Last updated: 6 October 2026.
GoCDKeys compares the prices that other shops charge for video games. We do not sell games, we are not a party to your purchase, and we never handle your payment details. We are paid by the shops we link to, through affiliate commissions. This page explains that arrangement, what data we process, and what you can ask us to do about it.
These websites are operated by, and the controller of your personal data is:
This page covers gocdkeys.com, gocdkeys.es, gocdkeys.de, gocdkeys.it, gocdkeys.fr and gocdkeys.pt, our browser extension, our Partner programme and the Gamecost mobile app for iOS and Android. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR; privacy matters are handled at the address above.
We operate a price comparison service. We display offers published by third-party shops and link you to them. Any purchase you make is a contract between you and that shop, not with us. We are not the seller, the reseller, the distributor or the agent of any shop, and we take no part in the transaction.
Accordingly, and to the fullest extent permitted by law, we are not responsible for:
Prices, stock and offer details come from the shops themselves and from automated feeds. They change constantly and may be out of date, incomplete or wrong. They are provided for information only and are not an offer to sell. Always check the final price and the product details on the shop's own page before you buy. Any complaint about a purchase must be directed to the shop that sold it to you.
Some shops resell keys bought elsewhere. We label the format of each offer where we can identify it, but we do not verify the origin of individual keys and give no warranty about them.
Nothing in this section excludes or limits any liability that cannot lawfully be excluded or limited, including liability for death or personal injury caused by negligence, for fraud, or under mandatory consumer protection and data protection law.
GoCDKeys is free to use. When you click through to a shop and buy something, that shop may pay us a commission. This does not change the price you pay. Links to shops pass through a redirect address on our own domain before reaching the shop, and carry markers in the page code that tell search engines not to follow them.
Commercial arrangements do not decide the order in which offers appear. Listings are ordered by price and by the criteria stated on each page.
When you click such a link we record which shop and which offer you clicked, the time, a random visitor identifier and, if you are signed in, your account. We do not record your IP address, your browser or the referring page in those records, and we do not pass the shop any information about you — the only thing added to the destination address is a fixed GoCDKeys identifier that is the same for every visitor. From the moment you arrive at the shop, that shop's own privacy policy applies and we have no control over it.
Cookies that are strictly necessary keep you signed in and protect our forms; the site does not work without them and they do not require your consent. Everything else — measurement, advertising and affiliate attribution — is used on the basis of your consent, which you give through the cookie notice. You can change or withdraw your consent at any time from the "Cookie settings" link in the footer of every page, which reopens the panel and lets you turn each category off.
The full list of cookies and of what we store in your browser, with the provider, purpose and lifetime of each one, is in our cookie policy.
| Cookie | Purpose | Duration | Category |
|---|---|---|---|
gamecostservices_session, PHPSESSID | Keep your session and keep you signed in. | 2 hours / browser session | Necessary |
XSRF-TOKEN | Protects forms against cross-site request forgery. | 2 hours | Necessary |
gc_remember, gc_remember_pref | Keep you signed in between visits when you choose "remember me". | 30 days / 1 day | Necessary |
gc-cookie-advice | Remembers your answer to the cookie notice. | 1 year | Necessary |
gc-cookie-prefs | Remembers which cookie categories you allowed. | 1 year | Necessary |
gc-currency | Remembers the currency you selected. | 1 year | Preference |
gc_sid | Random visitor identifier. It counts visits and links a page view to the outbound click that follows it, which is how a commission is attributed to us. | 1 year | Marketing (attribution) |
gcdk_ref, gcdk_tag | Identify the partner and campaign that referred you, so commission can be attributed. | 15 days | Marketing (attribution) |
Google Tag Manager loads Google Analytics, Google Ads and Microsoft Advertising on our pages. We also load the Reddit advertising pixel, which receives a page-visit event and, when you click through to a shop, the game and price of the offer you clicked. Google reCAPTCHA is used to filter automated traffic, and embedded YouTube videos set Google cookies when they load. We do not control these cookies; each provider's own privacy policy applies. Blocking third-party cookies in your browser prevents most of this processing, and each provider offers its own opt-out.
Google Tag Manager also loads the X (formerly Twitter) advertising pixel and Microsoft Clarity, which records how people use our pages — clicks, scrolling — so we can see what works and what doesn't. Cloudflare, which protects the site, may set a security cookie when it checks that you are not a bot.
We also use your browser's local storage to remember interface choices, such as the graphics card you entered in our system requirements tool. That information stays in your browser.
| What | Why | Legal basis |
|---|---|---|
| Pages you view, referring page, device, language, country, visitor identifier, and your IP address in our server logs | To run and secure the site and to understand which pages are useful | Legitimate interest, Art. 6(1)(f); consent for analytics and advertising |
| Account: email address, display name, avatar, language, country, sign-in identifiers, registration and last sign-in dates, and the IP address recorded at registration | To give you an account and keep your preferences | Contract, Art. 6(1)(b) |
| Price alerts: your email address, the game and the price | To send you the alert you asked for | Consent, Art. 6(1)(a) |
| Marketing emails: your email address, your language and proof of your consent (date, version of the text you accepted, where you gave it, and your IP address and browser as a hash) | To send you deals, price drops and news only if you give us your express consent by pressing the relevant button while signed in. You can withdraw it at any time from the link in every email or from your profile. We give you tickets as a thank-you for subscribing, and you keep them even if you unsubscribe. | Consent, Art. 6(1)(a) GDPR and Art. 21 of the Spanish Information Society Services Act (LSSI) |
| Notifications: the subscription your browser issues and its keys | To deliver browser notifications | Consent |
| Comments and ratings: what you wrote or selected, and your account | To publish them; ratings feed the average score shown on the page | Consent |
| Partner programme: for partners, the channel, declared audience, hashed sign-up and panel IP addresses, earnings, and payout and tax details. For visitors arriving through a partner link, the landing and click pages, country, device and one-way hashes of IP address and browser | To run the programme, attribute commissions, detect fraud and pay partners | Contract; legal obligation for tax records, Art. 6(1)(c); legitimate interest for fraud prevention |
You can sign in only with Google or Steam. We do not operate a password sign-up on our websites and we never see the password of your Google or Steam account. Google gives us your email address and basic profile; Steam gives us your SteamID64, public profile name and avatar, and does not give us your email address. If you link Discord or Telegram, we receive your identifier there and, for both, your email address.
In the Gamecost app you can also sign in with your email address, using a one-time code we send you (there is no password), or with Sign in with Apple, which may give us an Apple relay address instead of your real email address.
Older accounts may still contain a surname, date of birth, postal address, telephone number, postcode and town, collected for the prize draws we used to run; our current giveaways ask for none of it (section 11). We stopped collecting it in March 2025 and you can ask us to erase it. The display name on your account is not part of this: it comes from the Google or Steam profile you sign in with, and we keep it for as long as the account exists.
Partners see totals only. We do not disclose the identity of the visitors they refer.
We do not use your data for automated decisions that produce legal effects on you or similarly significantly affect you. In the Partner programme, automated rules discard clicks that are not billable and can place a payout on hold; a person reviews every payout before it is paid, and a partner can contact us to have a decision looked at again.
You can connect an AI assistant to GoCDKeys through our connector. When you do, we receive the queries your assistant sends us — a game name, a platform — and we return prices and links. The connector is read-only: it does not create an account, it sets no cookies, and it writes nothing to our databases. These requests appear in our ordinary server logs with the time, the address requested and the connecting network address, which for us is our content delivery network's, and are kept for the same fourteen days as the rest of our server logs. What you ask your assistant is not sent to us, only the query it makes on your behalf, and we do not know who you are unless your assistant chooses to send an identifier.
Gamecost is our mobile app for iOS and Android: a game recommender and price comparison. It needs an account, and it processes the following:
The rules for using the app — your account, what you may and may not do with it, how prices and shop purchases work, and what we are responsible for — are set out in the Gamecost terms and conditions.
Our browser extension shows our price comparison while you browse other sites. To do that it reads the address of the page you are on and sends it to us so we can look up a matching game. Please read this section before installing it.
The legal basis is your consent. For the price comparison you give it by installing the extension; for the purchase notices and the reward, by ticking the box to accept the extension terms on GoCDKeys, which is recorded with its date. You can withdraw it at any time by unlinking the extension from its settings ("Link account" → "Unlink the extension"), which stops the purchase notices, or by uninstalling it, which stops any further collection. To have records already held about you erased, write to us.
Our servers are in Germany. We share data with: Cloudflare (delivers and protects our sites, and therefore sees your IP address and requests); Hetzner (hosting); Google (sign-in, measurement, advertising, anti-bot, embedded video, notification delivery); Microsoft (advertising measurement, notification delivery); Apple (notification delivery); Reddit (advertising measurement); Mozilla (notification delivery); Overthings, S.L. (Bitelio, sends our email from Amazon Web Services servers in Ireland); Valve (Steam sign-in and game artwork); Discord and Telegram if you link them; and flagcdn.com, which serves the flag images on our pages and therefore receives your IP address.
For the Gamecost app we also share data with: Railway (hosts the app's account service); Anthropic (interprets searches written in your own words); Expo (650 Industries, delivers the app's notifications); Apple (Sign in with Apple and iOS notifications); Google (Android notifications); Bitelio (sends sign-in codes by email); YouTube (videos embedded in the app); and Twitch (live channel data and thumbnails).
On top of that list come X (formerly Twitter, advertising measurement) and Microsoft Clarity, which analyses how our pages are used.
Where a recipient processes data in the United States, the transfer is made under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework where the recipient is certified under it, and otherwise under the European Commission's Standard Contractual Clauses. Ask us and we will tell you which applies.
We also disclose data where the law requires it, and we may transfer it as part of a sale or reorganisation of our business, in which case the acquirer is bound by this policy. We do not sell your personal data.
We protect your data with encryption in transit, access controls that limit who can reach it, and regular review of who can see what. No system is perfectly secure, but we take measures appropriate to the risk. If a breach is likely to put your rights at risk, we will tell you and the supervisory authority as the law requires.
| Data | Kept for |
|---|---|
| Account and everything attached to it | While the account exists. Accounts unused for three years are deleted. |
| Price alerts and notification subscriptions | Until you delete them or unsubscribe. |
| Email preferences and proof of your consent to marketing emails | For as long as you stay subscribed and, after you unsubscribe or delete your account, three more years, solely so we can prove that you gave us your consent. |
| Page views and outbound clicks | 26 months. |
| Browser extension records | 6 months. |
| Partner attribution records | 24 months. Payout and tax records for the period Spanish tax law requires. |
| AI assistant connector requests | 14 days, in our server logs. Nothing else is stored. |
| Server logs | 14 days. |
| Gamecost app account and everything attached to it | Until you delete it, in the app or on the deletion page. |
| Phrases searched in your own words (Gamecost app) | 30 days, not linked to your account. |
| Phone notification token (Gamecost app) | Until you sign out, delete your account or the token stops being valid. |
| Giveaway entries: tickets entered, dates and acceptance of the rules | For as long as your account exists. |
| The record of each draw (seed, entrants by ID and weights), the winners' usernames and the messages they send us to claim their prize | The record and the winners' names, for as long as the giveaway page stays online, since it is the proof that the draw took place. The messages, for as long as we need to deliver the prize and deal with any complaint. |
You have the right to access your data and get a copy, to have it corrected, to have it erased including closing your account, to restrict or object to our processing, to portability, and to withdraw consent at any time without affecting what we did beforehand.
Write to hello@gocdkeys.com from the address on your account, or from any address if you tell us how to identify you. We may ask for more information to confirm who you are. We answer within one month and will tell you if we need longer.
If you think we have handled your data badly you can complain to the Spanish supervisory authority, the Agencia Espanola de Proteccion de Datos, at www.aepd.es, or to the authority of the country where you live.
Our service is not directed at children. You must be at least 14 to create an account, or older where your country requires it: 15 in France and Portugal, 16 in Germany. We do not knowingly collect data from children below that age. If you are a parent or guardian and believe your child has given us data, write to us and we will delete it.
GoCDKeys runs free giveaways of games and other digital products for registered users. Each giveaway has its own page and they are all listed on our giveaways page. The rules below are the same ones shown there, and you have to accept them by ticking a box before you can enter.
If you take part in ticket auctions, we process your bids (amount, date and time), the date and time at which you accept the auction rules, and a technical fingerprint of the device and connection you bid from (as a hashed summary, the same as in giveaways) to prevent the use of multiple accounts. We also use your email address to tell you what happens in the auctions you take part in and to deliver the prize if you win. Your username appears in the public bid history of the auction and in the activity bar.
These apply to every giveaway on Gocdkeys. If a specific giveaway has something extra, such as a ticket cap, you'll find it on its own page.
| What | Why | Legal basis |
|---|---|---|
| Your entry: your account, the tickets you put into each giveaway, when you entered and each time you added more, and whether they were refunded | To manage your entry, take or refund tickets, work out your odds and run the draw | Contract: the rules you accept when entering, Art. 6(1)(b) |
| Acceptance of the rules: the date and time you accepted them, which includes your statement that you live in the US, Europe or the UK | To be able to show that you accepted the rules and to check the residence requirement before handing over a prize | Contract; legitimate interest in being able to prove it, Art. 6(1)(f) |
| Draw record: the random seed, the list of entrants by numeric ID, each entrant's weight and the winners | So that the draw can be re-run and shown to be fair if anyone questions it | Legitimate interest, Art. 6(1)(f) |
| What is made public: the username and avatar of the five entrants with the most tickets, with their tickets and odds, and the usernames of the winners | So that anyone can follow each giveaway and see who won, and so we can announce the winners on our social media | Contract, because the rules provide for it; legitimate interest in transparent giveaways |
| If you win: whatever you write to us through the contact page, when you did so, and when we delivered your prize | To check that it is really you, deliver the prize and, if you do not get in touch within 72 hours, redraw it | Contract, Art. 6(1)(b) |
| Multiple-account checks: account data we already hold, such as the IP address recorded when you signed up and your sign-in identifiers | To spot anyone entering with more than one account and enforce the rule against it | Legitimate interest in fair giveaways, Art. 6(1)(f) |
The name we publish is your account's username. If your account has no username of its own and signs in with your email address, we only show the part before the @; the full address is never published. If you would rather not appear that way, write to us before entering.
We do not ask for a postal address, phone number or date of birth to enter. Prizes are keys and other digital products, and we deliver them ourselves.
You have the same rights over this data as described in section 9. Bear in mind that while a giveaway is open, your entry is needed to run it: if you ask us to erase it, you stop taking part in that giveaway.
Write to hello@gocdkeys.com, or to Overthings, S.L., Avenida Alejandro Rosello, 1, 07002 Palma de Mallorca, Illes Balears, Spain.
We may update this page. The date at the top shows when it last changed, and if a change materially affects how we use your data we will tell you before it takes effect.
Chrome paused it with the update: open chrome://extensions and switch it back on, or reinstall it.
You have an old version. To update it, remove it from Chrome and install it again from the Chrome Web Store. It only takes a minute.
We use cookies to provide you with the best experience on our website. You can review our privacy policy By clicking "Accept All", you agree to the use of all cookies.
Set Price Alert
{game_name} for {game_platform}
We will notify you when...
Alert created successfully!
Error creating the alert!
The minimum price cannot be higher than the original price
The minimum price cannot be empty
The minimum price is not valid
You already have an alert created for this game
Choose which cookies we may use. Turning a category off deletes the cookies we can reach from your browser.
Some cookies are set by third parties on their own domains and can only be removed from your browser settings or through each provider's own opt-out.
Italiano
English
Español
Português
Deutsch
Français