DropWatch — Privacy Policy

Last updated: 15 October 2026

DropWatch ("the app", "the website", "we", "us") is a game-deal tracker for Steam and other PC stores: an Android app, and the website at dropwatch.gg. This policy explains what each collects, why, and your choices. We keep it short and honest.

The short version

• No account. No sign-up. You never give us your name, email, or password.
• Your watchlist and settings stay on your phone, and games saved on the website stay in your browser. We don't upload them.
• No ads. We use Google Firebase (Analytics + Crashlytics) to understand usage and fix crashes — that's the only data collected, described below.

What we collect

1. On-device only (never leaves your phone unless you back it up)

• Your watchlist, price targets, region/currency choice, and cached price history. Stored locally on your device. Uninstalling the app deletes it.

2. Analytics — Google Firebase Analytics

• App usage events (screens viewed, features used, e.g. searches, stars, alerts), app version, device model, OS version, approximate region (derived from IP — not precise location), and a random Firebase installation ID.
• Used only in aggregate to see which features matter and improve the app.

3. Crash reporting — Google Firebase Crashlytics

• If the app crashes: a crash stack trace, device state, and OS/app version.
• Used only to find and fix bugs.

4. DropWatch's own price-history service

• To show price and player-count history, the app requests data from our own data service, which runs on Cloudflare.
• Each request contains only the Steam game ID you're viewing and your selected region code (so prices show in your currency). No account, device ID, advertising ID or other identifier is sent.
• As with any internet request, your IP address is visible to the server. We do not use it to build a profile of you, and we do not store it alongside the games you view.
• The service holds only public Steam data (prices, player counts, review totals) — it stores nothing about individual users.

5. Network requests to third-party data sources

• To show deals and prices, the app requests public data from third-party services including Steam, CheapShark, the Epic Games Store, ProtonDB, and a currency-rate API. These requests include your IP address and are subject to those services' own privacy policies. We do not send them any personal information about you.

The website

• No ads, and no third-party analytics or tracking scripts. Two cookies at most: fs, which holds only the date of your first visit, and dw_cc, only if you pick a currency (both below). Every script is served from our own site: our own (saved games, swipe deals, search suggestions, counting page views) and Google's open-source web-vitals library, which measures page speed in your browser and sends nothing to Google.
• We count page views on our own server, to learn which pages are useful and how people find the site. For each page we record the page, the region its prices were shown in, the site or link that sent you there (including the campaign tags on a link, such as utm_source=rss; the address of the page that linked here is kept without its query, the part after "?"), whether you are on a phone or a computer, your browser and its version (such as "chrome/141 android"), its language, how long the page took us to build, and the country your IP address belongs to (looked up in DB-IP's free database; the address itself is not stored). Our script then reports that the page was actually shown on screen — which is how we tell people from bots — along with clicks to a store or another site, games saved or unsaved, swipes, presses of the site's own buttons (such as Copy link or Save all), and script errors. A visitor whose browser sent no language with any page that day is counted as a bot. Searches typed into the site's search are recorded too, to find games we are missing.
• Counting visitors: each page view carries a code made from your IP address and browser with a key that changes every day and is then deleted, so the code cannot be turned back into an address, and the next day's code is a different one. The one thing that lasts beyond a day is the fs cookie below, and it holds a date, not an identifier. Within the day, the same code is how a click to a store or a save is counted under the way you first arrived that day (a search, a link, typed in).
• These records are deleted from the website after 30 days. Each night a copy goes to our own private store (a computer we run, not an analytics company), which keeps the detail for 90 days and then only daily totals. They are not shared or sold. IP-to-country data: IP to Country Lite by DB-IP (db-ip.com), licensed CC BY 4.0.
• Search suggestions are matched in your browser: it downloads one list of popular game names from us, the same for everyone, and what you type is not sent anywhere until you submit the search.
• Saved games stay in your browser (its local storage), not on our server. To show them, the Saved page puts their Steam game IDs in its own address and our server looks up their prices, as it would for a search; it keeps no copy. Clearing this site's data in your browser deletes the list. The list's link, and its price-drop feed for a feed reader, carry the same IDs in the address: anyone you give either link to can see which games are on it, and our server still keeps no copy of the list (the page-view count notes only that a game was saved, as above).
• Games you hide (✕ on a game) are kept the same way, in this browser's local storage and nowhere else, and left out of every list here. Hiding a game, or showing it again, is counted like a save.
• Swipe deals learns what you like from the tags of the games you save and skip. That too stays in your browser's local storage; only each save, skip or undo is counted, as above.
• Steam wishlist check: the profile you enter is sent to Steam to fetch its public wishlist. Steam's answer is cached by our data service for up to 15 minutes, so repeat visits do not ask Steam again, and is then dropped. We keep no record of who checked which profile: the page-view count notes only what the check came to (for example "empty or private"), never the profile.
• Currency: prices are first shown in your country's currency where we have it (ringgit in Malaysia, Singapore dollars in Singapore, US dollars elsewhere), from the same IP-to-country lookup as above; the address is not stored. If you pick a currency at the top of the page, a cookie named dw_cc holding only that choice (for example my) is kept in your browser so every page shows it, until a year after your last visit. It identifies nothing about you, is never used for counting, and clearing this site's cookies, or picking another currency, replaces it. The currency shown is counted with page views, and so is the currency you pick.
• Like any web server, ours records standard access logs — IP address, the page requested, the time and your browser's user agent — which the hosting provider keeps for a limited period for security and troubleshooting. We do not use them to identify or profile visitors, nor for the page-view count above.
• Game art is loaded from Steam's and Epic's image servers, which see your IP address as with any image on the web. Links to other stores go through CheapShark, which credits the store.

Detailed usage logging (from 15 October 2026, reviewed after six weeks)

For six weeks the website records more about how it is used, to learn what helps people find it and use it. Besides the page views above:

• Clicks on our own links and buttons: the button's label and where the link goes (a page here, or only the other site's name, never a full address).
• Reading: how long the page was in front of you while you were using it, how far down you scrolled, and how often you copied text or clicked in frustration (counts only, never what was copied).
• Page speed (Core Web Vitals), measured in your browser.
• Script errors, with addresses, emails and long numbers removed.
• Forms: the names of the forms started and sent (such as "search"), never what was typed into them.
• On-site searches, with emails and phone numbers removed.
• Your screen and connection: the window's size, its pixel ratio, the connection class (such as "4g"), and whether the browser says a program is driving it.
• The fs cookie: one cookie holding only the date of your first visit (for example 20261015), to tell first visits from returning ones. It is set once, never extended, expires after 395 days, and no crawler is given one. Our records keep only how long ago that date was, in the broad steps below, never the date itself.
• What isn't done: no third parties, and the IP address is not stored with these records. There is no code that follows you from day to day: the code that groups one day's pages changes daily, and the date of your first visit is kept only as how long ago it was, in broad steps (up to a day, a week, a month, three months, or longer).
• Retention: 30 days on the website and 90 days in our private store, then daily totals only.

What we do NOT collect

• We do not collect your name, email, phone number, contacts, photos, or precise location. We have no login and no user profiles.

Notifications

• With your permission, we send local price-drop alerts for games on your watchlist. These are generated on your device. You can turn them off any time in your device settings. We do not use them for marketing.

Children

DropWatch is not directed at children under 13. We do not knowingly collect data from children.

Your choices

• Analytics/Crashlytics: uninstalling the app stops all collection. On the website, blocking JavaScript stops our scripts' reports; the server still counts the page request itself. Clearing this site's cookies removes fs, and a browser that refuses cookies is counted as a first visit each time.
• Notifications: revoke the permission any time.

Data retention

Aggregated analytics and crash data are retained by Google per Firebase defaults. On-device data lives until you clear it or uninstall. The website's records: 30 days on the website and 90 days in our private store, then daily totals only.

Changes

We may update this policy. Material changes will be posted here with a new "last updated" date.

Contact

Questions? Email hello@dropwatch.gg.

DropWatch is not affiliated with, endorsed by, or sponsored by Valve Corporation, Epic Games, or any store. All trademarks belong to their respective owners.