Last updated: 16 April 2026.
ggto.win is a Steam looking-for-group board. We collect the minimum Steam and listing data needed to log you in, show your LFG posts, let other players contact you through Steam, and understand site traffic if you accept analytics cookies.
We do not ask for your Steam password. Steam login happens on Steam. We do not sell personal data. We do not store payment data, private Steam messages, Steam inventory, friend lists, bans, or full owned-game history.
Steam acts as the OpenID provider. After you approve login, Steam returns your 64-bit SteamID. ggto.win uses that ID to create your local account session.
Steam login does not give ggto.win your Steam username or password.
When you sign in, we call Steam Web API GetPlayerSummaries so listings can show a real Steam profile. We may store:
If you press Sync public library, we call Steam Web API GetOwnedGames for games visible through your Steam privacy settings. Steam may return AppIDs, game names, and playtime.
ggto.win only uses that response to add popular game records to the site game index. We do not store your personal owned-game list or your playtime linked to your account.
When you create a listing, we store the fields you submit: game, title, region, timezone, language, availability, optional date range, voice preference, voice tools, party size, skill level, playstyle, mode or role, notes, status, expiry, and timestamps.
Open listings are public and can appear on search pages, game pages, player pages, and search engines. Closed or expired listings stop appearing in normal search, but may remain stored for account history and abuse review until deleted.
When a signed-in player clicks a contact action, we store the post ID, sender SteamID, receiver SteamID, selected action, and timestamp. This helps measure interest and investigate abuse.
Actual conversation happens on Steam. ggto.win does not read, send, or store Steam messages.
We use a secure session cookie to keep you logged in and protect forms. Session data is kept for up to 30 days unless you log out sooner.
Google Analytics only loads after you accept analytics cookies. If accepted, Google may set first-party analytics cookies to distinguish visitors and sessions.
If you accept analytics cookies, we use Google Analytics 4 to understand page views, traffic sources, devices, approximate location, and site usage. We do not send SteamIDs, Steam names, LFG notes, or custom user IDs to Google Analytics.
Google says Analytics IP masking is built in for Google Analytics properties and IP addresses are not logged or stored. Google Analytics may still process browser, device, page, referrer, event, and approximate location data.
Core site data is stored and served through Cloudflare-hosted infrastructure. Steam processes Steam login and Steam Web API data. Google processes Google Analytics data if you accept analytics cookies. Discord processes data if you use the floating support link.
Secrets stay server-side. We use standard protections for login sessions and form submissions.
No internet service is risk-free, so avoid putting sensitive personal data in public LFG notes.