152-FZ

Personal-Data Processing Policy

Revision of June 27, 2026

1. General provisions

This Personal-Data Processing Policy (the “Policy”) is drawn up in accordance with Federal Law No. 152-FZ of 27.07.2006 “On Personal Data” (“152-FZ”) and defines the procedure for processing personal data and the measures the Operator takes to ensure its security.

The personal-data operator is individual Ilya Igorevich Tovstogray (the “Operator”), who runs the giftdeck.xyz website (the “Site” or the “GIFTDECK Service”). Contact address for personal-data inquiries: foreign.tubers@gmail.com.

The Operator processes personal data on a lawful and fair basis. Using the Site means the user agrees to this Policy. If the user disagrees with the Policy, they must stop using the Site.

2. Key definitions

Personal data — any information relating to a directly or indirectly identified or identifiable individual (the personal-data subject).
Processing of personal data — any action or set of actions with personal data (collection, recording, systematization, accumulation, storage, updating, use, transfer, anonymization, blocking, deletion, destruction).
User — a person who uses the Site.
Steam — a gaming service owned by Valve Corporation; the user links their Steam profile to their account on the Service (after sign-in) for the game features.

3. What personal data is processed

The Operator processes the following categories of data:

3.1. Account data (for signing in to the Service):

the username chosen by the User;
the password — stored only as a cryptographic hash (the scrypt algorithm); it is not transmitted to, known to, or stored by the Operator in plaintext. Email and phone are not requested.

3.2. Data obtained from the Steam account when it is linked (via the Steam OpenID protocol and the public Steam Web API; linking happens after signing in to the Service). The Steam password is not transmitted to or processed by the Operator:

the Steam identifier (SteamID);
the display name (nickname) and the Steam profile address;
the profile image (avatar);
the country stated in the profile;
the Steam account creation date;
if the library is public — information about the composition and number of games (for checks and giveaway-eligibility conditions).

3.3. Data the user provides themselves:

“about you” information, preferred region, gift budget (range and currency);
game-genre preferences, the list of wanted games (wishlist);
profile visibility and participation settings (readiness to be a “rescue” gifter, etc.).
day and month of birth — at the User’s option. The year of birth is neither requested nor processed; age cannot be derived from the stored date. The date is visible only to Users who have added its owner to their “Circle” and is used solely to remind them of the birthday. The User may hide or delete the date at any time; while hidden it is shown to nobody and no reminders are sent;

3.4. Data generated through use of the Service:

event applications, formed gift-exchange pairs, gift history;
participation in giveaways and “Wheel” spins, earned rewards and badges;
messages in private and group chats (stored for a limited time — see section 6), reports and blocks;
comments on gifts in the public feed — the comment text and the author’s account name. A comment is posted voluntarily and is readable only by Users signed in to the Service; unlike chat messages it is stored indefinitely — see Section 6;
when anonymous key delivery is chosen — the game activation key entered by the gifter. The key is not personal data, but it belongs to the User's content and is processed with heightened protection: it is stored only in encrypted form, disclosed solely to the recipient, and deleted after the exchange is completed (see sections 6 and 10);
notifications.

3.5. Technical data: for security, the Operator records the fact of significant actions in an audit log — which action, in relation to which account, and when (by internal account identifier). The IP address is used only temporarily, in memory, to limit the number of sign-in attempts (protection against password brute-forcing) and is not written to the database; no persistent log of IP addresses or User-Agent strings is kept.

The Operator does not request or process full name, passport data, phone number, address, payment details, or other excessive data.

4. Purposes of processing personal data

authorizing the user and providing access to the Service;
matching pairs for anonymous game exchange and running events;
organizing public gifts, giveaways, the “Wheel”, leaderboards, and badges;
messaging between users and content moderation;
ensuring security, preventing abuse and rule violations;
informing the user via in-app notifications.

5. Legal grounds for processing

the personal-data subject's consent to processing (Art. 6(1)(1) of 152-FZ), and for publicly available (public) data — consent to sharing (Art. 10.1 of 152-FZ);
the need to perform an agreement to which the user is a party (the Terms of Use);
the Operator's legitimate interests in ensuring the operability and security of the Service, without infringing subjects' rights.

6. Procedure, conditions, and terms of processing

Processing is carried out both with and without automation. The Operator performs on personal data the actions listed in section 2, to the extent necessary for the purposes in section 4.

account and profile data are stored for as long as the user's account exists on the Service;
chat messages are shown to users for 24 hours; a copy is kept for moderation for no more than 3 days, after which it is automatically deleted;
comments on gifts are stored indefinitely — until deleted by their author, by the participants of the relevant gift, or by the Operator, and until the author’s account is deleted or blocked, upon which all of their comments are deleted;
with anonymous key delivery, the encrypted activation key is stored only until the corresponding exchange is completed and is automatically deleted afterward; the key itself is not stored or logged by the Operator in plaintext;
audit-log entries are kept for a limited time for security purposes;
when an account is deleted (at the user's request or upon blocking for violations), the associated personal data is deleted or anonymized.

7. Data storage and localization

The recording, systematization, accumulation, storage, updating, and retrieval of the personal data of citizens of the Russian Federation are carried out using databases located within the Russian Federation, in accordance with part 5, Art. 18 of 152-FZ. The infrastructure is hosted at Timeweb (data center in Moscow, Russian Federation).

8. Transfer of data to third parties and cross-border transfer

The Operator does not sell personal data and does not transfer it to third parties, except as provided by law and in the following cases necessary for the Service to operate:

Valve Corporation (Steam) — when linking a Steam profile, the Steam identifier is used to obtain the profile's public data. This involves a cross-border transfer of data (USA). The transfer is carried out to the minimum necessary extent, solely to confirm profile ownership and for the game features.
Donation service (CloudTips) — when making a voluntary donation, the user goes to a third-party payment service's website, which acts as an independent operator with respect to the data entered there. The GIFTDECK Operator does not receive or store payment data.

9. Cookies

The Site uses only strictly necessary cookies that enable sign-in and security (the session token and cross-site request forgery protection during authorization). Third-party analytics, advertising, and tracking cookies are not used. Disabling the necessary cookies in the browser will make sign-in impossible.

10. Security measures

The Operator takes legal, organizational, and technical measures to protect personal data (Art. 18.1, 19 of 152-FZ), including:

storing the password only as a cryptographic hash (scrypt) — the password is never stored or logged in plaintext; brute-force protection (limiting the number of sign-in attempts);
linking Steam without transmitting the Steam password to the Operator (the OpenID protocol);
cryptographically signed sessions (HTTP-only cookie) with the ability to revoke all at once;
data transfer over a secure connection (HTTPS); protection of sign-in forms and actions against cross-site request forgery;
minimizing technical data: the IP address is used only for brute-force protection (temporarily, in memory) and is not written to the database;
encrypting the transmitted activation keys at rest and deleting them after the exchange is completed; the key is never stored or logged in plaintext;
limited storage periods for messages;
restricting access to data and keeping an action log;
deleting the profile when an account is blocked.

11. Rights of the personal-data subject

The User has the right to:

obtain information about the processing of their personal data;
demand the updating, blocking, or deletion of data if it is incomplete, outdated, inaccurate, or processed unlawfully;
withdraw consent to the processing of personal data;
delete their account and the data associated with it;
appeal the Operator's actions to the authorized body for the protection of personal-data subjects' rights (Roskomnadzor) or in court.

To exercise these rights, send a request to foreign.tubers@gmail.com. You can also delete your account yourself under “Profile”. The request is considered within the periods established by 152-FZ.

12. Minors

The Service is intended for persons who have reached 18 years of age and is not aimed at children. The Operator does not deliberately collect data of persons under 18. If it becomes known that a minor's data was obtained without the consent of legal representatives, such data will be deleted.

13. Changes to the Policy

The Operator may change this Policy. The current revision is always available at https://giftdeck.xyz/legal/privacy. Material changes affecting consent may require re-confirming consent at sign-in.

14. Contacts

Operator: Individual Ilya Igorevich Tovstogray. For all personal-data processing matters: foreign.tubers@gmail.com.