What does GameHub do with my username and password for e.g. GoG?

[eCyclops]

Does all of this stay on my machine except when authenticating to Steam or GoG? Or is there another layer "in the cloud" where my credentials are passed through another machine?

[tkashkin]

GameHub has no access to user credentials.

For Steam GameHub reads Steam config (steam/config/loginusers.vdf) and gets the SteamID and profile name from it (not the account name). SteamID is then used to call Steam API.

For GOG and Humble Bundle user authenticates in a webview and GameHub stores the access token to then call the APIs.
GameHub does not try to extract the credentials from the webview, access tokens are only stored locally and passed to the GOG/Humble API.

---

It may change slightly in the future if a server will be implemented (see #541), but even then I don't think there will be need to send anything other than maybe SteamID and/or similar identifiers.
All requests that use authentication and access tokens will remain in the app, but things that don't require user authentication like getting IGDB metadata or loading Steam games list from a profile by SteamID may be moved to a server in this case to solve the problem of bundling API keys in the app.

If server support will be implemented, it will be open-source, self-hostable and there should be a possibility to change it or disable it and set all required API keys in the app to have it call the APIs directly how it currently does.

[eCyclops]

Very cool. Thanks for the speedy response.