Privacy & cookies
Steamy measures unique browsers with first-party site analytics. You can disable and delete your analytics in Cookie settings.
Basic visit statistics
The public counter shows unique browsers active during the last 24 hours, using a random first-party visitor cookie. Repeat visits from the same browser count once. Different browsers on the same Wi-Fi count separately. The database saves a hash of the visitor identifier and its last-seen time for up to 31 days; it does not use IP addresses or browser fingerprints to group visits. Clearing cookies or switching browsers can count the same person again. JavaScript is required. This is a count of browsers, not people.
We count page loads for all visitors, including when optional analytics is off or rejected. This counter stores daily page totals for 90 days and minute totals for up to 25 hours for aggregate reports. The separate page-total records contain no visitor identifier, IP address or fingerprint. Counts are not linked to detailed analytics, accounts or giveaways. Refreshes and repeat visits count again; these totals do not identify unique people. JavaScript must be enabled, and browsers or blockers can prevent counting.
First-party site analytics
Unless you disable site analytics, Steamy assigns a random, HTTP-only visitor identifier to measure sessions and unique browsers in the admin analytics. The identifier is hashed before it is stored. These records are pseudonymous, not linked to your account. These detailed reports reflect browsers with analytics enabled, not every visitor.Steamy NSFW does not load Google Analytics or another third-party analytics tag.
What is measured
When analytics is enabled, the site records pseudonymous sessions and page paths, including the first page in each session, coarse device and browser categories, referral hostnames, standard UTM source, medium, campaign, term, and content labels, scroll depth, engaged time, and clicks to Steam, demos, Discord, and creator links. Outbound clicks retain their destination hostname and UTM labels. It does not store raw IP addresses, full user-agent strings, precise locations, arbitrary query strings, or the path and query from an external referring page.
If an advertising link arrives without UTMs, the site can recognize the presence of a Google, Meta, Microsoft, TikTok, X, or LinkedIn click parameter to classify its source. The advertising click identifier itself is discarded and never stored.
Detailed analytics sessions and events are retained for up to 90 days. The lightweight unique-browser count retains its hashed last-seen record for up to 31 days. Evidence of analytics consent (hashed visitor identifier, notice version and choice time) is kept for up to 90 days after the last analytics activity.
Your control
Open “Cookie settings” at the bottom of any page and choose “Disable & delete mine” to stop optional collection. The anonymous daily page total continues. Rejecting deletes analytics history and consent evidence associated with the current browser from the active database and expires its visitor cookie. Choices last 180 days. Your browser’s Do Not Track and Global Privacy Control signals also stop site analytics. A previous opt-out remains respected. Automatic collection is not recorded as an affirmative consent choice.
Accounts and external services
Signing in uses the provider you select. Game metadata and images come from Steam, and outbound creator links open the destination selected by that creator. Those services apply their own privacy terms when you use them.
Reddit sign-in requests only your account identity: your Reddit account ID, username and avatar. It does not request posts, comments, messages or subreddit subscriptions. Reddit does not provide your email address through this connection. The account ID identifies your sign-in method, and its access token is encrypted at rest. Connecting Reddit to an existing account requires signing in to that account first.
If you connect itch.io for creator verification, the site requests only your public itch.io profile and the list of games you develop. The access token is encrypted at rest and is used only to verify and refresh those games. Draft and unpublished games are never shown publicly. Disconnecting itch.io deletes the token and its ownership records from Steamy NSFW.
Connecting Patreon for membership giveaways requests your public account identity and creator pages, including published creator names, images, URLs and eligible tiers. It does not request member lists, membership history or email access. Access and refresh tokens are encrypted and used to verify and refresh creator information. Disconnecting removes those tokens and imported profiles from the active database. Previously donated prizes, their creator details and review records remain available for giveaway delivery; earlier connection data may remain in protected backups until those backups expire. Patreon applies its own privacy terms when you authorize a connection or redeem a gift.
Community chat
Anyone can read this site’s community chat, including visitors without an account. Only signed-in members can post. Your chosen nickname, messages, posting times and online status are publicly visible. Until you choose a nickname, the online list uses a generated Player name, not your login name or email. Developer verification is not required. Each site has its own separate chat.
The live conversation keeps only the latest 100 messages. You can delete your own messages; administrators can remove messages and suspend abusive accounts. Earlier or deleted messages may remain in routine rolling database backups until those backups expire. Online status is based on an active, visible site tab and expires within approximately 90 seconds of losing contact. A first-party, HTTP-only session cookie deduplicates guest browsers across tabs; only a site-specific hash and recent activity are stored for this count, not raw IP addresses. Guests join the presence count only when they open chat. Guest presence expires after approximately 90 seconds and stale records are cleaned as visitors check in. Guests are shown only as a count, never as individual profiles. The unread-message badge keeps a last-read message number in your tab’s session storage, so it survives navigation without saving chat text or creating an account. Chat works independently of optional analytics.
Links to public pages on this site can show a preview using our existing catalogue data. Chat does not fetch external links or run embedded HTML. Preview artwork may load from Steam or itch.io image servers without sending the chat page as a referrer.
Daily giveaways
Entering a giveaway stores your account reference, entry time and public nickname (or your generated Player name). If you win, the prize and that entry name are announced publicly. Your email, sign-in details, Steam key and private gift redemption link are not part of that announcement. Steam keys and Patreon gift links are encrypted in the database. Winners can reveal their own prizes; site admins can explicitly reveal inventory for verification. Admin reveals record the account and time in a private audit.
To prevent multiple accounts from increasing giveaway odds, we group entries that share a network address or giveaway browser cookie into one draw chance. A winning group has one eligible account chosen randomly. Shared networks can include different people. We store keyed, day-specific hashes of these signals, not raw IP addresses, and delete them with completed entry records after 90 days. The first-party, HTTP-only giveaway browser cookie lasts up to one year and is independent of optional analytics.
Verified Steam developers can privately submit keys for their own games. We store the submitting account, public nickname, confirmation time, game and optional developer credit for scheduling. Steam key format is checked automatically; no activation or manual review is required. Only scheduled giveaway information and the optional credit become public, not the submission history. Pending keys can be withdrawn before scheduling. Withdrawn or rejected key contents are cleared from the active inventory; submission counts and review records remain, and protected backups expire under the normal rotation.
Connected Patreon creators can privately submit native membership gift links. The site opens the Patreon gift page without redeeming it to check the creator, tier, value, duration, availability, remaining redemptions and non-expiring status. Only verified, non-expiring gifts with exactly one redemption remaining are eligible. Scheduled creator profiles, tier names, durations and prize notes are public; gift links and connection tokens remain private. Unscheduled gifts can be withdrawn. Admins can inspect submitted gifts and save private verification notes. Creators receive in-site alerts for blocked gifts. Checks reflect Patreon’s response at that time and cannot guarantee later availability. Patreon generates and redeems the gifts; revealing a link in Inventory does not itself redeem it on Patreon.
Entry lists for completed giveaways are cleaned after 90 days. Results, aggregate entry counts and encrypted prizes are retained so winners can return to their account for their prizes. Older records may remain in protected rotating database backups until those backups expire. Giveaways operate independently of optional analytics; keys, private gift links and clicks on the private redemption links are not sent to analytics.
Why we use this data
Accounts, favourites, creator connections and prize delivery process the data needed to provide the features you request. Optional detailed analytics relies on your consent. Basic traffic measurement, security, abuse prevention, moderation and giveaway fairness rely on our legitimate interests in understanding overall traffic and operating a safe service. You can object to this processing using the contact below; browser privacy signals also disable the unique-visit estimate. We use legal obligations where a valid legal requirement applies. We do not sell your personal data or use your activity to build advertising profiles.
Shared IP addresses or devices may cause giveaway entries to share one draw chance. This is automated anti-abuse processing, not a determination of someone’s identity. Contact us if you believe it has treated you unfairly.
Services and retention
Hosting providers process technical data needed to deliver and secure the site. Signing in or connecting a creator service shares the data needed with the provider you select. Images and media can load from Steam, itch.io or their delivery networks, which receive your network address. Playable third-party games load only when you press play. External websites have their own privacy and cookie policies.
We retain account, favourite, creator ownership and inventory records while needed to operate your account and deliver prizes. Contact us to request deletion. Security and moderation records may be retained where needed for abuse prevention or legal obligations. Deleted records can remain in protected rotating backups until replaced. Providers may process information outside your country; applicable transfer protections and provider agreements must cover those transfers.
Your rights and contact
Privacy contact for Steamy NSFW: indiensfwgames@gmail.com. You can request access, correction, deletion, restriction or a portable copy of your data, object to processing based on legitimate interests, or withdraw consent. We may ask you to verify control of your account and normally respond within one month. Withdrawal does not affect earlier lawful processing.
You can also complain to your local data protection authority. In Malta, this is the Information and Data Protection Commissioner.
This site is intended for adults 18+. Its entry prompt records an age declaration; it does not verify age or collect identity documents. If you believe a child has an account or personal data here, contact us.