SpyReel

Privacy Policy

Draft for review · Prepared 30 September 2026 · Analytics section updated 21 October 2026

This draft describes how SpyReel's platform handles account and service information. The controller is SIA Grave Robber Games, registration number 40203348076, VAT number LV40203348076, registered at “Priedes”, Lazdulejas pag., Balvu nov., LV-4592, Latvia. Contact hello@spyreel.dev for privacy questions.

1. Information you provide

When you create an account, SpyReel stores your name, email address, email-verification status and account timestamps. For email registration, your password is stored as a hash rather than plain text.

If you sign in with Google or Discord, SpyReel receives the account identifier, name, email address and verification information made available by that provider. The provider's account identifier is stored to connect it to your SpyReel account. SpyReel does not receive the password you use with that provider.

Onboarding and Account settings can store your work role and selected interests. The service also stores the studios and games you follow, saved games, follow preferences, digest preferences and any studio suggestions you submit. If you contact us, we receive the information you include in your message.

If you choose a paid subscription, Stripe collects payment and billing information, including the billing address and any business tax ID you supply. SpyReel stores Stripe identifiers, subscription and invoice status, billing dates and amounts, and limited payment-method details such as brand, last four digits and expiry. SpyReel does not store full card numbers or card security codes. Billing visits, plan-purchase clicks and checkout outcomes are recorded to understand subscription conversion and diagnose checkout problems.

2. Service and technical information

SpyReel stores session information needed to keep you signed in. Depending on the session configuration, this can include your IP address, browser information and session activity. It also records service timestamps, such as your last activity, Pulse and Watchlist visits, onboarding completion and digest delivery.

Server and security logs can contain request details, errors, account identifiers and technical information needed to operate the service and investigate problems. Internal account notifications can include your name, email address, role, interests, account activity and counts of followed or saved items.

3. Why the information is used

  • Provide the service: create and verify accounts, authenticate access, save research preferences, show changes since a previous visit and provide the Watchlist functionality you request.
  • Account communications: send verification links, password-reset messages and necessary service notices.
  • Optional notifications: send your selected Watchlist digest and honour notification preferences and unsubscribe requests.
  • Operate and protect SpyReel: investigate errors, prevent abuse, administer accounts and keep the service available.
  • Support and legal requirements: answer enquiries, respond to rights-holder concerns and meet applicable obligations.
  • Billing: provide and manage subscriptions, process payments through Stripe, calculate applicable taxes, retain required accounting information and investigate billing problems. Proportionate subscription-conversion reporting supports service administration and improvement.
  • Understand and improve SpyReel: measure how pages and features are used, find where people get stuck and decide what to improve, using the analytics described in section 4. Analytics information is not used for advertising.

Where GDPR applies, providing account features generally relies on performing the service agreement; proportionate security and administration can rely on legitimate interests; legal duties rely on the relevant legal obligation. Consent is used where required for optional communications or non-essential processing. The final notice must confirm the applicable basis for each optional email use.

4. Cookies and external resources

SpyReel uses cookies and similar session mechanisms for authentication, request security and remembering sign-in where selected. Blocking these can prevent account functions from working.

SpyReel uses two analytics services. It does not include an advertising pixel.

  • Google Analytics is loaded on SpyReel's public and signed-in pages to measure visits. It sets its own cookies and receives the pages you visit and technical information such as your IP address, browser and device. Administrator sessions are excluded.
  • PostHog provides product analytics for signed-in accounts. It records the pages you open and how long you stay, how far you scroll, the elements you click and where on the page clicks land (heatmaps), repeated or unresponsive clicks, and which Pulse sections you reach and open. These records are linked to your account identifier, name and email address. Where enabled, PostHog also records sessions: a replay of the page content, mouse movements, scrolling and clicks during your visit, with what you type into form fields masked. PostHog stores an identifier in your browser using a cookie and local storage.

This section does not cover tracking that an external service may carry out when you use that service.

Some pages request fonts, images or other resources from external providers. Playing a YouTube-backed creative loads the YouTube player only when you choose to play it; that request shares technical information, including your IP address, with the provider and can be subject to its privacy and cookie practices. A privacy-enhanced embed does not mean that no data is sent. Google or Discord sign-in also takes you to that provider's service.

5. Service providers and recipients

SpyReel's implementation supports these services, according to the deployment configuration:

  • Hosting, database and storage providers, including Cloudflare R2 for stored creative media, operate infrastructure and deliver files.
  • Resend and Brevo can deliver account emails and digests, receiving recipient details and message content.
  • Slack can receive internal account and operational notifications, including the account information described above.
  • Stripe processes payments, billing details, subscriptions, invoices and applicable tax information. Internal billing notifications can include purchase intent and subscription lifecycle events.
  • Google and Discord participate when you choose their sign-in methods.
  • YouTube, Bunny Fonts and external store-image providers can receive browser requests when their resources are loaded.
  • Google Analytics and PostHog receive the analytics information described in section 4. SpyReel's PostHog project is hosted in the United States.

Access should be limited to the people and providers needed to deliver and administer the service. Information can also be disclosed where required by law or necessary to handle a legal claim. SpyReel does not currently include a feature for selling account profiles or sending user audiences to advertisers.

Some providers may process information outside your country, including outside the EEA. The final notice must confirm processing locations and the safeguards applicable to those transfers; this draft does not assert that particular contractual safeguards have already been put in place.

6. Retention and account deletion

Active account information and preferences are retained while needed to provide your account. You can delete the active account through Account settings, which removes its follows, saved games, active sessions and password-reset records. Weekly digest delivery records contain the recipient address, the briefing period, its content, provider message identifier and delivery attempts. These records help us diagnose sending failures; account-linked digest records are removed when the active account is deleted. Requested test deliveries can have separate records.

The current deletion process also creates an account-deletion record. That record can retain the former account identifier, name, email address, sign-in method, signup and activity dates, who deleted it, the selected deletion reason and any written feedback, and counts of followed or saved items. SpyReel uses this feedback to understand why people leave and improve the service. Internal notifications and logs can contain related information, and backups may retain earlier copies until they are replaced.

Automatic expiry of account-deletion records is not currently defined in the implementation. Retention periods for those records, logs, provider-held information and backups must be confirmed before this notice becomes effective. Contact us to ask about erasure of retained records; deleting an active account does not by itself erase every operational copy.

7. Public market information

SpyReel separately observes public app-store and advertising-library information about games and publishers. This can include public developer names, public contact information, ads, media, availability, charts and store-page changes. Those observations are used for market research and historical context. They are separate from the personal preferences stored in your account.

Public source material can still contain personal data. If material identifies you and you have a privacy or rights concern, contact hello@spyreel.dev with enough detail for us to find it.

8. Your choices and rights

You can change profile details and research preferences in Account settings, disconnect supported social sign-in methods where another sign-in method remains available, stop the weekly digest, and delete your account. You can limit analytics by blocking cookies and site storage for Google Analytics and PostHog in your browser, and ask us to delete the PostHog analytics linked to your account.

Where applicable data-protection law provides them, you may request access, correction, erasure, restriction or portability of personal data, object to processing based on legitimate interests, and withdraw consent for processing that relies on consent. Withdrawing consent does not change the lawfulness of earlier processing. These rights have conditions and exceptions; we may request enough information to verify your identity.

Send requests to hello@spyreel.dev. Where GDPR applies, we will respond within the applicable statutory timeframe and explain any permitted extension. You can also complain to a competent data-protection supervisory authority. SpyReel does not currently make automated decisions about account holders that produce legal or similarly significant effects.

9. Security and updates

The implementation uses password hashing, verified-account access controls and session protections. No online service can promise absolute security. We will handle personal-data incidents in accordance with applicable obligations.

The final notice will state its effective date. We will update it when the platform's processing changes and provide additional notice where required.