Privacy Policy
Last updated: October 2026
This policy explains what personal data NextWishlist collects, why, and your rights. NextWishlist is operated by Etienne Pin-Claret, sole proprietor (France), SIRET 981502578, 59 rue Henri Beque, 78160 Marly-le-Roi, France ("we"). Contact: privacy@nextwishlist.com.
1. What we collect today
NextWishlist is currently in pre-launch: the website offers free tools and a waitlist.
| Data | Purpose | Legal basis (GDPR art. 6) | Retention |
|---|---|---|---|
| Email address, optional role and Steam page URL (waitlist form) | Inform you about the launch and invite you to the beta | Your consent (unticked checkbox) | Until you unsubscribe, or 3 years without interaction |
| Proof of consent (text accepted, date) | Demonstrate your consent | Legal obligation / legitimate interest | Same as above |
| Website style you were shown when you joined (Pro or Pixel) | Compare which website style works best | Legitimate interest | Same as above |
| Style poll: the style you vote for, and a keyed fingerprint of your IP address (irreversible HMAC; the address itself is never stored) | Count one vote per person | Legitimate interest (a fair poll) | Fingerprints are deleted when the poll ends |
| Technical logs (IP address, browser, pages, timestamps) kept by our hosting provider | Security and abuse prevention | Legitimate interest | Up to 12 months |
The free tools (Next Fest calendar, wishlist calculator) run without an account and do not store what you type.
We do not sell your data, we do not use it for targeted advertising, and we never use it to train AI models.
2. When the service launches
The NextWishlist service will, only with your explicit authorization, read data from accounts you connect, in read-only mode:
- Steam: aggregated wishlist and sales reports of the game you declare, through Valve's official Steamworks API, using a key you create and can revoke at any time. Valve provides aggregates only — no personal data about players.
- Social platforms (YouTube, X, Bluesky, Reddit where available): your own posts and their public metrics, through official OAuth access you can revoke at any time.
- Tracking links: clicks on links you share are counted without cookies. Visitor IP addresses are never stored in clear text; a daily identifier is computed with a salt deleted every 24 hours.
This section will be detailed further before the service opens, and you will be informed of any change.
3. What we do with your data
We keep data for one reason: to give you better advice and to improve our tools.
- The private data of your game (Steam reports, connected accounts) is used to build your dashboard, reports and recommendations.
- It is never sold, rented or traded, never handed to other developers, publishers or data brokers, and never used to compete with you.
- To improve our benchmarks and tools for everyone, we may use aggregated, de-identified statistics in which no game, studio or person can be recognised.
- It is not used for advertising, and we never train AI models on it.
4. Processors and transfers
Your data is stored in the European Union (database: Supabase, EU region). The website is delivered through a content delivery network: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA (website delivery network). Database: Supabase (EU region). Our processors (hosting, email delivery, and, once the service launches, an AI provider used only on numerical summaries) are bound by data processing agreements. When a processor is located outside the EU, transfers rely on the EU–US Data Privacy Framework or on the European Commission's Standard Contractual Clauses.
5. Your rights
You can access, correct, delete or export your data, object to processing, restrict it, and withdraw your consent at any time by writing to privacy@nextwishlist.com. We answer within one month. Every email we send includes an unsubscribe link. You can also lodge a complaint with the French data protection authority (CNIL, www.cnil.fr) or your local authority.
6. Cookies
We use no advertising, analytics or cross-site tracking cookies. The website only sets first-party preference cookies, which last 12 months and are never used to track you:
nw-skin: the website style you see (Pro or Pixel). On your first visit it is picked at random, so that both styles are shown equally; you can switch at any time with the toggle at the top of the page.nw-mode: light or dark mode, only if you change it (otherwise we follow your device setting).nw-voted: remembers that you already voted in the style poll.
7. Security
Encryption in transit (TLS) and at rest, strict access control, and encrypted secrets. See our Security page.
8. Children
The service is intended for adults (18+).
9. Changes
We will notify significant changes by email to waitlist members and on this page.