CS2.SPACE API
PRIVACY POLICY

1. Data we collect about customers

• Sign-in details. If you sign in with Steam, we receive your SteamID and Steam display name (we never see your Steam password). If you sign in with Google, we receive your Google account ID, name and email address. We request only Google's basic profile and email permissions.
• Email address that you provide and verify, and a one-time verification token while verification is pending.
• Billing information: your plan, subscription status and billing period, your customer ID at our payment processor (Helcim) and the email used for billing. Card details are entered directly into Helcim's secure payment form; we never receive or store full card numbers.
• API keys and usage: your keys and how many requests each has made, in total and this month.
• Communications: emails you send to us (for example, to help@cs2.space), and records of the account emails we send you, including delivery status.
• Technical data: IP address, browser and request details in our server logs, and a session cookie that keeps you signed in.

2. Data we collect about website visitors

We use Plausible Analytics, hosted on our own server, to count page views. It does not use cookies and does not collect personal data or track you across sites; it records aggregate statistics such as pages viewed, referrer, browser, operating system and country. Our servers also keep standard access logs (IP address, browser, requested page and time). Your light/dark theme choice is stored only in your own browser.

3. Data about players returned by our API

When a customer requests data about a Steam account, we retrieve publicly available information about that account from the gaming platforms it relates to. Depending on the request, this can include: Steam public profile (name, avatar, profile link, level, account age), ban status, owned games and playtime, friends list and Counter-Strike 2 statistics; Counter-Strike 2 profile details such as commendations, profile rank and displayed medals; public Counter-Strike 2 and Dota 2 inventories; and public FACEIT and Leetify profiles and statistics.

We only access information that the player has made public on those platforms. We keep it temporarily to answer repeat requests quickly: profiles for up to 3 hours, inventories for up to 30 minutes, and a backup copy of an inventory for up to 7 days, used only if the platform is temporarily unavailable. We do not build long-term profiles of players or sell this data.

If you are a player and do not want your data available through our API, you can make your Steam profile or inventory private in your Steam privacy settings, which stops us from accessing it. You can also email help@cs2.space with your SteamID and we will delete any data we hold about you. Customers who received your data through our API are responsible for their own handling of it under our Terms of Service.

4. How we use data

• To provide the Service: signing you in, issuing and checking API keys, answering API requests, and showing your dashboard.
• To process payments, manage subscriptions and free trials, and prevent duplicate trials.
• To send account emails: verification links, receipts, trial and renewal notices, payment problems, and important service or security notices.
• To answer support requests.
• To enforce rate limits and our Terms, and to detect and prevent abuse, fraud and security incidents.
• To monitor and improve the Service's performance and reliability.
• To comply with legal obligations.

We do not sell personal data, share it for targeted advertising, or use it to train AI models. We do not send marketing emails.

Where the GDPR or UK GDPR applies, our legal bases are: performing our contract with you (providing the Service and billing), our legitimate interests (security, abuse prevention, improving the Service, and providing publicly available player data to customers), and legal obligations.

5. Google user data

If you sign in with Google, we use your Google account ID, name and email address only to create and identify your CS2.SPACE account and to contact you about it. We do not share Google user data with third parties except the service providers listed below as needed to operate the Service, do not use it for advertising, and do not use it to train AI or machine-learning models. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who we share data with

We share personal data only with service providers that help us run the Service, under their own privacy and security commitments:

• Helcim: payment processing and subscription billing.
• Resend: sending account emails and receiving emails sent to our support address.
• Hostinger: hosting of our servers in the United States.
• Proxy network providers: used to retrieve public inventory data. They receive the SteamID being looked up, not information about our customers.
• Gaming platforms (Steam, FACEIT, Leetify): when answering an API request, we send them the SteamID being looked up. We do not send them information about our customers.

We may also disclose data if required by law or valid legal process, to protect the rights, safety or property of CS2.SPACE, our users or others, or as part of a sale or reorganization of the Service (in which case this policy will continue to apply to your data).

7. Where data is stored

Our servers, databases and backups are located in the United States, and data, including data received from Steam, is stored and processed there. If you are outside the United States, your data is transferred to and processed in the United States; where required, we rely on appropriate safeguards for such transfers.

8. How long we keep data

• Account, API key and subscription data: while your account exists. When you ask us to delete your account, we delete it within 30 days, except for records we must keep for legal, tax or accounting reasons. Our payment processor keeps its own transaction records under its own policies.
• Database backups: rolling backups are kept for about 7 days, so deleted data disappears from backups within that time.
• Server and application logs: up to 30 days.
• Support emails: until the related request is resolved and no longer needed, and at most 2 years.
• Player data returned by the API: as described in section 3 (hours to days).

9. Security

We protect data with encrypted connections (HTTPS), access controls, restricted server access, signed session cookies and protections against cross-site request forgery. No system is perfectly secure; if we learn of a breach affecting your personal data, we will notify you and the relevant authorities where required by law.

10. Cookies and similar technologies

• connect.sid: a strictly necessary session cookie that keeps you signed in, for up to 7 days.
• Theme preference: stored in your browser's local storage, never sent to us.
• No advertising or cross-site tracking cookies are used. Our analytics do not use cookies.
• Our payment form is provided by Helcim and may set its own strictly necessary cookies while you pay.

11. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. California residents have the right to know, delete and correct personal information and to not be discriminated against for exercising these rights; we do not sell or share personal information as defined by California law.

To make a request, email help@cs2.space from the email address on your account, or include your SteamID if you are a player. We may need to verify your identity, and we will respond within 30 days. If you are in the EU, the UK or another region with a data protection authority, you can also complain to that authority.

12. Children

The Service is not directed at children under 13, and we do not knowingly collect personal data from them through account sign-up. If you believe a child has created an account, contact us and we will delete it.

13. Changes to this policy

We may update this policy. We will post the new version here with a new effective date and, for material changes, notify account holders by email before they take effect.

14. Contact

Privacy questions or requests: help@cs2.space.