Know what you are connecting.
Browse games without installing anything. Steam handles account sign-in; the Windows companion is optional.
Sign in only with Steam
GTF redirects sign-in to https://steamcommunity.com/openid/login. Check the browser address before entering Steam credentials. GTF does not ask for your Steam password, Steam Guard code or your own developer API key. Steam privacy settings control which library, friends and achievement information is available.
Optional Windows downloads
The GTF website links to versioned GTF Companion releases in the K1riru/GTF-Companion repository on github.com. The current installer is not code-signed, so Windows may show an unknown-publisher or reputation warning. A warning is not proof that a file contains malware; equally, a download link or a checksum is not a safety certification. Do not turn off antivirus or other protection to install it. You can use the website or phone companion without installing the Windows app.
Verify the file you downloaded
Each release includes SHA256SUMS.txt and a release-manifest.json containing package names, SHA-256 hashes, website origin and installer signature status. Compare the file hash with the checksum for that exact release. Matching hashes check file integrity against the published release; they do not replace a malware scan or a verified publisher signature.
What the companion accesses
The companion reads Steam installation manifests and checks running game processes to identify installed and active games. Installation paths and process-path information stay on your computer. Its local connection accepts only the configured GTF website origin and requires a per-run token for commands. Steam sign-in remains in the browser; account cookies, passwords and developer API keys are not passed to the companion. GTF does not inject into games, bypass anti-cheat or force a game to close.
Website data and controls
The website uses HTTPS, browser security headers, signed session cookies, same-origin write checks and bounded API requests. Hosted private records are accessed through the server, with database row-level security and retention limits. Taste, liked games and hidden titles remain in your browser according to your storage choices. Shared curated game metadata is separate from personal account information. Read the Privacy and Cookie notices for the full data description.
Report a concern
Email info@gamesthatfit.com with the affected URL or companion version and a description. For a download warning, include the exact filename, SHA-256 and the protection product’s detection name. Do not send passwords, Steam Guard codes, API keys, account cookies or other people’s private information. No software or service can guarantee that every security or reputation provider will accept it; reported concerns need investigation.