Privacy Policy

Last updated 19 October 2026

Fraglink is a small, independent project that helps you track your game hours and see what your friends are playing. This page explains, in plain words, what we collect, why, who can see it and what you can do about it.

The short version

The app only checks which programs are running and compares them with Fraglink's own games list. It never looks inside your games, your files or your screen.
Hours are only counted while you're signed in and connected to Fraglink. Nothing is tracked or saved up for later while you're offline.
Profiles are public by default (private to start with if you're under 18), and you choose exactly what's shown. You can also make your whole profile private.
No ads, no selling your data, no analytics or tracking scripts.
You can download a copy of your data and delete your account at any time.

Who we are

Fraglink is operated by Lucrona, an individual based in Melbourne, Australia. For anything privacy-related, email support@playfraglink.com.

What the Windows app does on your PC

What it looks at:

Running programs. About every 5 seconds the app checks the names of running programs and compares them with Fraglink's own games list. It downloads that list from our server and refreshes it every 6 hours.
Installed games. To list the games you have installed, it reads the install lists of common game launchers and Windows' list of installed programs. Once on first start, and whenever you press Scan for games, it also looks through the folders games usually live in. It only reads folder and file names, never what's inside your files, and skips Windows and personal folders. The list of games it finds stays on your PC.
Full-screen programs. If an unknown program runs full screen for a while, the app asks once whether it's a game. It only checks the window's size, never what's on screen.
Time since you last used the keyboard or mouse. Just one number from Windows, used only to show you as Away after 10 minutes. It never records which keys you press or where you click, and it doesn't affect your hours.
World of Warcraft realm. While WoW runs, the app reads which realm you're on from WoW's settings file. It's sent along with your game, but our server throws it away straight away: it isn't stored or shown to anyone.

What it never does: read or change game memory, inject anything into games, log keystrokes, take screenshots, or read chat or window contents. That's also why it's safe to use alongside anti-cheat software.

What it keeps on your PC: games it has seen, your play sessions and daily totals, games you've tagged or excluded, your settings, and (when signed in) a sign-in token that's encrypted by Windows. Uninstalling and removing the Fraglink data folder deletes all of it.

Signed out, the app talks to our server only to:

check for updates: shortly after it starts, then every hour, or when you check by hand. Our server logs these requests with your IP address and app version (see "How long we keep things").
download the latest games list.
send a game suggestion, if you answer "Yes" to "Track this as a game?" (see below). It has no account attached.

None of this includes anything else about you or your PC.

What we receive when you're signed in

While the app is running and connected, it sends our server:

Your status: online, away or invisible.
The game you're playing right now, as an id from Fraglink's games list, plus when you started.
For a program you told Fraglink is a game (one that isn't on our list yet): its program file name (for example mygame.exe), so we can review it and add it to the list. Until it's added, everyone else just sees "Playing a game". The name you typed for it stays on your PC.
A small keep-alive message every 30 seconds, so we know you're still connected.

From that connection, our server records your play sessions (which game, when it started and when it stopped). That's how your hours are counted. If you're offline or signed out, nothing is recorded, and the app never uploads time later.

"Share what I'm playing" off: the game is still sent and your hours are still recorded. Your friends just don't see what you're playing.

We never receive your list of running programs, install folders, file names, or anything about non-game apps.

Game suggestions. If you answer "Yes" when the app asks "Track this as a game?", whether you're signed in or not, we receive the program's file name and the name you gave it, with no account attached, so we can review it. Your IP address is only used briefly to stop spam and isn't stored with the suggestion. The names also appear in our server log.

Your account

When you create an account we store:

Email address, to sign in, confirm your account, reset your password and warn you about new sign-ins. We don't send marketing email.
Username, your permanent sign-in name and profile address, and your nickname, the name everyone sees. We keep your earlier nicknames and show the last few on your profile ("Previously known as"), unless you hide them.
Password, stored only in scrambled (hashed) form. We can't read it.
Profile picture, if you upload one or pick a preset. We keep a fingerprint (hash) of uploaded pictures and when you changed your picture. If a picture is removed for breaking the rules, its fingerprint stays on a block list so it can't be uploaded again, even after the account is deleted.
Date of birth, which you give when you sign up. We use it to check you're old enough for Fraglink and to set up the right account for your age (see "Children and teens"). It's private by default. You can choose to show your age on your profile (never the date itself). You can't change your date of birth yourself after sign-up. If it's wrong, email support@playfraglink.com and we'll fix it.
Optional profile details you choose to add: about me, location, country, gaming style, your gaming PC (rig), real name and gender.
Two-step sign-in, if you turn it on: the authenticator secret and your backup codes (scrambled).
Sign-ins: for each browser or copy of the app you sign in with, its name or browser type, its IP address, and when it was created and last used. You can see your active sign-ins (with the IP partly hidden) and sign them out under Settings > Security. For new sign-ins we also record a rough country, worked out on our own server from the IP address (no outside service is asked). A website sign-in lasts 30 days. An app sign-in stays active until you sign out, remove it, or don't use that copy of the app for 180 days.

Friends, profiles and who sees what

Friends see your status, the game you're playing, and (unless you turn it off) your recent games and hours this week. Invisible shows you as offline, with no game, to everyone.
Your profile at playfraglink.com is public by default. Anyone, including people who aren't signed in, can see what your privacy switches allow. Public profiles can also appear in lists on the home page and on leaderboards, and you can share a signature image or a small profile card.
Privacy switches. You choose what your profile shows: what you're playing now, your games and hours, recent activity, friends, achievements, leaderboards, your gaming rig, previous nicknames, the names of your connected accounts (Show connected account names, on by default), and each personal detail, including whether to show your age (hidden by default). The same switches are in the app (Options > Privacy) and on the website, and changing one changes the other.
If you're 13–17, your profile starts private. You can make it public yourself after a short confirmation, and then it works like any other public profile.
Private profile. Turn this on and only your friends can see your profile. You're taken off the home-page lists, and your signature image and profile card are switched off.
Finding you. Any signed-in player can find you in player search by username or nickname, or by typing your exact email address. That includes private profiles. Search shows only your username and nickname, and your email is never shown to anyone. Players you've blocked (or who blocked you) can't find you.
Blocking is silent. A blocked player can't send you requests or see your status.
Reports. Players can report a profile or a profile picture. Reports, including the reported username and the reason, go to our team by email for review.
Sometimes we may limit profiles to friends only for everyone, for example while dealing with abuse.

Linked accounts

You can link other accounts in the app (Options > Connections) or on the website. Battle.net and Discord use their official sign-in, so we never see your password for them. We use the access they give us once to confirm who you are, and we don't keep it.

Battle.net: your account id and BattleTag.
Discord: your Discord user id and display name (or username).
Steam: your SteamID, plus each game's total playtime and playtime in the last two weeks, which we fetch from Steam and refresh once a day if your game details are public there. You can link by signing in through Steam (verified) or by pasting your Steam profile link or SteamID (not verified). If you link by signing in through Steam, we also store your public Steam profile name so we can show it on your profile. If you paste a profile link or SteamID instead, we store only the SteamID, and the link isn't shown on your profile.

Verified linked accounts can show on your profile with their name and icon. If you don't want visitors to see the names, turn off Show connected account names in your privacy settings (it's on by default). The icons and verified ticks still show either way. You can unlink an account at any time. Unlinking Steam removes the link but keeps the playtime already imported. You can remove it by resetting a game's hours or by deleting your account.

Email

Emails we send are account emails only: confirming your email, password resets and new sign-in alerts. They go out from no-reply@playfraglink.com through Cloudflare Email Sending.
Emails you send us at support@playfraglink.com (or hello@) are received and stored in Google Workspace.
Our own admin alerts (for example about new reports or game suggestions) also go to that mailbox. We keep a log of which alerts were sent, with their recipient and subject.

Cookies and browser storage

Signing in. The website keeps you signed in with a sign-in token stored in your browser (local storage), for 30 days.
The fl_session cookie. Signing the app in through your browser, signing in through Steam, and some older pages use one sign-in cookie, fl_session (HttpOnly, lasts 30 days).
Small notes in your browser session, like remembering that you closed a banner.
Sign-up age check. If sign-up is refused because you're under 13, your browser stores a note for 24 hours that stops the form being tried again straight away.
No advertising, analytics or tracking cookies, and no tracking pixels.
Strictly necessary only. Everything above is needed to sign you in, keep the site secure or remember a choice you made, so we don't need to ask for consent and there's no cookie banner.
Bot checks. The website's sign-up, sign-in and forgot-password forms use Cloudflare Turnstile. Turnstile can see your IP address and browser details.
Country flags on profiles are served from our own server, so no outside service is contacted for them.

Where your data lives and who else gets it

Your data is stored on our server in Sydney, Australia, hosted by BinaryLane.
Cloudflare provides our domain, sends our emails and runs the Turnstile bot check.
Google Workspace holds the emails you send us and our admin alerts.
Battle.net, Discord and Steam are only contacted when you link those accounts, or to refresh linked Steam playtime.
Game icons and pictures are fetched by our server and served from our own domain, so your app and browser don't contact other image servers for them. These fetches don't include anything about you.
We don't sell, rent or share your data for advertising. We'd only disclose it if Australian law requires us to.

Outside Australia. Cloudflare (email sending, bot checks, domain) and Google (our support mailbox) may store or handle some of your information in other countries, including the United States. We only use providers with strong security and privacy commitments, and we take reasonable steps under Australian Privacy Principle 8 to make sure they protect your information.

How long we keep things

Your account and its data: for as long as you keep your account.
Deleted accounts: removed for good 7 days after you ask (see below).
Backups: we back up the database every night (around 3:30 AM Sydney time) and before updates. Backups stay on our own server and are deleted when they're about 14 days old. So data you delete, or a deleted account, is gone from backups within about 14 days.
Your current status: we only keep your latest status, not a history.
Sign-ins: website sign-ins last 30 days. Copies of the app you haven't used for 180 days are signed out and have to sign in again. Signed-out and expired sign-ins (with their IP address, browser details and country) are deleted 30 days later, and all of them go when you delete your account.
Admin records: a log of actions our team takes (for example a ban or a name change: who did it, to which account, and what changed) is kept permanently and keeps the username even after an account is deleted.
Logs: update checks are logged with IP address and app version in a small log that rotates (about 50 MB in total). Our server log is capped at 200 MB and holds account ids, admin actions and game suggestions. Older entries are overwritten as new ones come in.

Your choices and rights

Download your data: Settings > Account lets you download a copy of your data (once an hour). It includes your account details, linked accounts, play sessions, imported hours, game stats, friends, your privacy settings and the app sign-ins on your account. It doesn't yet include your profile details, picture, earlier nicknames or website sign-in history. Ask us for those and we'll send them. The app can export its local data too.
Correct it: change your nickname, email, profile details and privacy switches at any time, and reset a game's hours.
Delete your account: in Settings, with your password (and two-step code if it's on). You're signed out everywhere straight away. The account is deleted for good after 7 days. Signing in again within that time cancels it.
Stop sending: sign out in the app. Nothing about you is tracked while you're signed out.
Ask us: email support@playfraglink.com to access, correct or delete your information, or with any question. We'll reply within 20 working days (about a month).
Wherever you live (including the US, Canada and Brazil), you can ask us for any of the rights on this page by emailing us.
Complaints: if you're not happy with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au). (EU and UK: see below.)

Australia. Fraglink is a small hobby project, but we aim to follow the Australian Privacy Principles (APPs) in the Privacy Act 1988 in how we collect, use, store and share your information. We never sell or trade your personal information.

If you're in the EU or UK

Anyone can use Fraglink, wherever they live. If the GDPR or UK GDPR applies to you, here's how it works.

Why we use your data (lawful bases)

For almost everything, including teen accounts, our legal basis is providing the service you signed up for (contract), not consent. Consent only covers the optional extras listed below.

To provide Fraglink (contract): your account, tracking your hours, friends, your profile, linked accounts and account emails.
To meet our age rules and protect young players (legal obligation and legitimate interests): your date of birth, and the extra protections on minor accounts.
To keep Fraglink safe and working (legitimate interests): sign-in records, bot checks, logs, backups, rate limits, and handling reports and bans.
Because you chose to (consent): optional profile details (like real name or gender), showing your age on your profile, your profile picture and linking other accounts. You can remove them or unlink at any time, and that doesn't affect anything we did before.

Your rights

Access: ask what we hold about you.
Correction: fix anything that's wrong (most of it you can change yourself in Settings).
Deletion: delete your account in Settings, or ask us.
Objection: object to how we use your data for legitimate interests, and we'll stop unless we have a strong reason to continue (for example keeping a ban in place).
Portability: download your data in a machine-readable format from Settings > Account.
Complaint: contact your local data protection authority (for example your national regulator in the EU, or the Information Commission in the UK, formerly the ICO, at ico.org.uk).

To use any of these, email support@playfraglink.com. We'll reply within 20 working days (about a month).

If you're in New Zealand

We aim to follow New Zealand's Privacy Act 2020. Our privacy officer is Lucrona (support@playfraglink.com). If you're not happy with our answer, you can complain to the Office of the Privacy Commissioner (privacy.org.nz).

Security

Passwords and sign-in tokens are stored scrambled (hashed), the app's token is encrypted by Windows, the site runs over HTTPS, and you can turn on two-step sign-in.

If a data breach is likely to cause you serious harm, we'll tell you as soon as we can, and tell the regulators where the law requires it. Sign-ins, searches and friend requests have limits to stop abuse.

Children and teens

You need to be at least 13 to use Fraglink, wherever you live, including the EU and UK. When you sign up, we ask for your date of birth. We don't check ID. We use your data to provide the service (contract), not on the basis of consent, so we don't ask for a parent's permission.

We don't knowingly collect information from children under 13. If the date of birth you enter at sign-up shows you're under 13, sign-up is refused and no account is created. Your browser then remembers this for 24 hours so the form can't simply be tried again straight away.

If you're 13–17, your account is marked as a minor account and your profile starts private. You can make it public yourself in your privacy settings, after a short confirmation. Once it's public, it works like any other public profile: it can appear in lists on the home page, on leaderboards and in search. You can switch back to private at any time. When you turn 18, your account automatically becomes a normal account and keeps whatever setting you had, so a private profile stays private until you choose to make it public.

You can't change your date of birth yourself after sign-up. If it's wrong, email support@playfraglink.com and we'll fix it.

Accounts made before we asked for a date of birth are treated as adult accounts and asked to add one. If the date added shows the person is under 13, the account is locked straight away and flagged for our team, and an admin reviews and closes it. This isn't automatic.

If we learn in any other way that someone is under 13, we lock the account straight away, and an admin closes it after a review. Parents can email support@playfraglink.com and we'll close their child's account.

Credits

IP Geolocation by DB-IP (https://db-ip.com), licensed under CC BY 4.0. We use their free country database on our own server and refresh it monthly.

Changes to this policy

If we change this policy, we'll update the date at the top. For bigger changes, such as collecting a new kind of data, we'll tell you in the app and on the website before they take effect.

Contact

support@playfraglink.com