Your data
Privacy Policy
Last updated : 3 October 2026
This is a courtesy translation. The French version is the reference text and prevails in case of any discrepancy: read it in French.
1. In short
Eukleia brings together your Steam, PlayStation and RetroAchievements achievements, and helps you choose which ones to go after.
- No advertising, no tracking, no analytics. The application embeds no analytics, crash-reporting or advertising-profiling tool.
- You never enter a gaming platform password. Not Steam, not PlayStation, not RetroAchievements — see section 3.
- Your data is hosted in the European Union (Frankfurt, Germany). One thing leaves it, and only if you report a problem — see section 6.
- Your data is visible to nobody else, except the friends you add yourself, and never your notes — see section 6.
- You can export and erase everything from the application, permanently, in two taps, without writing to us.
2. Who is responsible for this data
Lorenzo Basoli, publisher of the Eukleia application, acting as a natural person.
Contact for any question or request regarding your data: contact@demoos.fr
No postal address is published here. Any request regarding your data — access, rectification, erasure, restriction or objection — goes through that address, and will receive an answer within the one-month period the Regulation provides for.
3. Signing in
You sign in with Apple or with Google. You can also continue without an account.
There is no longer any email-and-password sign-in. That route has been removed from the application; there is no screen anywhere that asks for a password.
Your password is never seen by us. With Apple and Google it does not leave their sign-in screen, and we receive only a signed identity token.
What creating an account records: your identifier, and nothing else. Neither your name nor your picture is taken from Apple or Google. Your email address is kept by the authentication service to recognise you. If you use Apple's "Hide My Email", we see only the relay address Apple generates.
Continuing without an account
You can use Eukleia without identifying yourself to Apple or Google. An anonymous session is opened: it is attached to no identity, and we receive no email address, no name and no provider identifier.
What this costs, and we would rather write it down. Your data is indeed kept on the server, but the key that opens it lives only on this device. Uninstalling the application, signing out, or losing the device makes it permanently inaccessible — to you and to us. The application tells you so before you choose.
A consequence for your rights, and it is a real one: data made inaccessible this way can no longer be deleted from the application, since there is no longer any way to prove it is yours. It then designates nobody — an anonymous session carries no email address, no name and no provider identifier — but it remains. If that troubles you, create an account, or delete your data before uninstalling.
You can attach an Apple or Google account to an anonymous session at any time: the link is made on the same account server-side, and you keep everything you have already done.
The three gaming platforms are links, not identities
Steam, PlayStation and RetroAchievements attach to an existing account. None of the three is used to sign in, and you may link none of them.
Steam uses Steam OpenID, Valve's official mechanism: your Steam password is never seen, never transmitted and never stored, and Steam returns only your SteamID64 identifier — a seventeen-digit, public number.
RetroAchievements is linked with your username and an API key you generate on their site. Your RetroAchievements password is never requested.
PlayStation is linked with a session token you retrieve yourself from your browser. Your PlayStation password is never requested, and we strongly advise against entering it anywhere in the application — it will never ask you for it. That token is kept only for the duration of the synchronisation.
4. What is kept, and why
Everything below comes from the platforms you have linked, or from what you enter in the application.
| Data | Origin | Why |
|---|---|---|
| Your email address | Apple, Google, or you | To recognise you from one session to the next |
| SteamID64 identifier | Steam | To connect you to your library |
| PlayStation username | PlayStation | To connect you to your trophies |
| RetroAchievements username | RetroAchievements | To connect you to your achievements |
| Steam username and profile picture | Steam | To show your identity in the application |
| Your list of games, playtime, last-played date | The linked platforms | To prioritise what you have left to go after |
| Your unlocked achievements and their date | The linked platforms | The heart of the application |
| Your earned feats and their date | Computed | Your collection of rewards |
| Your progress on counter achievements | Steam and your own entry | To show the progress bars |
| Your pinned achievements, their order, and your free-form notes | You | Your hunt list |
| A purchase transaction identifier | Apple or Google | To prevent one receipt unlocking several accounts — see section 9 |
| The game you set as active | You | The "Current hunt" tab |
| Whether your Steam profile is public | Inferred | To explain why synchronisation fails |
| Synchronisation dates | System | To avoid querying Steam needlessly |
| The text of a problem report, and its technical context | You | To reproduce and fix the fault — see below |
The notes you write are free-form text. They are read by nobody but you, but avoid putting anything sensitive in them: that field is not designed for it.
Problem reports
If you report a problem from the application (Settings → Report a problem), we keep your message and the technical context the screen lists before sending: the version of Eukleia, the version of your system, your device model, your account identifier, and the most recent errors the application ran into.
That context is used to reproduce the fault. The device model is the hardware identifier ("iPhone17,2"), not a serial number: it does not designate your device, it designates its model.
The message is free-form text, and it is sent exactly as you write it. Do not put anything in it you would not want to entrust to us. At most three reports per 24 hours.
What becomes of a report when you delete your account is described in section 9.
The catalogue of games and achievements (names, descriptions, icons, rarity) is shared across all users and contains no personal data.
Technical sign-in data
Two tables serve only to secure sign-in. They contain nothing but cryptographic hashes, never a usable value, and their rows expire automatically — two minutes for exchange codes, fifteen minutes for sign-in challenges. Expired rows are erased an hour later.
What we do not collect
Not your location, not your contacts, not your address book, not your device's advertising identifier, not the list of your other applications, and no biometric data. The application requests no system permission.
5. On your device
The application keeps locally:
- your language choice;
- your choice of whether to show the tab bar labels;
- your library sort order, and your Pantheon display mode;
- a working copy of the data already loaded — your games, your achievements — so the application opens without waiting for the network;
- your session tokens, so you are not asked to sign in again;
- your PlayStation session token, if you have linked a PlayStation account. It is kept in the system's secure storage (the iOS keychain) and nowhere else: it is never written to our database. It travels to our server for the duration of a synchronisation, which uses it and forgets it.
Widgets. If you place a Eukleia widget on your home screen, the application writes the snapshot it displays into a space shared with that widget, on your device. That space does not leave the device.
Uninstalling the application erases all of that, including the PlayStation token and the widget snapshot. It does not erase the data kept on the server — see section 8.
6. Who this data is shared with
Nobody, in any commercial sense. Your data is neither sold, nor rented, nor passed on to advertisers or data brokers.
The third parties necessarily involved are the following, and there are no others:
Valve Corporation (Steam). The application queries Steam's public API and reads the achievements page of your community profile. Your SteamID is therefore transmitted to Steam — which already knows it, since it is yours. No other data goes to Steam. See Steam's privacy policy for what it does with it.
Sony Interactive Entertainment (PlayStation). Queried only if you have linked a PlayStation account, with the session token you provided.
RetroAchievements. Queried only if you have linked an account, with your username and your API key.
Apple and Google, if you sign in with one of them: they know you use Eukleia, as with any application you sign in to that way.
Supabase. Hosts the database and the server functions, in its `eu-central-1` region (Frankfurt, Germany). That is where all your data lives.
Notion, and only if you report a problem. Our problem reports are tracked in a tool provided by Notion Labs, Inc., a company established in the United States. It is the only processing in this document that leaves the European Union, and what leaves is strictly bounded:
| Goes to Notion | Does NOT go to Notion |
|---|---|
| A row number, the date of the report | Your message |
| The version of Eukleia, the version of your system | Your account identifier |
| Your device model | The error log |
The code that talks to Notion does not even load the message, the account identifier or the log: what it never reads cannot leave. Those three stay in Frankfurt.
Your friends, if you add any
This is the only case in which another person sees your data, and it exists only if you trigger it yourself.
The application lets you add friends and compare yourself to them. There is no directory: nobody can find you. A friendship is formed only if one of you creates an invitation code and passes it to the other, who enters it. The code lasts seven days and can be used once.
A friendship is mutual, and what it opens is broad. A friend can see your username and picture, your list of games and your progress, your unlocked achievements, your feats, and your leaderboard score. Your free-form notes are never shared.
You can remove a friend at any time, from the Friends screen. Access is cut immediately and in both directions: you no longer see their data, they no longer see yours.
So add only people you are willing to show your gaming activity to.
7. Notifications
The application sends no notifications and collects no notification token.
Nothing in the database could store one: the table that would have allowed it existed without any code writing to or reading from it, and it was deleted on 18 August rather than left to sleep.
8. Your rights, and how to exercise them
The GDPR gives you a right of access, rectification, erasure, restriction and objection.
Erasure is immediate and complete, from the application: Profile → Settings → "Delete my account". A confirmation is requested, then everything is deleted — your profile, your library, your achievements, your hunt list, your notes, your feats and your friendships. This is irreversible.
Exporting your data is also done from the application, without writing to us. It produces a JSON file — a structured, commonly used, machine-readable format, as the Regulation requires — containing what we keep about you. Do it before deleting your account: deletion keeps no copy of it.
The shared catalogue of games and achievements is not included: it concerns you no more than anyone else. Nor are your purchases — see section 9, that is an accounting record, not profile data.
Your friendships go in both directions: you also disappear from the leaderboards of those who had added you, without them having to do anything.
Your achievements of course remain on Steam, PlayStation and RetroAchievements; we do not touch them, and deleting your Eukleia account has no effect on them.
Signing out erases nothing: it only closes the session on the device.
For access, rectification or any other request, write to contact@demoos.fr.
You may also lodge a complaint with the CNIL (www.cnil.fr).
9. How long this data is kept
As long as your account exists. It is deleted immediately when you delete your account, with no retention period and no backup copy kept for that purpose.
Technical sign-in data (section 4) expires within minutes.
First exception: purchase transaction identifiers
If you buy the lifetime unlock, we keep the transaction identifier issued by Apple or Google — never your receipt, never a payment method, which we never see at any point. That row survives the deletion of your account, but it is detached from it: the link to your account is erased, and all that remains is an identifier issued by the store, which no longer designates anyone in our database.
Why this exception exists. A purchase receipt is a bearer token: verifying it with Apple proves it is genuine, not that it belongs to you. If we erased that row along with your account, the same receipt could be presented by another account — or by you after recreating yours — and unlock the application as many times as one wished. Account deletion would become a fraud tool.
A consequence worth knowing, and we would rather write it down: if you delete your account and then create a new one, your purchase cannot be restored here. We cannot tell a former buyer from a third party presenting their receipt, and we have chosen to err on the side of refusal. A purchase lost that way is settled with Apple or Google, who do know who paid.
The legal basis for this retention is the legitimate interest in preventing fraud, which the GDPR expressly recognises.
Second exception: the technical shell of a problem report
If you have reported a problem, deleting your account erases the text you wrote — a database operation handles it, in the same transaction as the deletion — and detaches the row from your account.
What remains is kept on purpose, and designates nobody: the version of Eukleia, the version of the system, the device model and the technical log. That is the diagnosis this table exists for; erasing the whole row would lose exactly what we were trying to keep, while protecting nothing more.
The difference with the notes in your hunt list, which go entirely, is this: a report is a request for help you address to us, and the fault it describes concerns others too.
10. Children
The application is not intended for children under 13 and knowingly collects no data concerning them.
No gaming platform account is required to use it. The age conditions that apply are therefore those of the sign-in method you choose — Apple, Google or an email address — and, if you link them, those of Steam, PlayStation and RetroAchievements.
11. Changes
Any substantial change to this document will be signalled by updating the date at the top of the page. This document is published at https://demoosx.github.io/eukleia-legal/, and it is that address which is declared to the App Store and the Play Store.