Privacy notice

Who we are

Most Wishlisted is built by Focal Point Advisory, based in Australia. This is a testing release: a small number of game studios use it by invitation, signed in with an access code. If you have a question about this notice or your data, send us a message through our contact form or email us at hello@mostwishlisted.com.

Studios using the app

When a studio uses Most Wishlisted, this is what we collect, why, where it lives, and how connected accounts and cookies work.

Our founder can see every studio’s workspace: the names and contact emails on its access codes, its games and the files in them, its asset kit, website, press kit, Steam page, launch plan and posts, and its consult bookings and feedback. We look only to help the studio, for example to spot something that’s stuck or broken, or to prepare for a consult it has booked, and to get in touch with it about its work here. Nothing is changed, posted or approved from that view, and we don’t share what we see there with anyone else. That view doesn’t show the post numbers we read from a studio’s accounts (see “Post numbers on your Steam numbers timeline” below). Those appear only to the studio they belong to.

What we collect, and why

• The studio’s name and its access code, so we know which studio is asking. The code itself is stored as a hash, never as plain text.
• The games it adds: a name, and a Steam app id if it gives one.
• The media it uploads (video and images) for its posts and its game site.
• The posts it drafts: captions, titles, notes, and which platforms they’re for.
• The choices a studio makes on a game’s guided journey: which steps it has ticked as done (and when), the side quests it has added, the wishlist goal and launch date it sets, its answers on first run (which side quests it said it was thinking about, and when it answered), which lines it has switched on or off on its wishlist chart, which levels it has already seen celebrated, and any reminders it has snoozed. These are kept for that game only, to show the studio its own progress.
• The platform accounts it connects, so it can post directly (Instagram, TikTok, Discord, Bluesky and YouTube) or, for Threads and Facebook Pages, only so it can read post numbers. See “Connected accounts” below.
• A record of who approved each post before it went out (the label on the access code that approved it, for example “Founder”), and of every attempt to publish it, so a studio can see why a post did or didn’t go out.
• The numbers on its posts, read from the accounts it connects, the public accounts it adds and the post links it pastes, with each post’s id, time and link. See “Post numbers on your Steam numbers timeline” below.
• Numbers a studio types in itself for a post, and the events it adds to its game’s timeline, such as a demo, a discount or a creator’s video.
• If a studio adds someone else’s public post or account: its link, time and public numbers, the author’s handle, and a label made from the post’s title or the author’s display name. See “Other people’s public posts a studio adds” below.
• If a studio builds a game website with us: its content, and the visitor emails and page insights described below.
• Press and creator contacts a studio adds for its own outreach: a name, an outlet or platform, a way to reach them, and any notes it adds. This is the studio’s own list, for its own outreach, the same as its game site’s email list below: it decides who to add and how to contact them, and is responsible for that under its own obligations.
• A contact email for the person an access code is for: added by us, once a studio gives it to us, so we can get in touch with the right person.
• If a studio books a paid consult with our founder: the email address it gives us, the topic and notes it enters, and which of its games, if any, the consult is about.
• If someone backs a studio’s insider offer: the email Stripe collects to take the payment, and any note of support they add, both kept for that studio only. See “The insider offer” below.
• Feedback it sends us from inside the app: whether it’s a bug, an idea or a question, its message, the page it was sent from, and a screenshot if it attaches one.

We collect this to run the app: to store a studio’s games, media and posts, to let it connect and post to its own accounts, and to keep an honest record of what was approved and posted, and to show a studio how its posts line up with its Steam numbers.

Where studio files are stored

Uploaded media is stored privately by default. Only the studio it belongs to, and our founder when helping it (see above), can reach it. Every file is checked against the studio’s own access code, or the founder’s, before it’s served, and links to it are short-lived signed URLs, not public addresses.

Once a studio publishes a game website or press kit, the media that page actually shows is also served from a public, cacheable address, because it’s already shown to anyone who visits the page. That copy is removed when the studio unpublishes the page or deletes the file, though copies already cached by visitors’ browsers or networks can take time to expire. Everything else stays private.

Connected accounts: Instagram, TikTok, Discord, Bluesky, YouTube, Threads and Facebook Pages

When a studio connects Instagram, TikTok, Discord, Bluesky, YouTube, Threads or a Facebook Page, we store the platform account’s id and the name or username shown in the app, plus what’s needed to use it: an access token and refresh token (Instagram, TikTok, YouTube, Threads, Facebook), a webhook URL (Discord), or an App Password and session (Bluesky). For a Facebook Page we store the Page’s id and name, and the app-specific id Meta gives us for the person who connected it. That secret is encrypted (AES-256-GCM) before it’s stored, and only decrypted for the one request that uses it.

Threads and Facebook Pages are connected only so we can read post numbers. We never post to either, and the app refuses to publish through them. Instagram, TikTok and YouTube connections can also be used to read the numbers on a studio’s posts, with a permission asked for when it connects. Posting through any connection still needs a person to approve that exact post, as described below.

Instagram, Threads and Facebook Pages (Meta). For each post we read its id, when it went up, its link and its type, and its numbers. For Instagram that is views, accounts reached, likes, comments, shares and saves. For Threads it is views, likes, replies, reposts, quotes and shares. For a Facebook Page it is reactions, comments, shares and, where Meta gives them, media views. We keep none of the captions, text, pictures, videos or comments, and not who liked, replied or reacted. We use these only to show them to the studio that connected the account. We don’t use them for advertising or to build profiles of people, and we don’t sell them. Meta handles the data on its side under its own privacy policy.

TikTok. For each of a studio’s public videos we read its id, when it went up, its link, and its view, like, comment and share counts. We don’t read the video’s caption or comments, or the studio’s followers. We show these only to the studio that connected the account, use them only to run the app, and delete them when access ends.

Nothing is ever posted to a connected account without a person actively approving that exact post first. Editing the caption, the media or the settings after approving means it needs approving again: the app checks this every time, not just once.

A studio can disconnect an account at any time from Connections in the app. See our data deletion page for exactly what disconnecting does and how.

YouTube

Most Wishlisted uses YouTube API Services. By connecting YouTube or using our YouTube features, you agree to be bound by the YouTube Terms of Service. Google’s Privacy Policy explains how Google itself handles your data.

What we access, use, store and share. When a studio connects YouTube, Google asks it to let us upload videos to its channel (only when a person has approved that exact post), see its YouTube account (its channel name, and its videos with their public numbers) and see its YouTube Analytics reports (each video’s daily views, likes, comments, shares, watch time, and subscribers gained and lost). We use this to upload the studio’s own approved videos, to show its channel name, and to show it the numbers on its own videos next to its Steam numbers. We store the channel’s id and name, the connection’s tokens (encrypted) and the details of its videos described below. We share none of it with anyone except the services that run the app, listed under “Who processes the data”.

Limited Use. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements. We use it only to upload the studio’s own approved videos, show its channel name and show it the numbers on its own videos, in the screens it can see in the app. We don’t transfer it to anyone else except to provide those features, for security, or to follow the law. We don’t use it for advertising, we don’t sell it, and nobody here reads it unless the studio asks us to look, or we have to for security or the law.

What we keep from YouTube. For each video we keep its id, when it went up and its link, and a title that we refresh or clear within 30 days. Until YouTube approves our app for storing statistics, we don’t keep YouTube’s numbers at all: we ask YouTube for them when a studio opens its timeline and show them. We never write them down. Our server may hold them in its memory for a few minutes, so that opening the timeline again doesn’t ask YouTube again, and then forgets them. After YouTube approves it, we will keep a connected channel’s numbers while it stays connected, check every 30 days that the studio’s permission still works and the video still exists, and delete what’s left if either has changed. Numbers read with our own key, for a public video or channel a studio adds, are never kept for more than 30 days.

Taking our access away. A studio can remove our access to its YouTube account at any time on Google’s permissions page, https://security.google.com/settings/security/permissions, or by disconnecting YouTube in the app, which also asks Google to revoke our access straight away. If a studio disconnects in the app, we delete the YouTube data we hold for that account within 7 days. If it removes our access on Google’s page, we delete it within 30 days. The same goes if Google stops accepting our access for another reason, such as a sign-in that has run out: we delete what we read through that account within 30 days, and ask the studio to sign in again, and if it doesn’t within a week we delete the connection too. If it asks us to delete it, we do so within 7 days. Deleting our copy doesn’t change anything on YouTube.

Agreeing first. Before we read any YouTube numbers for a studio, someone in it has to read and agree to a short notice in the app that says the same things as this section. We ask again whenever this privacy notice changes.

Questions or complaints. About how we handle YouTube data or anything else here, use our contact form or email hello@mostwishlisted.com.

Steam numbers, our browser extension and tracking tags

Steam numbers you upload. If you upload reports from Steamworks (your game’s daily wishlist report and its UTM Analytics report), or send them with our browser extension, we keep those numbers for your studio only: each day’s wishlist adds, deletes, purchases and gifts, each tagged link’s visits, wishlists and purchases, and when each report came in. We use them to show you your own timeline and reports, and nothing else unless you separately opt in. They’re never shown to another studio, and never sold or shared. If you opt in to helping improve Steam watch’s estimates, your wishlist numbers may also count towards an average across many studios that never identifies you or your game. You can remove everything you’ve uploaded for a game at any time from its Steam numbers page, and it all goes when you delete the game or your studio. We store these numbers in our database in Sydney, with the rest of your studio’s data, and the wishlist chart on your game’s Home screen is drawn from them.

On a game’s Steam numbers page, you can opt that game in to Most Wishlisted’s running total: the wishlists each opted-in game gains while it’s opted in, added up across every studio that opts in. It’s off by default. We never show which games it came from, or any game’s own numbers, only the single combined figure, and not until enough studios have opted in for it to mean something. You can switch it off any time, and that game stops counting from then.

Our browser extension. The Most Wishlisted extension for Chrome and Edge only acts when you click it. On your Steamworks wishlist or UTM Analytics report page, it reads that report’s numbers and sends only those to your Most Wishlisted account. It never reads other pages, never changes anything in Steamworks, and never sees your Steam password. It keeps a pairing token in your browser, which you can remove at any time from the Steam numbers page; we keep only a scrambled copy of it (a hash), with your browser’s name and when it was last used.

Tracking tags on links to your Steam page. Unless you switch it off for a game, we add UTM tags (utm_source, utm_medium, utm_campaign and utm_content) to the links to your game’s Steam page in your posts, emails, game website and press kit. The tags say where the link was (a platform, an email or a page) and carry a short code for the post or email, never anything about the person who clicks. Valve counts visits from those links in your own Steamworks reports; we don’t track the people who click them.

Post numbers on your Steam numbers timeline

A studio can see the numbers on its posts on its game’s Steam numbers timeline, next to its Steam wishlist numbers, so it can see what happened around each post. We get the numbers from four places.

• Accounts the studio connects: Instagram, Threads, a Facebook Page, TikTok and YouTube, as described above. We read the posts a studio makes through the app and, if it switches on “Show posts I made outside the app” for an account on a game, the posts we find on that account.
• Public sources the studio adds: a Bluesky account or post (we ask Bluesky’s public API, with no sign-in), or a YouTube channel or video (we ask YouTube’s public data service, with our own key). We read only what anyone can see.
• Post links the studio pastes: to fill in the title and author, our server asks that platform’s public embed lookup about the link (YouTube, TikTok, X and Bluesky, and Reddit only while we’ve switched its lookup on). That sends the pasted link to that platform from our server, so the platform sees our server, not the studio’s address or browser. For a YouTube link, the small picture shown with it loads straight from YouTube’s image servers into the studio’s browser, so Google can see its IP address and browser details, the same as for the pictures beside Steam search results. We read the time a TikTok or X post went up from the numbers in its link.
• Numbers the studio types in itself, for platforms we can’t read yet, such as X, or whenever it prefers.

For a post we can read, we take its numbers 1 hour, 6 hours, 24 hours, 72 hours, 7 days and 30 days after it goes up, and not after that. We look for new posts on switched-on and public accounts every 6 hours. We read nothing for a studio, including the numbers behind a pasted link, until someone in it has agreed to the in-app stats notice.

For each post we keep its id on the platform, when it went up, its link, its type (a Reel or a Short, for example), a label, its numbers at each reading with the date and time of the reading, and a plain note if a reading failed. For a post a studio adds by link we also keep its author’s handle, and for a public account a studio adds, the account’s handle and id. We never keep what a post says, what people said on it, its pictures or video, or who liked or reacted. The one thing close to this is a post’s label.

A label is one of two things. It is a name the studio typed, up to 120 characters. Or it is a suggestion we make when a studio pastes a post link, which the studio sees before it saves and can change. If the platform’s embed lookup gives the post a title, the suggestion is that title, cut to 80 characters: a video’s title on YouTube, a post’s title on Reddit, or, for a TikTok video, its caption. If the platform gives no title (X gives none), the suggestion is made from the platform and the author instead, such as “X post by Sam Lee” (the author’s display name, or their handle if there is no name), cut to 80 characters. That display name is kept only inside the label.

A label the studio typed, or changed, is the studio’s own and stays until it removes the label or the post. A label we suggested and the studio left as it was, and the author’s handle, are looked up again about every 29 days. We clear them if the platform no longer gives them or we can’t reach it, so none is kept for more than 30 days without a fresh look.

Only the studio the numbers belong to sees them: whoever signs in to that studio with one of its access codes. We never pool them with other studios’, show one studio’s to another, or use them on public game sites, in Steam watch’s estimates, in Most Wishlisted’s running total or in investor material. We don’t use them for advertising, we don’t sell them, and we don’t share them with anyone except the services that run the app (see “Who processes the data”). Our founder’s admin view of a studio doesn’t show them.

How long we keep them

• While the account stays connected. If a studio disconnects an account in the app, we delete the numbers read through it, and the posts we found on it that the studio didn’t post or add itself, straight away, and within 7 days at the latest.
• If access is removed at the platform. If someone removes us in Instagram’s, Threads’, Facebook’s or TikTok’s own settings, or asks Meta to delete their data, we revoke the connection and delete the same within 7 days.
• If a sign-in runs out. We keep the numbers for 30 days so a studio that signs in again doesn’t lose its history, and delete them if it doesn’t. YouTube is different: what we read through a YouTube account whose sign-in ran out is deleted sooner (see “YouTube” above).
• YouTube. See “YouTube” above.
• Titles, display names and handles we took from a platform are looked up again about every 29 days, and cleared if the platform no longer gives them or can’t be reached, so none is kept for more than 30 days without a fresh look. A label the studio typed or changed stays until it removes it.
• A Bluesky post that has gone (it’s missing from two readings in a row) is marked gone, and its numbers are deleted.
• Numbers a studio typed in, and events it added, stay until it removes them, or deletes the game or its studio.
• When a game or a studio is deleted, everything for it goes.

A studio can remove a post it added, and its numbers, from the game’s Posts page, and remove a typed number one at a time. Hiding a post we found on an account only hides it. To delete the posts found on an account, and their numbers, remove the account on the game’s Accounts page, or disconnect it.

If a studio asks us to delete its post numbers, or anything else that came from a platform, we do it within 7 days, and everything else within 30 days. To ask, use our contact form or email hello@mostwishlisted.com.

Other people’s public posts a studio adds

A studio can add a link to someone else’s public post, such as a creator’s video about its game, or add a public Bluesky or YouTube account to follow. The author hasn’t signed up to Most Wishlisted and we can’t contact them ourselves, so this section is our notice to them, under Australian Privacy Principle 5.

Who we are. Focal Point Advisory, based in Australia. You can reach us through our contact form or at hello@mostwishlisted.com.

What we collect, and where from. The post’s link, when it went up, its public numbers (such as views and likes), the author’s handle, and a label for the post. The label is the post’s title if the platform gives one (for a TikTok video, that is its caption, cut to 80 characters). If it gives none, as X does not, the label is made from your display name, or your handle if you have no name, such as “X post by Sam Lee”. Your display name is kept only inside that label. The studio sees the label before it saves it and can change it, and a label it has changed is the studio’s own. We get all of this from the platform’s public sources when a studio adds the post or account: its public embed lookup, Bluesky’s public API, or YouTube’s public data service. We can’t see anything that isn’t public.

Why. Only so the studio that added it can see how the post lines up with its Steam numbers. No law requires us to collect it.

Who sees it. Only the studio that added it. We don’t sell it, add it to any list of creators, or share it with anyone except the services that run the app (see “Who processes the data”).

How long. We look up the title, display name and handle again about every 29 days, and clear them if the platform no longer gives them or we can’t reach it, so none is kept for more than 30 days without a fresh look. A label the studio has changed stays until it removes it. The post’s link, which can include your handle, and its numbers stay on that studio’s timeline until the studio removes the post, the game or its account.

Where it goes. We store it in Sydney with Vercel and Supabase, both United States companies. A lookup sends the link to the platform that hosts the post (Google for YouTube, TikTok, X, Bluesky, and Reddit only while its lookup is on), mainly in the United States.

To have a post removed, or to see or correct what we hold. Use our contact form or email hello@mostwishlisted.com with the link to your post. We remove it from every studio’s timeline within 7 days and tell you when it’s done. To complain, see “How to complain” below. Your post stays public on its own platform whatever we do.

Your own AI assistant

You can connect your own AI tool, like Claude Code or Cursor, to your studio with a token you make in Settings. What it reads through that connection (your games, plans, stats and drafts) goes to that tool’s provider under your agreement with them, not ours. It can’t see other studios, anyone’s email address, or your press and creator contacts. It can only draft: nothing goes out without a person approving it. We keep only a scrambled copy of each token and log which tools were used, never what they read or wrote, for 90 days. You can revoke a token at any time. It can’t read the post numbers described in this notice.

Cookies

The studio app sets two essential cookies. Essential means the app can’t work without them. The first is the sign-in cookie that remembers which studio you’re using the app as: without it, the app can’t tell who’s asking. The second holds only the id of the game you last had open, and is limited to the app. It lets the shortcuts on your home screen, and sharing something to the app from your phone, open the right game. It lasts up to a year, is sent to our server with requests to the app, and our server only uses it if that game is one of your studio’s own. We don’t set analytics or advertising cookies in the studio app.

The app also remembers a few display choices in your own browser’s storage, like whether help hints are on. Those never leave your browser. The game you last had open is kept there too, and the cookie above is a copy of it that our server can read.

Two more cookies exist for narrow jobs, and most people will never be given either. Our founder’s admin tools use a cookie that remembers which plan the founder is previewing the app as; only the founder’s own sign-in can set it. If emailed sign-in links are switched on, asking for one sets a cookie that lasts as long as the link does (15 minutes) and remembers which browser asked, so a link opened in a different browser asks you to confirm first. Neither is used for tracking or advertising.

We run a lightweight usage tracker in the studio app itself, so we can see which screens are useful and where studios get stuck, and improve the product. It records:

• Which screen you open, as a general pattern (for example “a game’s website tools”), never the address itself or a game or post id.
• How long a screen stays open before you move to another one or the tab is hidden, and whether you saved anything on it in that time.
• Which help topic you open in the guide panel.

It never records a form value, anything you typed, your keystrokes, or a recording of your session. It sets no cookies of its own, beyond the cookies already described above, and no localStorage or sessionStorage: just a random id held in memory for that visit, gone once you close the tab. It records no IP address and no user agent string, and nothing at all if your browser sends Do Not Track or Global Privacy Control. We keep this raw data for 90 days from when we receive it, then delete it automatically. Each record is linked to your studio’s account, so we can see where a studio got stuck and offer to help. It’s never sold, shared or used for advertising.

People who visit a studio’s game site

If a studio builds a game website with us and you visit it or sign up on it, your email address (and your consent to hear from the studio) is collected for that studio, not for us. The studio decides what to do with its list, for example emailing you about the game, and is responsible for that under its own privacy obligations. We store the list on the studio’s behalf, and a studio can export it at any time.

A published game site can be found by search engines unless you switch that off in the website editor.

If a studio’s game site shows its Steam trailer, images or short loops, or a YouTube video, your browser loads them straight from Valve’s or Google’s servers, so Valve or Google can see your IP address and browser details when you open the page. The first trailer may start playing without sound on its own once the page has loaded, unless your device asks for reduced motion, has data saving on, or is on a slow connection. That happens under their privacy policies, not ours.

We also run a page insights tracker on these sites, so a studio can see how its page is doing and improve it. It records:

• Page views, which sections you reach, how far you scroll, and the average time each section stays on your screen (capped, so leaving a tab open in the background doesn’t count).
• Which trailer or screenshot you open, how long a trailer plays while it is on your screen, and whether you turn its sound on. Which highlights on the first screen you tap, and which parts of the About section reach your screen, and for how long (capped, like the sections above).
• Where on the page you click: which section, the position within that section as a percentage (not a precise pixel location), and the clicked element’s role or visible label, for example “button: Wishlist now”. For a form field this is its label or placeholder, never anything typed into it. We also work out whether clicks look like a “rage click” (several fast clicks in one spot) or a “dead click” (a click on something that isn’t actually clickable), so a studio can spot confusing parts of its page.
• Whether you focused the signup form’s email field and whether you completed it, so a studio can see where people give up partway through.
• A referral code or campaign tag if your link had one, and a general device type (phone, tablet or desktop).

It never records a form value, anything you typed, your keystrokes, or a recording of your session. It does not use cookies or browser storage: just a random id held in memory for that visit, gone once you leave. It records no IP address and no user agent string, and it records nothing at all if your browser sends Do Not Track or Global Privacy Control. We keep this raw data for 90 days from when we receive it, then delete it automatically. It is never used to identify you.

People who visit Most Wishlisted’s own pages

We run the same kind of page insights tracker on our own site, including the home page, so we can see how people use it and improve it. It records:

• Page views, which sections you reach, how far you scroll, and which buttons and links you press.
• Where on the home page you click: which section, the position within that section as a percentage (not a precise pixel location), whether you clicked a link, button or form field or empty space, a short name for what was clicked (for a button, the name we gave it, such as “header-cta”; otherwise just its type, such as “button”), and how long after the page loaded you clicked. We use this to draw a heatmap of which parts of the page get clicked, and to spot parts that confuse people.
• A referral code or campaign tag if your link had one, the website you came from (its name only, never the full address), and a general device type (phone, tablet or desktop).

It never records what a button or link says, a form value, anything you typed, your keystrokes, or a recording of your session. It does not use cookies or browser storage: just a random id held in memory for that visit, gone once you leave. It records no IP address and no user agent string, and it records nothing at all if your browser sends Do Not Track or Global Privacy Control. It is only used to understand how the page is used, and is never used to identify you, sold, shared or used for advertising. We keep this raw data for 90 days from when we receive it, then delete it automatically.

Meta Pixel and ads tracking

A studio running paid ads (Meta, TikTok, Reddit or others) can choose to add a Meta Pixel to its game site, so it can see how well those ads are working. This is the studio’s own choice: most game sites on Most Wishlisted do not have one.

When a site has one, you see a small banner before anything loads. Nothing happens until you accept it: the Pixel is not loaded, and nothing is sent to Meta, unless you say yes. Your choice is remembered on your own device (in your browser’s local storage) so you are not asked again on that site. If your browser sends Do Not Track or Global Privacy Control, the banner never appears at all.

If you accept, the Pixel records that you viewed the page, and, if you sign up with your email, that you did. To help Meta count that signup accurately even if the Pixel is blocked by your browser, our server separately sends the same signup event to Meta’s Conversions API: this includes your email (hashed with SHA-256, never sent in plain text), the page’s address, and, as Meta requires, your IP address and browser’s user agent string. We pass those two straight to Meta and do not store either of them ourselves.

Meta processes this under its own privacy policy, as the studio’s advertising platform. We do not control what Meta does with it beyond this one event.

The insider offer

If you back a studio’s insider offer, Stripe collects your email address to take the payment: it goes straight to the studio’s own connected Stripe account, and the studio, not us, is the seller. We keep a copy of that email and any note of support you add, for that studio only, so it can see who backed it and thank them properly. It’s never shown to another studio, never sold or shared, and the studio can export its own list of backers at any time.

The waitlist

• Your email address, when you join the waitlist.
• The optional answers you give us about your studio and your game, if you choose to share them. That includes an optional link to your game’s Steam page or website, or the Steam page you pick when you type your game’s name.
• Where you came from: a referral code and any campaign tags in the link you used.
• Anonymous page activity on this site, as described under “People who visit Most Wishlisted’s own pages”: no cookies, and no localStorage or sessionStorage, just a random id held in memory for that visit.

We use this to tell you about early access and launch news, and to shape the product around what studios actually need before we build the wrong thing.

If you give us a link to your game’s Steam page or website, we store it with your other optional answers and use it to prepare a game profile for you and to decide who to invite first. We do not open or fetch it automatically when you join: we only read it ourselves, and if you are invited and add a game, we offer you that Steam page, and nothing is imported until you confirm it. If you type your game’s name into that box instead, the text you type is sent through our server to Steam’s public store search to find the page. It goes from our server, not with your address, your browser details or any cookie, and we do not keep what you typed against your email address. Steam’s own results come back to you, and only the page you choose is stored. The small pictures beside those results load in your own browser from Valve’s image servers, so Valve sees your IP address and browser details for those pictures.

Pressing “Join the waitlist”, under the sentence next to it that says what you’re joining, is your consent to hear from us about early access and launch news. There’s no pre-ticked box to miss. We also send you a one-time link asking you to confirm it’s you (double opt-in): it’s a plain message with nothing promotional in it, we send at most three to one address, and if you don’t click it, we treat you as not yet confirmed and email you less, not more. Every message we send you can be stopped: reply with “unsubscribe” or write to hello@mostwishlisted.com, and we’ll remove you.

The contact form

• The message you write, your email address, and your name if you choose to give one.
• Nothing else is attached to it: we don’t record your address or browser details with the message. To limit abuse, the server keeps a few counters in its memory: messages and form opens from each connection address, messages from each email address (the email address only as a scrambled value), and one total for the day, which holds no personal information. A short-lived signed timer checks that the form was open for a moment before sending, and it carries a scrambled value of your connection address so that it only works from the connection that opened the form. None of that is written to a database. Each count starts again after an hour (the day’s total after a day), and the server forgets all of them when it restarts, which on our host is usually within hours.

We use it only to reply to you. We don’t save it in this site’s database. The message is emailed through Resend to our mailbox, with your address as the reply address, and that mailbox, and Resend’s own delivery log, are where it sits. We don’t send anything to you automatically, and we don’t add you to any list. We keep a message only as long as we need to reply and follow up, and delete it sooner if you ask.

Who processes the data

• Our hosting provider (Vercel) runs the app on servers in Sydney, and our database provider (Supabase) stores this data in Sydney. Both are United States companies, and Vercel’s global network may route requests, and keep short-lived logs of them, outside Australia.
• Steam (Valve) answers a game name searched in the waitlist or new game box, and a public store page when a studio imports one. We ask from our server, signed out, and send only the text typed or the app id chosen. The small pictures beside the search results load in your own browser from Valve’s image servers, so Valve sees your IP address and browser details for those pictures.
• Resend sends the emails this app sends: a game site’s signup confirmations, this waitlist’s confirmation link, our beta invitations (which carry an access code), messages sent through the contact form (to our own mailbox), and a studio’s own campaigns to people who’ve confirmed and haven’t unsubscribed. Resend keeps its own copy of each message under its own policy. When an email bounces or is reported as spam, Resend tells us and we record that against the address, so it isn’t emailed again.
• Instagram, TikTok, Discord, Bluesky and YouTube only ever see a post’s content once a studio has connected that account and a person has approved that exact post. Separately, those platforms, and Threads and Facebook, are asked for the numbers on a connected account’s posts, as described above. They see our requests (which account, which post), not the rest of a studio’s data.
• When a studio pastes a post link, our server asks that platform’s public embed lookup about it (YouTube, TikTok, X and Bluesky, and Reddit only while we’ve switched its lookup on). We send the link that was pasted, and nothing else about the studio. The platform sees our server, not the studio’s address or browser. For a YouTube link, the small picture shown with it loads in the studio’s own browser from YouTube’s image servers, so Google can see its IP address and browser details.
• Bluesky’s public API and YouTube’s public data service answer the lookups for public accounts and posts a studio adds. They are sent a handle or a post id, and nothing else.
• Google Calendar only ever sees a consult booking’s time, the email address the invite goes to, and its topic, notes and game, to create the calendar invite and video call link.
• Stripe processes payment for a paid consult booking, and any refund of one. For a studio’s insider offer, a backer’s payment goes straight to that studio’s own connected Stripe account: we never hold or see the money, only the email and note described above.
• We don’t send anything collected under this notice to an AI model ourselves. If you connect your own AI assistant, see “Your own AI assistant” above.
• We don’t sell data, to anyone, ever.

Several of these providers are based overseas, mainly in the United States: Vercel and Supabase (even though this app’s servers and database are in Sydney), Stripe, Google (including YouTube and Google Calendar), Meta (Instagram, Threads, Facebook and the Meta Pixel), TikTok, X, Discord, Bluesky, Reddit (only while we have its embed lookup switched on) and Resend. Using them can mean your information is processed there, under that provider’s own security standards. We only ever send each one what its one job needs, as described through this notice, and never more.

How long we keep it

We keep a studio’s data for as long as it’s testing with us, except where this notice sets a shorter time, as it does for post numbers (see “Post numbers on your Steam numbers timeline”) and YouTube data (see “YouTube”). If a studio stops testing, we delete its data within 30 days. If it asks us to delete its data, we delete anything that came from a platform, such as post numbers, within 7 days, and everything else within 30 days. Waitlist details are kept until you ask us to delete them, and we delete them within 30 days of you asking. Unsubscribing from our emails stops them and keeps your address on a do-not-email list so it stays that way, but it doesn’t delete your signup or your answers. If you have unsubscribed, your address stays on that list even after a deletion, so we never email you again. Contact form messages are kept only as long as we need to reply and follow up. The raw page insights and heatmap data described above are kept for 90 days from when we receive them, then deleted automatically, whatever else is happening with the studio’s account. A game’s journey choices are deleted when the game or the studio is deleted.

How to complain

If you have a privacy question or complaint, tell us first through our contact form or at hello@mostwishlisted.com. Focal Point Advisory is based in Australia. If you’re unhappy with how we’ve handled your personal information and we haven’t resolved it, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

If you’re in the European Economic Area or the United Kingdom

Focal Point Advisory is based in Australia and is the controller of the information this notice describes, except for a studio’s own game site list and its outreach contacts, where the studio itself decides what to do with the list and is the controller for that part. We rely on your consent for the waitlist, a game site’s signups and the Meta Pixel; on our agreement with a studio to run its account and the tools it uses; and on our legitimate interest in keeping the app secure and improving it, which covers the usage tracker and error logs. You can ask to see, correct, export or delete your information, object to or withdraw consent for any of it, and complain to your own country’s data protection authority, at any time, by using our contact form or emailing hello@mostwishlisted.com. Our data protection contact for the EEA and the UK is hello@mostwishlisted.com, or use our contact form.

See also our terms.