Privacy Policy

Version 1.1 · Effective date: 2026.07.23

This Privacy Policy explains how [OPERATOR NAME] ("we", "us", "our", the "Operator") collects, uses, shares, and protects personal data when you create an account and use our fan-made, virtual Counter-Strike 2 trading simulator (the "Service").

The Service is an independent entertainment product. Everything in the Service is virtual: all balances, skins, inventories, trades, marketplace listings, cases, rewards, and prizes exist only inside the Service, have no real-world monetary value, cannot be cashed out, and cannot be redeemed for real money or real Steam items. The Service is not a real skin-trading site, is not a gambling service, and is not affiliated with, sponsored by, or endorsed by Valve Corporation or Steam. Counter-Strike, CS2, Steam, and related names, logos, and marks are the property of their respective owners.

This document is a template. Sections marked with [PLACEHOLDER] tokens must be completed and reviewed by a qualified legal professional before publication. Until then it should not be relied on as finalised legal advice.

1. Who we are (data controller)

The data controller responsible for your personal data under this Policy is:

Operator / legal entity: [OPERATOR NAME]
Registered address: [REGISTERED ADDRESS]
Company / registration number: [COMPANY NUMBER]
Tax / VAT number: [TAX NUMBER]
General contact email: [CONTACT EMAIL]
Data Protection Officer (if appointed): [DPO CONTACT]

2. Scope of this Policy

This Policy applies to personal data we process about registered users, prospective users, and visitors of the Service. It covers our website, application, in-game features, real-time messaging, and any related support channels we operate.

This Policy does not cover third-party websites, platforms, or services that we do not control, including Valve Corporation, Steam, and any external account provider you may choose to link. Their handling of your data is governed by their own privacy policies.

3. How to contact us

If you have any question about this Policy or about how your personal data is handled, or if you wish to exercise any of your rights, you can contact us using the details below.

Privacy / data protection enquiries: [CONTACT EMAIL]
Postal address: [REGISTERED ADDRESS]
Data Protection Officer: [DPO CONTACT]

4. Categories of personal data we collect

We collect the categories of data described below. Some data you provide directly; some is generated automatically as you use the Service.

a) Account and identity data

Registration data provided when you create an account
Email address
Username / display name
Password, stored only as a salted cryptographic hash (we never store your password in plain text)

b) Profile data

Profile information you choose to add (for example a bio or profile settings)
Avatar or profile image you upload
Cosmetic and display preferences

c) Technical, device, and security data

IP address
Browser type and user agent
Security logs and audit records of sensitive actions
Login history and session / authentication events
Records used to detect abuse, fraud, or automated access

d) Gameplay and virtual-economy data

Gameplay activity, progression, missions, achievements, and levels
Virtual inventory and owned virtual items
Virtual transactions, balances, and ledger entries (all in virtual currency with no real-world value)
Marketplace events such as listings, purchases, and sales of virtual items
Trades and trade offers between users
Case, capsule, upgrader, jackpot, and battle activity

e) Communications and moderation data

Chat messages and direct messages you send through the Service
Moderation data, reports, sanctions, warnings, and ban records
Bug reports, feedback, and support requests you submit

f) Analytics and consent data

Analytics data about how the Service is used (subject to your consent where required)
Cookie and consent choices you have made
See our Cookie Policy for details on cookies and similar technologies

g) Linked external accounts (optional)

Identifiers and basic profile data from external accounts you voluntarily link
Optional Steam login / OpenID identifier, only if you choose to connect it, used solely to authenticate you and never to access, move, or trade real Steam items

h) Payment and subscription data (real-money purchases only)

This category applies only if you buy one of our paid products (the VIP membership subscription or an XP Boost). All in-game balances and items remain virtual and have no cash value; the only real-money transactions are these Stripe-processed purchases.

Your card details are entered directly on Stripe's secure hosted checkout page; we never see or store your full card number
Stripe customer identifier, subscription identifier, and subscription status
Cancel-at-period-end flag and VIP expiry date
Purchase and payment references (including our internal payment reference), and invoice / payment status returned by Stripe
The email address, username, and internal user id we share with Stripe so your purchase can be matched to your account

i) Promotions, cashback, and rewards data

Promo codes you redeem and the resulting virtual-balance bonus (recorded as a ledger entry)
Aggregated fictional spend per period, your rank/level, the cashback percentage applied, and the cashback amount credited as virtual balance
Claim and redemption timestamps used to enforce one redemption per user and per-period idempotency

5. How we use your data (purposes of processing)

We use personal data for the following purposes:

To create and administer your account and authenticate you when you sign in
To provide the Service and its virtual features, including inventory, marketplace, trades, cases, and progression
To operate real-time features such as chat, notifications, and live updates
To keep the Service secure, prevent fraud and abuse, and detect automated or unauthorised access
To enforce our Terms of Service, community rules, and moderation decisions
To respond to your support requests, feedback, and bug reports
To understand and improve how the Service is used, where you have consented to analytics
To send transactional email such as account email verification and password-reset messages
To process real-money purchases via Stripe (the VIP membership subscription and one-time XP Boosts), manage billing, and reconcile your entitlements from Stripe events
To redeem promotional codes and to compute and credit rank-ladder cashback as virtual balance
To serve third-party display advertising to non-VIP users, only where the advertising feature is enabled and you have given marketing consent
To generate admin-authored content (such as season drafts and images) using third-party AI providers; these features are triggered by administrators only and do not process end-user personal data
To send you service-related communications (for example security or account notices)
To send optional updates or marketing communications, only where you have consented
To comply with legal obligations and to establish, exercise, or defend legal claims

6. Legal bases for processing

Where data protection law (such as the EU/UK GDPR) applies, we rely on the following legal bases. The applicable basis depends on the specific processing activity.

a) Performance of a contract

We process account, profile, gameplay, and virtual-economy data because it is necessary to provide the Service you have requested under our Terms of Service.

b) Legitimate interests

We process technical, security, and moderation data to keep the Service safe, prevent abuse, protect our users and infrastructure, and improve the Service. We balance these interests against your rights and freedoms.

c) Consent

We rely on your consent for non-essential cookies, analytics, marketing communications, and any optional linking of an external account. You can withdraw consent at any time, and doing so does not affect the lawfulness of processing carried out before withdrawal.

d) Legal obligation

We process certain data where necessary to comply with a legal obligation to which we are subject, such as responding to lawful requests from competent authorities.

7. Cookies, analytics, and consent

Authentication tokens are stored in secure, httpOnly cookies that cannot be read by client-side scripts; these are strictly necessary for you to stay signed in.

Non-essential cookies and similar technologies, including analytics and any marketing tools, are consent-gated: they are only loaded after you have given consent through our consent mechanism, and you can change or withdraw your choices at any time.

Full details of the cookies and similar technologies we use, their purposes, and how to manage them are set out in our separate Cookie Policy.

8. How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes described in this Policy, unless a longer retention period is required or permitted by law.

Account and profile data: retained for the life of your account and then for [DATA RETENTION PERIOD] after account closure
Security, login, and audit logs: retained for [DATA RETENTION PERIOD]
Gameplay, virtual-economy, and marketplace records: retained for [DATA RETENTION PERIOD]
Chat and moderation records: retained for [DATA RETENTION PERIOD]
Support requests and bug reports: retained for [DATA RETENTION PERIOD]
Consent records: retained for [DATA RETENTION PERIOD] to demonstrate compliance

When a retention period ends, we securely delete or irreversibly anonymise the relevant data. We may retain data for longer where required for legal, regulatory, tax, accounting, security, or dispute-resolution purposes.

9. Who we share data with (recipients and processors)

We do not sell your personal data. We share personal data only where necessary, and with appropriate safeguards, including with the categories of recipients below.

Hosting, infrastructure, and cloud storage providers who operate our servers and databases
Analytics providers, where you have consented to analytics
Communication and email delivery providers used to send service or account messages, including the SMTP email provider we configure to deliver verification and password-reset messages
Payment providers, only if and where paid features exist: [PAYMENT PROVIDERS]. We currently use Stripe, Inc. (Stripe) to process real-money purchases (the VIP subscription and XP Boost)
Advertising networks, where display advertising is enabled and you have given marketing consent; the ad-network snippet runs in your browser and collects data directly
AI content-generation providers (OpenAI, Recraft, and fal.ai) used for admin-triggered content authoring; these are supplied only administrator-provided prompts and images, not end-user personal data
Security, anti-fraud, and content-delivery providers that help protect the Service
Professional advisers such as legal and accounting advisers, where necessary
Competent authorities, regulators, or courts where we are legally required to disclose data
A successor entity in the event of a merger, acquisition, or reorganisation, subject to this Policy

Where a recipient processes personal data on our behalf, they act as our processor under a written agreement that requires them to protect the data and to process it only on our instructions.

10. International data transfers

Your personal data may be processed in, or transferred to, countries outside your own country or region, including outside the European Economic Area or the United Kingdom, where our providers operate.

Where we transfer personal data internationally, we put in place appropriate safeguards required by applicable law, such as an adequacy decision or Standard Contractual Clauses. You may request more information about these safeguards using the contact details in this Policy.

11. Your data-protection rights

Subject to applicable law, you have the following rights in relation to your personal data. We will respond to valid requests within the time limits required by law.

Right of access: to obtain confirmation of whether we process your data and a copy of it
Right to rectification: to have inaccurate or incomplete data corrected
Right to erasure: to have your data deleted in certain circumstances (the right to be forgotten)
Right to restriction: to limit how we process your data in certain circumstances
Right to object: to object to processing based on our legitimate interests, and to object to direct marketing at any time
Right to data portability: to receive certain data in a structured, commonly used, machine-readable format and to have it transmitted to another controller where technically feasible
Right to withdraw consent: to withdraw any consent you have given, at any time, without affecting prior lawful processing
Right to lodge a complaint: to complain to a supervisory authority, being [SUPERVISORY AUTHORITY]

To exercise any of these rights, contact us at [CONTACT EMAIL]. We may need to verify your identity before acting on a request. Exercising your rights is free of charge in most cases, although we may charge a reasonable fee or refuse to act on requests that are manifestly unfounded or excessive, as permitted by law.

12. Automated decision-making and profiling

We use automated processing for limited, non-legal purposes such as anti-fraud and abuse detection, rate limiting, matchmaking within virtual features, and personalising parts of the in-game experience.

We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you, as described in Article 22 of the GDPR. If this ever changes, we will update this Policy and, where required, provide you with meaningful information about the logic involved and your rights to obtain human intervention, express your view, and contest the decision.

13. Children and minimum age

The Service is not intended for children under [MINIMUM AGE], and you must be at least [MINIMUM AGE] years old to create an account and use the Service.

We do not knowingly collect personal data from children below [MINIMUM AGE]. If we become aware that we have collected such data without appropriate consent, we will take reasonable steps to delete it. If you believe a child has provided us with personal data, please contact us at [CONTACT EMAIL].

14. How we protect your data (security)

We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration. These measures include, among others:

Storing passwords only as salted cryptographic hashes, never in plain text
Keeping authentication tokens in secure, httpOnly cookies
Encrypting data in transit using industry-standard protocols
Restricting access to personal data on a need-to-know basis
Logging and monitoring sensitive actions and maintaining audit trails
Applying rate limiting and abuse-detection controls

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for signing out of shared devices.

15. Data breaches and incident handling

We maintain procedures to detect, investigate, and respond to personal-data breaches. Where a breach is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority, [SUPERVISORY AUTHORITY], without undue delay and within the time limits required by applicable law.

Where a breach is likely to result in a high risk to your rights and freedoms, we will also inform affected users without undue delay, describing the nature of the incident and the steps we are taking.

16. Third-party services and links

The Service may contain links to, or integrations with, third-party services that we do not control, including any optional external or Steam login you choose to use. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

Linking an external account is entirely optional and is used only to authenticate you within the Service. It does not grant us access to your real Steam inventory, and it is never used to trade, move, or value real Steam items.

17. Changes to this Policy

We may update this Policy from time to time to reflect changes to the Service, our practices, or legal requirements. When we make material changes, we will update the version and effective date below and, where appropriate, provide additional notice through the Service.

Your continued use of the Service after an updated Policy takes effect indicates your acceptance of the changes, to the extent permitted by applicable law.

18. Payments and subscriptions (Stripe)

The only real-money transactions in the Service are our paid products: the VIP membership, which is a recurring monthly auto-renewing subscription, and the XP Boost, which is a one-time purchase. Everything else in the Service remains virtual, has no real-world monetary value, and cannot be cashed out. Buying a paid product does not turn any virtual balance or item into real money.

Payments are processed by Stripe, Inc. ("Stripe"). When you buy a paid product you are redirected to Stripe's secure, Stripe-hosted checkout page to enter your payment details. Your card number and related payment credentials are collected and handled by Stripe directly; we never see or store them.

To link your purchase to your account, we share your email address, username, and internal user id with Stripe (for example as Stripe Customer metadata and a client reference). Stripe returns to us, and we store, information such as your Stripe customer id, subscription id, subscription status, cancel-at-period-end flag, VIP expiry date, and payment / invoice references. Your VIP entitlement is advanced from Stripe webhook events, so the Service (not the client) remains the authority on your subscription state.

You can manage or cancel a subscription, update your card, and view invoices through the Stripe-hosted Billing Portal.

For these payment activities Stripe acts as an independent data controller in respect of the payment data it collects and processes for its own compliance, fraud-prevention, and financial-reporting obligations, in addition to acting as our processor for completing the transaction. Stripe's own handling of your data is governed by its privacy policy.

Stripe processes this data in the United States. Where this involves transferring personal data outside the European Economic Area or the United Kingdom, the transfer is made under appropriate safeguards such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

We do not load Stripe scripts on our own pages, and checkout is fully redirect-based, so Stripe does not set cookies on our website; any Stripe cookies are set on Stripe's own hosted checkout domain. We rely on the performance-of-a-contract legal basis to deliver the purchased product, and on legal obligation to keep the associated tax and accounting records.

19. Transactional email

We send a limited set of transactional emails that are necessary to operate your account, such as email-verification messages and password-reset messages. We do not send marketing or newsletter email through this channel.

These messages are delivered through an SMTP email provider that the Operator configures. To send them we provide the provider with your recipient email address, your username, and a single-use verification or reset link; the underlying token is stored on our servers only in a hashed form. If no SMTP provider is configured, the relevant link is logged on our server instead of being emailed.

The processing location and any international-transfer safeguards for email delivery depend on the SMTP provider the Operator configures: [PLACEHOLDER]. We rely on performance of a contract and our legitimate interest in account security as the legal bases for these messages.

20. Advertising and marketing cookies

We may display third-party advertising to users who do not have active VIP status, and only when the advertising feature is enabled. Advertising is served by injecting an admin-configured ad-network snippet (HTML/JavaScript) into placement slots such as a sidebar, a top banner, or in-content areas. No ad network is wired in by default, and VIP members are not shown ads.

Advertising cookies and similar technologies are treated as marketing cookies and are strictly consent-gated: the ad-network snippet is only loaded, and its cookies are only set, after you have given marketing consent, and you can withdraw that consent at any time.

When it runs in your browser, the third-party ad-network script may collect data such as your IP address, device and browser identifiers, and page or interaction data, and may set its own cookies for ad delivery, frequency capping, and measurement. This data is collected by the ad network as an independent third party; we do not pass your account data to it directly. Because no concrete ad network is configured by default, the specific cookie names, processing location, and transfer safeguards depend on the network the Operator selects: [PLACEHOLDER]. The legal basis for advertising and marketing cookies is your consent. Full details are set out in our Cookie Policy.

21. Promotional codes and cashback

The Service offers reward features that credit additional virtual (fictional) balance to your account. These rewards have no real-world cash value and cannot be cashed out; they only affect your in-game balance.

Promo codes: when you redeem an administrator-issued promo code (including at registration), we record your internal user id, the code, the bonus amount, and the redemption timestamp as a ledger entry, and we use these records to enforce one redemption per user and any global usage cap.
Rank-ladder cashback: we compute a rank-based percentage of your closed-period fictional spend and credit it back as virtual balance. To do this we process your internal user id, your rank/level, your aggregated fictional spend per period, the cashback percentage and amount, the period key, and the claim timestamp; claims are idempotent per user and period.

We rely on performance of a contract to provide the requested bonus, and on our legitimate interest in operating a loyalty program, as the legal bases for these features.

22. AI content-generation providers

Some content in the Service (for example season drafts, name and theme suggestions, branding art, case container art, and custom-collection textures) is generated with the help of third-party AI providers: OpenAI (text and vision), Recraft (image generation), and fal.ai (depth/ControlNet image generation).

These AI features are server-side and are triggered by administrators only. The providers receive only administrator-supplied prompt text and, where relevant, an administrator-provided or rendered image. They do not receive end-user personal data, and they are not used to profile or make decisions about players.

These providers process data in the United States. Where this involves transferring personal data outside the European Economic Area or the United Kingdom, the transfer is made under appropriate safeguards such as the EU-US Data Privacy Framework and/or Standard Contractual Clauses.

23. Version and effective date

Document version: 1.1
Effective date: 2026.07.23