Privacy Policy & incorporated notices

We updated the Privacy Policy and the Terms of Service. Optional title logos are now covered, and the Terms explain how anti-cheat systems and game bans work.

• Title logos for the games in your library are optional. Only after you allow them do warmUP servers ask SteamGridDB for a matching logo, and a copy of it may be stored on this device. You can turn title logos off again in Settings under Privacy.
• The Terms of Service now explain that anti-cheat systems, game bans, and other account actions in games are decided by the game publisher, the platform, or the anti-cheat provider, not by warmUP.
• From now on, updated legal documents have to be accepted to keep using warmUP. If you decline, you are signed out until you accept. Declining does not cancel a paid subscription automatically.

The App is built as a local-first game launcher, but several online features use third-party infrastructure and service providers. This Policy names those providers, explains what is sent to them, and describes your choices. It forms part of the Terms of Service.

For privacy requests and legal notices, the responsible party (controller) is warmUP Game Launcher (sole proprietor: Levent Yakin), Paulsborner Strasse 91, 10709 Berlin, Germany. This Policy covers the App, www.warmup-gamelauncher.com, api.warmup-gamelauncher.com, ads.warmup-gamelauncher.com, and other warmUP-operated domains or backend routes that support the App.

Third-party services such as Discord, Steam, Stripe, YouTube, Twitch, IGDB, SteamGridDB, Epic Games, GOG, Amazon Games, OpenRouter, Cloudflare, Supabase, PostHog, and Sentry process data under their own policies when their services are used. We describe our use of them below, but we do not control their independent privacy practices.

Depending on which features you use, warmUP may process the following categories of data:

• Local library and device data: installed games, custom games, emulator entries, launch status, play session metadata, savegame backup metadata, display preferences, controller settings, audio settings, UI settings, and local cache data.
• Account and subscription data: Supabase user ID, email address where you create or sign in to a warmUP account, subscription status, selected plan, Stripe checkout/session/customer identifiers, and authentication tokens needed to keep you signed in.
• Account sign-in records: for each successful sign-in or account creation, the time, whether it was a sign-in or a sign-up, the App version, operating system version, CPU architecture, the pseudonymous installation identifier of the device, and — only where our hosting provider has already resolved it — a two-letter country code. Your IP address is not stored in this record.
• App usage records: for each time you open warmUP while signed in, the start time, the time of the last sign of life, the end time where the App closes normally, the App version, operating system version, CPU architecture, the pseudonymous installation identifier, and — where already resolved by our hosting provider — a two-letter country code. No IP address is stored, and no record is made of which games you own, launch, or play.
• Connected account data: profile identifiers and OAuth/session tokens for services you link, such as Discord, Steam, Epic Games, GOG, or Amazon Games.
• Discovery and metadata data: game titles, IGDB IDs, platform names, genres, tags, artwork metadata, YouTube video IDs, interaction signals such as impressions, clicks, dismissals, and dwell time.
• Title-logo data: after you allow title logos, the game name, a store identifier where the library has one, the backdrop image address used to choose a light or dark logo, the logo file address returned for that game, and a copy of the logo stored on this device.
• Diagnostics and telemetry: event names, screen paths, error messages, crash context, operating system, app version, language, platform, request IDs, latency, status codes, and similar technical data.
• Advertising data: placement, surface, campaign ID, ad ID, request ID, impression/click event type, event time, and cached creative metadata.
• AI data: selected model, token usage metadata, latency, and operational metrics for AI-generated launcher features.
• Network and security data: IP address, headers, device installation identifier, device attestation/session headers, rate-limit keys, logs, and abuse-prevention metadata.

Many App settings and library records are stored locally on your device in SQLite, browser storage, operating system credential storage, or app cache folders. Local data may include library entries, preferences, ad caches, pending ad tracking events, Discord or store session data, discovery personalization signals, and social message history.

Local-first does not mean no network use. When you enable or use online features, the App may contact warmUP backend services and the third-party services listed in this Policy.

We use the following services to run warmUP or optional features:

• Cloudflare: DNS, domain, TLS, proxy, caching, security, and traffic protection for warmUP domains. Cloudflare may process IP addresses, request headers, routing metadata, and security events.
• Coolify: deployment and server administration tooling. Coolify may store or expose deployment metadata, logs, and environment variables to authorized warmUP administrators. If self-hosted, Coolify is tooling on our infrastructure; if Coolify Cloud is used, Coolify also acts as a service provider.
• Supabase: authentication, Postgres database, public metadata caches, subscription status, telemetry tables, OST contribution records, service-role backend operations, and related APIs.
• warmUP backend and Ad Center: api.warmup-gamelauncher.com and ads.warmup-gamelauncher.com handle billing sync, device attestation, YouTube/Twitch/IGDB/SteamGridDB proxying, ad selection, ad creative metadata, impression tracking, and click tracking.
• Stripe: subscription checkout, customer portal, payment processing, fraud prevention, and webhooks. Card and payment method details are handled by Stripe, not stored by warmUP.
• PostHog: product analytics and backend operational events where configured.
• Sentry: crash/error monitoring and user feedback where configured and consented or voluntarily submitted.
• OpenRouter and downstream model providers: AI-generated launcher text. The selected model provider may receive prompts, context, outputs, and request metadata.
• Google / YouTube: YouTube Data API searches, video metadata, embedded YouTube player, and youtube.com links.
• Twitch / IGDB: game metadata, artwork, release information, and Twitch live/discovery data. IGDB is operated by Twitch. What that means for this App is in section 7.
• SteamGridDB: optional title logos. After you allow them, warmUP servers ask SteamGridDB for a matching official logo. The logo file may then load on this device from SteamGridDB. Details are in section 7.
• Discord: OAuth profile connection, parties, social presence, chat, voice, and related Social SDK or API features.
• Steam, Epic Games, GOG, Amazon Games, Ubisoft, EA, Battle.net, and similar platforms: account linking, library import, launcher detection, entitlement checks, or store-specific launch and download flows where supported.
• Optional savegame backup helper: if you choose to install savegame support, warmUP downloads a small third-party helper over HTTPS, verifies it, stores it locally on your device, and runs it as a separate process to detect, back up, and restore local PC game save files. The helper may read local save folders, file names, file metadata, game titles, and backup locations needed for that purpose. warmUP does not send those save files to warmUP servers as part of this local backup feature.
• Weather and browser content providers: if you enable weather, geolocation, or the integrated browser, the relevant external website or API may receive normal browser/network data.

We process data to:

• provide the launcher, library, import, launch, display, controller, browser, and social features;
• authenticate users, manage subscriptions, process payments, and enforce entitlements;
• fetch metadata, artwork, title logos, trailers, soundtrack previews, live streams, news, and recommendations;
• serve, label, cache, measure, and limit advertising and sponsored content;
• operate AI-generated product features;
• debug, secure, rate-limit, prevent abuse, and improve the App;
• respond to support, feedback, legal, copyright, and privacy requests;
• comply with legal obligations and enforce the Terms.

Where applicable law requires a legal basis, we rely on contract performance, consent, legitimate interests, compliance with legal obligations, and protection against fraud or abuse, depending on the feature and context.

warmUP may show sponsored tiles, hero placements, feed placements, house ads, partner ads, subscription upsells, and other promotional content. Sponsored content should be labeled with copy such as “Sponsored” or equivalent in-product labels.

Live ad delivery uses the warmUP Ad Center at ads.warmup-gamelauncher.com. The App requests eligible ads using placement and surface data, then receives creative metadata such as campaign ID, ad ID, headline, call-to-action label, partner name, target URL, image URL, and request ID. Creative images may be cached locally so the UI can continue to render the last served creative when offline.

When a live ad is shown or clicked, the App records an impression or click event. If offline, those events may be queued locally and sent later. Tracking events include campaign ID, ad ID, placement, surface, request ID, event type, and event time. We do not intend to include payment details, private credentials, or precise local file paths in ad tracking payloads.

The free tier includes sponsored placements as part of the product experience. warmUP Ad-Free and Plus offerings may reduce or remove some ad placements only as described in the active product copy at checkout or in the App. Settings do not provide a general switch to disable advertising on the free tier.

If you click a sponsored link, the target site and partner may process your data under their own terms and privacy policies.

warmUP may use the YouTube Data API, YouTube embedded player, Twitch embedded player, and IGDB metadata for trailers, discovery videos, live streams, artwork, ratings, release information, and optional Home soundtrack previews. Title logos for games in your library may be loaded from SteamGridDB. These features are provided by Google / YouTube, Twitch, IGDB, and SteamGridDB and are subject to their respective privacy policies and terms.

To find videos and enrich discovery, warmUP may send game titles, IGDB IDs, search intent, excluded video IDs, and similar non-secret metadata to the warmUP backend. The backend may call the YouTube Data API, IGDB, or Twitch Helix APIs, cache results in Supabase where applicable, and return embeddable video IDs, live channel data, or metadata to the App. API credentials are kept on server-side infrastructure where practical and are not intended to be exposed to the desktop client.

Twitch and IGDB. IGDB is operated by Twitch. Twitch Interactive, Inc. describes its practices in the Twitch Privacy Notice. Twitch says that when its services are used it may automatically collect an IP address, a unique user ID, device and browser types and identifiers, referring and exit pages, software and system type, and information about interaction with the service. It uses cookies and similar technologies. It may use that information to operate, secure, and improve the services, including recommendations, advertising, analytics, and fraud prevention, and it may share information with Amazon companies and with service providers working for Twitch.

IGDB metadata lookups are made by warmUP servers with Twitch API credentials. Those requests carry game titles and related lookup data from our infrastructure. We do not send your warmUP password or payment details to Twitch for this. If you allow embedded previews and game metadata, IGDB artwork and embedded Twitch players load on this device, and Twitch may then receive the automatic information described above from this device.

SteamGridDB (title logos). Title logos are optional. Nothing is requested from SteamGridDB until you choose Allow title logos in onboarding, in the Home prompt, or later in Settings. Choosing Allow title logos is your agreement to this Privacy Policy and the Terms of Service as they describe title logos. Logos are used only to identify and show games in your personal library and may be stored on this device. Game names, logos, and artwork remain the property of their respective owners. warmUP does not claim ownership of that content and is not affiliated with or endorsed by Nintendo, Valve, Sony, Microsoft, or other publishers, or by the Nintendo, Steam, PlayStation, Xbox, or other platforms. You can turn title logos off again in Settings under Privacy. Turning them off stops new downloads.

When you allow title logos, the App sends the game name, and where the library has one a store identifier such as a Steam or Epic id, to warmUP servers, together with the address of the backdrop image used to pick a light or dark logo. warmUP servers then ask SteamGridDB, using a warmUP API key, for an official logo that matches that game. You do not need a SteamGridDB account. We do not send your warmUP account email, password, or payment details to SteamGridDB.

SteamGridDB, LLC operates SteamGridDB. Its privacy policy says that use of its service can produce log data, including an IP address, browser information, the pages or files requested, and the time of the request, and that its website uses cookies. It also says advertising on SteamGridDB may be managed by Playwire, which may use aggregated or anonymized data for advertising, and that service providers may process information to run or analyze the service. The logo lookup is made by our servers, so SteamGridDB receives that request from warmUP infrastructure. The logo file is then loaded on this device from SteamGridDB, which can receive this device’s IP address and ordinary request data for the file. If that host sets a cookie or similar technology, SteamGridDB’s policy applies to it.

Embedded playback and IGDB metadata are a separate choice from title logos. If you do not allow embedded previews and game metadata, warmUP does not transfer data to YouTube, Twitch, or IGDB for those features, shows a placeholder instead of loading embedded players on eligible surfaces, and does not request new IGDB metadata or Twitch live data for discovery. Allowing that choice does not by itself download title logos. If you do not allow title logos, warmUP does not ask SteamGridDB for logos and keeps the game name.

Some features let users suggest YouTube links for soundtrack previews. Suggestions must point to lawful, authorized uploads. warmUP does not host YouTube audio or provide tools to download, rip, or bypass YouTube.

When you use YouTube API Services through warmUP, Google processes your data under the Google Privacy Policy. You can revoke warmUP’s access to your Google account at any time through the Google security settings page.

AI-generated text features may route prompts and context through the warmUP backend to OpenRouter and the selected downstream model provider. Requests may include selected model, token limits, temperature, and operational metadata such as latency, status, token usage, and message count where applicable.

Provider logging and retention can vary by provider, model, account settings, routing options, and law. Do not submit passwords, API keys, payment card data, government IDs, medical records, or other sensitive data through AI features.

AI outputs may be inaccurate, incomplete, unsafe, or outdated. They are not legal, medical, financial, mental health, or professional advice. In emergencies, contact local emergency services or a qualified human support service.

Account sign-in records are separate from the optional telemetry described in the rest of this section. Whenever you sign in to a warmUP account or create one, we record the time, whether it was a sign-in or a sign-up, the App version, your operating system version, CPU architecture, and the pseudonymous installation identifier your device already uses for device attestation. Where our hosting provider has already resolved a country from the connection, we store that two-letter country code. We do not geolocate you ourselves and we do not store your IP address in this record.

We keep this log to secure your account and support you: it lets us and you answer “when and from which of my devices was this account used”, detect account takeover, and reproduce version-specific problems. The legal bases are performance of the contract (Art. 6(1)(b) GDPR) for operating your account and our legitimate interest in the security of the service (Art. 6(1)(f) GDPR). It is therefore not covered by the diagnostics toggle and continues even if you decline optional analytics. It records nothing about your game library, play time, or what you do inside the App, and it is never used for advertising or profiling. You can export the full log at any time through Settings → Privacy → Export my data, and you may object to the processing under Art. 21 GDPR using the contact details in section 16.

App usage records. Separately from the sign-in log, we record when warmUP is opened while you are signed in and roughly how long it stays open. The App reports the start, sends a sign of life every few minutes while it runs, and reports the end when it closes normally; a session whose signs of life stop is treated as ended at the last one, so a crash cannot leave an open-ended record. Alongside it we store the same coarse client facts as above — App version, operating system, CPU architecture, installation identifier, and a country only where already resolved by our hosting provider.

We use this to understand how much warmUP is actually used, to plan what to build next, to size the service, and to report aggregated, non-personal usage figures — for example the total number of active users — to business partners and advertisers. Individual records are never shared for that purpose, and this data is not used to target advertising at you or to build a profile of your interests. The legal basis is our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR). Usage records are deleted after 14 months at the latest, and immediately when you delete your account. You can object to this processing at any time under Art. 21 GDPR using the contact details in section 16, and you can export the records under Settings → Privacy → Export my data.

Diagnostics telemetry is controlled in Settings where offered. When enabled, warmUP may send startup events, screen views, library scan events, launch events, checkout events, feedback events, error messages, crash reports, sanitized context, app version, operating system, architecture, language, platform, and timestamp.

Diagnostics and operational events may be stored in Supabase and/or sent to PostHog. Sentry may receive crash, error, and voluntary feedback data where configured. The App attempts to redact tokens, secrets, emails, file paths, database URLs, webhook URLs, and similar sensitive strings from telemetry payloads, but you should not intentionally include secrets in feedback or error reports.

Product analytics may also be emitted by configured frontend or backend analytics integrations to understand feature usage, detect abuse, measure performance, or operate subscriptions and AI features. Analytics settings and defaults may differ between development, beta, and production builds.

Frame-timing diagnostics (PresentMon): the Performance page measures local frame timing (frames per second, frame pacing, CPU/GPU frame time, and display latency) using PresentMon, a third-party tool by Intel Corporation that warmUP bundles and runs locally on your device as a separate process. This frame-timing data is processed on your device for diagnostics and is not transmitted to warmUP or any third party as part of this feature. PresentMon may require your Windows user to be in the “Performance Log Users” group; capture is best-effort and never blocks launching a game.

If you connect Discord, Steam, Epic Games, GOG, Amazon Games, or another platform, warmUP processes the data needed to authenticate, import your library, show profile or social state, launch games, check entitlements, or disconnect the account. This may include user IDs, display names, avatars, access/refresh tokens, public profile data, game ownership data, installed launcher paths, and library metadata.

OAuth tokens and session data are stored locally or in operating-system credential storage where supported. You can disconnect supported accounts in Settings. The platform provider may continue to retain data under its own policy, and you may also need to revoke access from the provider’s account settings.

Local data remains on your device until you delete it, clear App data, disconnect an account, uninstall the App, or the App replaces or expires the relevant cache. Server-side records are kept only as long as reasonably needed for the purposes described above, including account management, subscription state, security, abuse prevention, audit logs, legal compliance, support, analytics, and product improvement.

Deletion. When you delete your account in Settings → Privacy → Delete account, or request deletion through the public form, your account and personal data are scheduled for permanent deletion and erased within 30 days, except where retention is required by law. In particular, invoices, payment records, and accounting documents are retained for the statutory periods — generally six to ten years under German commercial and tax law (§§ 238, 257 HGB, § 147 AO) — and are blocked from any other use until deleted. Connected account data and OAuth tokens are removed when you disconnect the service or delete your account. Consent records are kept for up to three years so we can evidence your choice, and diagnostics or analytics data for up to 14 months or until you withdraw consent. Account sign-in records (section 9) are deleted at the latest 24 months after the sign-in they describe, App usage records (section 9) at the latest 14 months after the session they describe, and both immediately together with your account when you delete it.

We use reasonable technical and organizational measures such as secret separation, server-side API keys, Supabase Row Level Security, device attestation, rate limits, credential storage, request signing, and redaction. No system is guaranteed to be secure. You are responsible for securing your device, operating system account, linked third-party accounts, and any credentials you enter.

We and our service providers may process data in the European Union, United States, and other countries where they operate. Where required, we rely on appropriate transfer mechanisms such as data processing agreements, standard contractual clauses, adequacy decisions, or equivalent safeguards.

Depending on your location, you may have rights to access, correct, delete, export, restrict, or object to processing of your personal data, and to withdraw consent where processing is based on consent. You can manage many choices in Settings, including diagnostics telemetry, embedded YouTube previews, connected accounts, social notifications, and recommendation reset. Reducing or removing ads is available only through paid subscription tiers where described in the App.

Deleting your profile. If you are signed in, use Settings → Privacy → Delete account to schedule permanent deletion of your account and personal data, and to export a copy of your data first. You can cancel the deletion any time before the purge runs. If you cannot sign in, do not have the App installed, or are a business partner of the warmUP Ad Center, use our public data deletion form — no login required:

https://www.warmup-gamelauncher.com/data-deletion

The form covers erasure, a copy of your data, and corrections. You receive written confirmation of receipt with a reference, we answer within one month (Art. 12(3) GDPR), and verified deletion requests are completed within 30 days except where retention is required by law. Requests by email to privacy [at] @warmup-gamelauncher [dot] .com or by post are equally valid. We may need to verify your identity. If your data is stored only locally, deleting local App data or disconnecting the account may be the fastest way to remove it. Deleting data does not cancel a paid plan — use the cancellation route in Settings or the public cancellation form for that.

warmUP is not directed to children. Where processing relies on consent, the minimum age is 16 in Germany and the European Union (Art. 8 GDPR), or the lower age set by national law (down to 13) where permitted. If you believe a child provided personal data to warmUP without appropriate consent, contact us and we will take reasonable steps to delete it.

We may update this Policy when features, providers, laws, or business practices change. The latest in-app and public versions will show a new effective date. If a material change requires additional consent or notice under applicable law, we will provide it in an appropriate way.

In practice, a material change is announced inside the App: the next time you start warmUP you see a dialog that summarizes what changed, names the date, and asks you to accept the updated Policy and Terms of Service before the change applies to you. The dialog cannot be skipped or closed: you either accept or decline. If you decline, you are signed out and cannot use the App until you accept. The same summary stays at the top of this document. Optional processing that needs your consent, such as diagnostics or title logos, is never bundled into this acceptance; you choose it separately in Settings → Privacy.

Questions, privacy requests, copyright or OST link notices, and regulatory inquiries: privacy [at] @warmup-gamelauncher [dot] .com

Public policy URL: https://www.warmup-gamelauncher.com/privacy-policy

Sections 1–16 are identical to the Privacy Policy shown in the App. This section adds the processing that only happens when you visit www.warmup-gamelauncher.com (the “Site”). Full operator details are in our Imprint.

When you request the free warmUP download on this Site, we store the email address you provide so we can process your download request and manage related account or support follow-up in our CRM.

Separately, you may optionally consent to receive warmUP product updates by email. That consent is never required for the download. If you choose "Receive updates & download", we record your choice (including consent text version and timestamp) so we can demonstrate valid consent. Choosing "Download once. No future updates" means we will not send product-update emails. You can withdraw anytime via the unsubscribe link in any update email or by contacting us.

• Data: email address, signup timestamp, optional product-updates consent (yes/no), consent text version, and referral source.
• We do not sell your email address.
• Product-update emails are only sent when you have given consent.
• Entries are stored in our CRM (warmUP Ad Center / AI Sales Engine) and may be queued via Cloudflare infrastructure.
• Retention: until launch communications are finished, until you unsubscribe, or until you ask us to delete them — whichever comes first, and in any case no longer than 24 months after the last interaction.

When you sign in on warmup-gamelauncher.com, we store an HttpOnly session cookie on www.warmup-gamelauncher.com for the same warmUP account; billing uses your existing Stripe customer record.

If you take part in the creator program, we review publicly posted Reels you tag or share with us on Instagram or TikTok under those platforms' own terms, and verify view counts to grant rewards.

When you interact with the cookie banner, we log a pseudonymous device identifier, the choice and categories selected, the notice version, the page, a truncated IP address, the user agent, and a timestamp, so we can demonstrate valid consent under Art. 7(1) GDPR. These records are stored in the warmUP CRM and kept for up to three years after the consent or its withdrawal. See our Cookie Policy.

On this Site we use Google Analytics 4, a web analytics service provided by Google Ireland Limited (measurement ID G-84WVV8DWCF), to understand how many people visit the Site and how it is used. We only enable GA4 if you accept optional cookies in our cookie banner. The legal basis is your consent under Art. 6(1)(a) GDPR.

We use Google Consent Mode v2. Until you enable analytics, we do not load Google Analytics and no analytics cookies or comparable storage are set. After you enable analytics, GA4 may use cookies or similar technologies to analyse your use of the Site.

Depending on your interaction with the Site, Google may process data such as a truncated IP address, device and browser information, pages visited, time spent on pages, referrer URL, and approximate location derived from the IP address. Google may transfer data to servers in the United States (Google LLC). Where required, we rely on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards for such transfers.

Google typically retains event-level analytics data for up to 14 months, after which it is deleted or aggregated. You can withdraw consent at any time with effect for the future via Cookie settings in the Site footer and by turning analytics off. We then stop collecting new analytics data, delete prior consent-based traffic events linked to your browser's pseudonymous device identifier in our systems, and record the withdrawal in our consent audit log. You can also read Google's privacy policy at policies.google.com/privacy and install Google's browser add-on to opt out of GA measurement: tools.google.com/dlpage/gaoptout.

In addition to GA4, we operate our own consent-based reach and usage tracking at ads.warmup-gamelauncher.com/api/traffic. This service runs only after you enable analytics in the cookie banner. It records page views, interactions, and similar usage events and may store a pseudonymous device identifier and session identifier in your browser. If analytics is off, we do not send usage data to this service.

On the landing page we may show a preview image for a YouTube video loaded from YouTube's image servers (i.ytimg.com). The interactive YouTube player is not loaded until you click play and confirm in a separate consent dialog.

If you confirm, we load the player from www.youtube-nocookie.com (a Google service). YouTube may then process data such as your IP address, device and browser information, video interactions, and approximate location derived from the IP address, and may set cookies or use similar technologies on your device. Google may transfer data to servers in the United States (Google LLC). Where required, Google relies on the EU-US Data Privacy Framework and EU standard contractual clauses as safeguards.

The legal basis is your consent under Art. 6(1)(a) GDPR when you choose "Play video" in the embed dialog. Your choice is stored locally in your browser so you are not asked again for the same video on this device. You can withdraw the effect for the future by clearing site data/local storage for this Site or using your browser's privacy controls; we do not operate a separate YouTube account for you.

Google's privacy policy: policies.google.com/privacy. YouTube terms: youtube.com/t/terms.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For our establishment in Berlin, the competent authority is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit). You may also contact the supervisory authority in your country of residence.