Security & data

Wishmail reads your own Steam sales and wishlist data through a Steamworks Web API key you create for it. This page says exactly what that involves.

What we ask for

One Steamworks Web API key with the Financial permission only, restricted to our egress IP 51.15.72.79. That permission exposes all sales data of your partner account; Wishmail stores rows only for the apps you choose to track and discards the rest.

How the key is stored and used

Encrypted at rest with AES-256-GCM under a data key unique to your studio; that data key is wrapped by a server key that is not stored in the database and is backed up offline.
Only the collection worker decrypts it, only to call Steam, always from the fixed egress IP, and only in the request header. It is never written to logs or shown back to you (only its last four characters).
A rejected key (HTTP 403) is never retried; you are told and can revoke it. Revoking deletes the ciphertext immediately.

What we collect and keep

Per tracked app: daily sales rows as Steam reports them (units, USD, country, platform, currency, discount) and daily wishlist totals with country and language summaries.
Personal data: your email, your studio name, a Stripe customer id if you subscribe, and an audit log of account actions. No names, no addresses, no card details (Stripe handles payment).
Retention: data stays while the app is tracked and the studio exists. Deleting a studio removes keys at once and all remaining data after 30 days. Web server logs with IP addresses are kept for 30 days.

Where it runs and who else is involved

Scaleway (France, EU): servers, database, backups. Database backups are encrypted at rest on the host and kept for 30 days.
Stripe: subscriptions, invoices, VAT. Resend: transactional email (sign-in links, digests). Valve: the Steamworks Web API we read from.
Discord or Slack only if you add a webhook; the URL is stored encrypted like a key.

Your controls

Export everything as one file, or delete the studio or your account, from Data & privacy in settings.
Revoke the key in Wishmail at any time; you can also revoke it in Steamworks, after which collection stops with a visible error.
Share links are unguessable, can expire, can be revoked, and are excluded from search engines.

Contact

Security or privacy questions, or a data request by email: nick@housefolk.games. This page describes current practice; it is not a certification.