Privacy Policy

1. What we collect

We collect: your Steam ID (after OpenID sign-in), email (if you link one or sign in with Google/Discord/email), persona name + avatar from your linked provider(s), inventory snapshots (refreshed on demand), trade history (created by your activity on the site), wallet ledger entries, rewards activity (XP, keys, daily claims, and the case openings with their seeds, result and the country you opened from, to apply the cases' country restrictions), and request-level logs (IP, user-agent, request id).

Site analytics: our own code (no third-party scripts) records the pages you open (the address without its query string), clicks on some buttons (such as add to cart or sell), the website that sent you (its domain only), campaign tags in the link (utm_*), your country as reported by our CDN (Cloudflare), and your device type, browser and operating system. It sets no cookie and stores nothing on your device. To count visitors we keep a code derived from your IP address, browser user-agent and a random value that changes every day and is deleted after two days, so the code can't be traced back to your IP or matched across days; your IP address itself is not stored. When you're signed in, these records are linked to your account. Choosing "Essential only" in the cookie banner turns this off in that browser.

2. Why we collect it

Authentication, anti-fraud, trade reconciliation, support, and understanding how the site is used so we can improve it.

3. Cookies

Strictly-necessary: cs2sell_session (auth),csrf (CSRF token), cs2sell_locale (language). Site analytics use no cookies (see section 1). Your cookie-banner choice is remembered in cs2sell_consent, and you can change it from the Footer → Cookie Settings link.

4. Your rights (GDPR / CCPA)

• Export — request a JSON file of all your data via Account → Security → Export your data. We notify you when it's ready; the download link stays valid for 7 days.
• Delete — Account → Security → Delete account signs you out everywhere, removes your sign-in methods and personal details right away, and schedules the remaining records for anonymization after 30 days.
• Access, rectify, restrict, object — email [email protected].

5. Data sharing

We share data only with subprocessors needed to deliver the service: Steam (for trade verification), Resend (transactional email), BunnyCDN (image hosting), Blockbook (for crypto deposit tracking), and our DPO. We do not sell personal data.

6. Retention

Wallet ledger: 7 years (regulatory).
Auth sessions: 30 days rolling.
Server-side request logs: 30 days.
Site analytics records: 90 days, after that only totals with no link to you are kept; the dates you were active (signed in or traded): 400 days. Both are part of your data export and are deleted when you delete your account.
Everything else: until you delete your account.