Privacy Policy

Who operates Stimpak

Stimpak is operated by Zektek LLC (“Zektek,” “we,” “us,” or “our”). This policy applies to stimpak.com, its accounts, and the API and content services used to operate Stimpak.

Information we collect

Information you provide

• Your name, email address, and password when you register with email and password. Passwords are stored as hashes, not readable passwords.
• Your name, email address, and message if you use the contact form
• Game or event details, links, and images that you submit for a listing through contact or authorized publishing tools

The contact form is delivered through a third-party form processor that receives your submission and forwards it to us. Account registration is handled separately by Stimpak’s authentication system. We do not use the details you send for marketing, and we do not add you to any mailing list.

Social sign-in

If you choose Google, Twitch, or Discord sign-in, we receive the account identifier and profile information supplied by that provider, which may include your name or username, email address, email-verification status, and profile image. We store the provider association and authentication tokens supplied for the sign-in flow, including access or refresh tokens where provided. We do not receive your password for Google, Twitch, or Discord.

The provider processes your sign-in request under its own privacy policy and learns that you are using it to sign in to Stimpak. Signing in does not give Stimpak access to your reward progress, private messages, or game library as part of the current login feature.

Followed games, claimed giveaways, and settings

When you use features that need an account, we store the choices you make: the games you follow, the giveaways you mark as claimed, and your notification settings, including when you turned each one on. We also keep a record of which notifications we have sent you, so that you don’t receive the same one twice.

Notifications

We send notifications only through channels you turn on. Email and Discord are off until you enable them, and browser push works only after you allow it in your browser.

• Email: we send notifications to your account email address through our email delivery provider, which receives the address and the message.
• Browser push: your browser gives us a subscription address and encryption keys, which we store in order to deliver notifications to that browser. Push messages pass through your browser’s push service, such as the ones operated by Google, Mozilla, or Apple.
• Discord: if you connect Discord for notifications, we store your Discord user ID and the ID of the direct-message channel our bot uses to message you. Connecting asks Discord only for your basic account identity. It does not give us access to your other messages, friends, or servers.

Links in notifications include a tag showing which channel they came from, so that our analytics can tell how notifications are used.

Information collected automatically

• Standard web server logs (e.g. IP address, browser type) collected by our hosting provider
• Website usage data (e.g. pages visited, referring site, and links and buttons you click) via PostHog, which sets a cookie named ph_…_posthog and stores related values in your browser’s local storage. While you are signed in, PostHog also receives your account identifier, name, email address, and account role, so that usage is linked to your account rather than collected anonymously
• A cookie that remembers which sign up button you used, such as the alerts panel on an event page, kept for one hour and set only when analytics cookies are allowed. Each time an account is created or someone signs in, we count it in PostHog with that button and the sign in method (email, Google, Twitch or Discord), without your account identifier or any other details
• Session recordings via PostHog, which show how you use the website, such as where you click and scroll. Anything you type into a form and your account details are hidden
• A cookie that records whether visitors from your region are asked before analytics cookies are set, worked out from your approximate location. It holds only that yes or no, never your location, and your choice itself is kept in a second cookie
• Browsing-preference cookies that remember choices like card or table view, grouping, and sort order when you change those settings. These contain the selected preferences and are set to last for up to one year
• Authentication cookies for signing in, including cookies used to complete social sign-in and maintain a session. Session records may include your account identifier, expiration time, IP address, and browser or device information

If you visit from the European Economic Area or the United Kingdom, we ask before setting PostHog cookies. Until you choose, or if you decline, PostHog still counts your visit without cookies or browser storage: pages visited, referring site, and approximate location are grouped using a one-way hash of your IP address and browser details that PostHog replaces daily, so visits cannot be connected across days or linked to your account. We rely on our legitimate interest in understanding how the website is used for this counting. Session recordings are made only after you accept. Everywhere else, analytics cookies and session recordings are on by default, and you can turn them off. You can change your choice at any time in Privacy choices.

We do not use advertising or marketing cookies on this website.

Why we process this information

We use this information only to:

• provide and maintain the website, create accounts, authenticate users, enforce access permissions, and remember browsing preferences;
• keep track of the games you follow and the giveaways you mark as claimed;
• send the notifications you turn on, through the channels you choose;
• respond to messages and event submissions;
• understand how the website is used so we can improve it, including activity linked to your account while you are signed in; and
• detect and prevent security issues.

We do not sell personal information, use website data for targeted advertising, or build advertising profiles about you.

Service providers

We use service providers to operate Stimpak, and share information with them only as needed for their services. These include providers of website hosting and content delivery, database hosting, image storage, email delivery, contact-form handling, bot protection on sign up (Cloudflare Turnstile), and usage analytics (PostHog, as described above). If you use social sign-in, Google, Twitch, or Discord also process your sign-in request. If you turn on Discord notifications, Discord delivers our bot’s messages to you, and if you turn on browser push, your browser’s push service delivers those. Each provider processes information under applicable agreements and its own privacy policy.

Retention and your choices

We retain account information while your account is active and as needed to operate the service, address security issues, and meet legal obligations. Session and provider-token records are used to support authentication and may expire or be replaced over time. Followed games, claimed giveaways, notification settings, and the record of notifications sent are kept while your account is active, and a browser’s push subscription is removed once that browser stops accepting notifications. Analytics data is retained according to our PostHog configuration. Messages and event submissions are retained for as long as needed to handle your request and keep a reasonable record of our correspondence.

You can turn notifications off at any time, for each channel and each kind of notification, from your settings. Every notification email and Discord message points there. To disconnect Discord entirely, remove the Stimpak app from the authorized apps in your Discord account settings. To stop browser push, you can also block notifications for Stimpak in your browser’s site settings.

You can control or delete cookies, including PostHog cookies and stored values, through your browser settings. Blocking cookies will interfere with signing in and prevent browsing preferences from being saved. Public listings can be browsed without creating an account. You can revoke a social provider’s access through that provider’s settings; this does not by itself delete your Stimpak account or its existing sessions. Depending on where you live, you may have rights to access, correct, or delete the personal information we hold about you; to make such a request, please contact us.

To delete your account, use Request deletion under Privacy in Settings while signed in. If you can’t sign in, contact us instead; we may need to verify that you control the account before acting on a request. Some records may need to be retained for security or legal reasons, and backup copies may remain until replaced through normal backup processes.

Security and children

We use reasonable technical measures to protect the information this website processes. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Stimpak is not directed to children under 13, and we do not knowingly collect personal information from children under 13.

Changes to this policy

We may update this policy as the website changes. We will post the revised policy here and update the effective date above.

Contact us

For questions, privacy requests, or concerns, please contact us.