Your account data, synced collection, community content, profile images and critic-program applications are hosted in the EU region (see Section 10).

8. Retention

• Data on your device is kept until you delete it, delete your account, or uninstall the app.
• Your account and synced collection are kept while your account exists. Deleting your account in the app removes it from our live systems immediately; residual copies in encrypted backups and transient technical logs expire within 30 days. A deletion request sent by email is handled within 30 days.
• Turning sharing off removes the profile and activity from public access. Your avatar and banner are then moved to private storage with no public address; only you receive short-lived private links to them, and they are restored if you turn sharing back on. Copies already cached by our storage network can take up to about an hour to expire. Reversible unlisted profile, media, profile card, follow and list records may remain private until account deletion; deletion erases them, including your avatar, banner and card photo, subject to the backup window above and the limited safety records below (see Section 11).
• Your profile card and its photo are kept until you remove or replace the photo, or delete your account. Your weekly poll votes and co-op invitations are kept until your account is deleted (an invitation is also deleted when the other person deletes theirs).
• A critic-program application, including a refused one, our decisions and the copies of emails queued for sending, is kept until you delete your account. Copies of emails already delivered remain in the mailboxes that received them.
• A push registration is kept until logout, account deletion, replacement or invalidation by the notification service.
• Missing-game requests are kept for no more than 180 days and are also erased with the linked account.
• Crash diagnostics are retained by Sentry for a limited period under its standard retention policy (currently 90 days) and are then deleted automatically.
• Purchase records are retained by Apple, Google, RevenueCat and Stripe / Link under their policies and applicable accounting law. Loadia retains necessary billing and support records for the applicable legal retention periods. Gift and gift-purchase records are kept after either person deletes their account, with that person's account and profile identifiers removed, for accounting, refunds and disputes.
• Google and AppsFlyer retain advertising and attribution data under their own policies; Loadia receives aggregate reports and stores no separate user-level copy. AdMob reporting windows range from 90 days for user activity to 2,555 days for other reports; AppsFlyer user-level retention varies by integration and partner, and its aggregate data may be kept for up to 25 months.
• A minimal private deletion/replay-security record (retired profile ID, one-way hashes and timestamps) is kept for the lifetime of the service to prove retries and prevent reuse. It contains no email, collection, reviews or profile content.
• Private reports and moderation action proofs may be kept only as long as necessary for abuse handling, community safety and legal claims. They are not republished and are not used to recreate a deleted account.
• A Steam connection record and its verification records are kept until you disconnect Steam or delete your Loadia account. A Steam library preview is deleted when you confirm, or within about two hours after it expires. One-time link records are deleted when used or rejected; abandoned records expire after ten minutes and are pruned by the next link attempt. Disconnecting removes the connection but does not silently delete games you already confirmed into your Loadia collection; you can edit or delete those entries normally.
• PlayStation and Xbox connection records, and PlayStation import records, are kept until you disconnect that platform or delete your Loadia account. PlayStation and Xbox library previews expire ten minutes after they are produced and are deleted within about two hours after they expire or are confirmed; until then, a confirmed Xbox preview supplies the verified Xbox playtime shown next to your reviews. Import receipts are deleted when you disconnect. Games you already imported stay in your collection.

9. Your rights (Articles 15-22 GDPR)

You have the right to: access, rectification, erasure ("right to be forgotten"), restriction, data portability, and objection, and to withdraw consent at any time.

You can exercise most of these directly in the app:

• Access / portability: Settings → Export my data (machine-readable JSON). Where the features are available, the export also includes your weekly poll votes, and an export made from the app includes your profile card and its photo and your critic-program application, decisions, badge and early reviews.
• Erasure: Settings → Delete account (permanently removes your cloud account, synced collection, public content, profile images and on-device data, except for the limited private safety records and pseudonymised purchase records described above). Deleting Loadia does not cancel or refund App Store, Google Play or Stripe/web billing; cancel it separately with that provider. If you connected Xbox in the app, Microsoft's own sign-in cookies stay in the app's browser storage on that device until you sign out on Microsoft's page or uninstall the app (see Section 10). If you can no longer access the app, use loadia.app/delete-account.
• Rectification: edit your profile and entries at any time.
• Objection: turn public sharing off in Settings, remove your card photo, or disconnect a platform to stop its verified playtime from appearing next to your reviews.
• External connection: disconnect Steam, PlayStation or Xbox at any time in the import/settings screen. Your data export includes the stored Steam connection metadata; PlayStation and Xbox connection identifiers are not yet part of the automatic export, and we send them on request. Deleting your Loadia account also deletes every connection. Disconnecting Xbox does not sign you out of Microsoft in the app's browser (see Section 10).

For any other request, or if something you expect is missing from your export, contact contact@loadia.app. We respond within one month (Art. 12 GDPR).

10. Cloud accounts and sync

When you create an account, your account and synced collection are stored with our processor Supabase in an EU data centre (Ireland), protected by encryption in transit (TLS) and at rest, and by row-level security so only you can access your private data. Sign-in uses your password or a one-time code sent to your email address (and Sign in with Apple on iOS); passwords are never stored by us in readable form, authentication is handled by the provider using salted hashing. If you use Loadia without an account, nothing in this section applies: your library and account content stay on your device and are not synced to Loadia's account servers.

Optional Steam, PlayStation and Xbox connections

Connecting a platform is optional and is not a way to sign in to Loadia. You sign in on Valve's, Sony's or Microsoft's own page; Loadia never sees your password and keeps no Sony or Microsoft token after the request that uses it. Loadia keeps the platform account identifiers listed in Section 3 and, for Steam and PlayStation, the per-game records used to verify playtime and count later imports. For Xbox, the playtime shown as verified next to your reviews comes from your last confirmed preview, so it appears only until that preview is deleted, within about two hours. The library preview is shown to you before anything is imported, and nothing is added to your collection until you confirm. You can disconnect a platform at any time; games you already imported stay in your collection.

On a phone, you sign in to Microsoft in the app's own browser, which keeps Microsoft's sign-in cookies on that device. They stay in the app's browser storage after you disconnect Xbox, sign out of Loadia or delete your Loadia account, until you sign out on Microsoft's page or uninstall the app. In current versions of the app, a fresh Xbox link asks you to sign in to Microsoft again, even when Microsoft remembers your account. This stops someone else using Loadia on the same device from linking your Xbox account with one tap.

Loadia Plus gifts

Where gifts are offered, you can buy one month or one year of Loadia Plus in the app for a mutual friend (you follow each other) who has a Loadia account with public sharing on. To make this possible, Loadia stores the gift (buyer, recipient, gift type, status and dates) and the store transaction identifier, shows each of you the other's public profile, and sends the recipient a push notification. When the recipient activates the gift, RevenueCat grants Plus to their account identifier until the end date. Gift and gift-purchase records are kept after either person deletes their account, with that person's identifiers removed, for accounting, refunds and disputes.

11. Community features and public sharing

Community features come with your account (guests share nothing). Public data is stored with our processor Supabase in an EU data centre:

• Public profile. When you create an account, sharing is on by default. Your @handle, display name, avatar and banner, bio, optional X/Twitch/YouTube handles, Loadia badge, up to four favourite and currently-playing games, played-game count, and any public list pinned to your profile are published so friends can find and follow you. Your diary and your Backlog are never published, here or anywhere else.
• Public web pages. While public sharing is on, your profile page at loadia.app/u/<handle> (name, handle, bio, avatar, banner, badge, favourite and currently-playing games, statistics and published reviews), your published reviews at loadia.app/review/<id> and your public lists at loadia.app/list/<id> can be opened by anyone, without an account. Search engines may index them, and some of them are listed in our community sitemap. Link-preview images of your profile and lists include your avatar, name and figures.
• The games you have marked as played. While public sharing is on, any signed-in member can open that list, unless one of you has blocked the other. Each entry shows your playtime, rating, like, platforms and whether you completed the game. The list is not shown to visitors without an account or on the public web pages; turning public sharing off closes it.
• Public activity and reviews. Reviews, ratings and play statistics you share are visible to other members in feeds and on game pages. Where available, a review can show other members the playtime and platform verified by a Steam, PlayStation or Xbox connection, and whether you finished or completed the game. If you optionally tell us how long it took you to finish a game, your answer is part of your private synced activity and, while public sharing is on, may contribute to aggregated completion-time statistics. Loadia displays the median only after at least five people have contributed; your individual answer and the contributor list are never shown publicly. You can clear it by editing the game entry. The separate Show when I am online setting is off by default. If you enable it, Loadia stores a recent activity timestamp and shows other members only a short-lived online dot, never the exact time. Turning it off clears that timestamp. You can mark any review as a spoiler, and block or report other members at any time.

Profile card ("Games to know me")

Where available, you can build a card from nine game picks and, optionally, a photo taken with your camera or chosen from your library. The app resizes the photo to at most 2,048 pixels, re-encodes it as a JPEG without its location and other metadata, and saves it to your Loadia account; our server removes any remaining metadata segments. Signed-in members who open your card can see your picks and, when the card is in photo mode, the photo, as long as your profile is public and neither of you has blocked the other. The card and its photo are not shown on the public web pages or to visitors without an account. They are kept until you remove or replace the photo or delete your account; turning sharing off hides them but keeps them for when you turn it back on. An export made from the app includes them. Do not use a photo of another person without their consent.

Critic program

Where available, you can apply for a critic badge. The application form collects the data listed in Section 3; it is used only to review and answer your application. It is stored with Supabase, and its full text is emailed through Cloudflare's email service to contact@loadia.app, where Loadia reviews it; our decision and any reply are emailed to the address you gave. If you are accepted, your critic badge is shown on your profile instead of the Plus badge, and the early reviews you write, from up to 14 days before a game's release, can be read by signed-in members and remain visible after the release. If the badge is revoked, your early reviews are hidden. Applications, including refused ones, and decisions are kept until you delete your account, and an export made from the app includes them.

Weekly polls and co-op invitations

You can vote once in each weekly poll, and a vote cannot be changed. Results are shown only as totals; no one else sees how you voted. You can invite a mutual friend to play a game together: Loadia stores the invitation and shows it to the other person; if they accept, the game is added to their library. Invitations are visible only to the two of you.

What is stored: the profile fields listed above; the games you have marked as played, with the details listed above; your shared reviews, ratings, play statistics and optional self-reported finish times; your profile card; and, while online status is enabled, the recent activity timestamp used for your online dot. Lawful basis: our legitimate interest in operating the community service (Art. 6(1)(f)), subject to your right to object by turning public sharing off. Optional online status separately relies on your consent (Art. 6(1)(a)), given only when you enable it and withdrawable in Settings.

How to object or withdraw: you can turn public sharing off at any time in Settings. Once the server confirms the change, your profile and shared activity are unlisted or removed from public access: your public profile, review and list pages return "not found" and are marked not to be indexed, and they drop out of our community sitemap within a few hours. Your avatar and banner are moved to private storage with no public address; only you receive short-lived private links to them. Copies already cached by our storage network can take up to about an hour to expire. Copies that search engines, link previews or other people already made can take time to disappear and are outside our control; you can ask a search engine to refresh its result. To keep the choice reversible, Loadia may retain the profile, its media and profile card, the follow graph and unlisted list records privately; game projections and authored interactions are deleted or hidden. Turning sharing back on restores your avatar and banner. Account deletion erases retained account content, subject to the 30-day backup window and the limited safety records described in Section 8.

12. Security

We protect your data with measures appropriate to the risk: TLS for network calls, encryption at rest and row-level security for account data, hashed credentials and strict access controls. No method is 100% secure, but we work to keep your data safe.

13. Children

Loadia accounts are intended for users aged 15 and over. Account creation requires the user to affirm that they are at least 15; Loadia is not directed at younger children.

14. Right to lodge a complaint

If you believe your data-protection rights have been infringed, you may lodge a complaint with the French supervisory authority:

CNIL, Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, www.cnil.fr

15. Changes to this policy

We may update this policy. Material changes will be announced in the app or on the site before they take effect, and the "Last updated" date above will change.

16. Contact

Questions or requests: contact@loadia.app
Init Consulting, 11 passage Marivaux, 77185 Lognes, France.