Privacy policy

Controller

The controller under Art. 4(7) GDPR is the operator of PlayerCards. You can reach us on the Discord server linked in the footer for every question about your data.

Overview

PlayerCards shows public Counter-Strike 2 statistics as player cards. Browsing the site needs no account. We use no advertising or analytics trackers, no third-party fonts and no consent banner, because we set only the technically necessary cookies listed below.

Visiting the site

Our servers sit behind Cloudflare. Cloudflare processes your IP address and request data to deliver the site, protect it against attacks and cache images; its own logs can include the requested address with query string.

Our access log records the request id, method, path (without query string, tokens masked), host, status and duration, but no IP address, user agent or cookie. IP addresses are used briefly for rate limiting (counters in Redis that expire with their time window; IPv6 is shortened to a /64 network) and to find out the visitor’s country from the Cloudflare header.

To count unique visitors per day we hash IP address and user agent with a salt that changes daily and put the hash into a counter. Neither IP address nor user agent is stored, and the salt and counter expire after two days. Page views are counted per day without any link to a person.

Legal basis: our legitimate interest in running, securing and improving the site (Art. 6(1)(f) GDPR).

Cookies and local storage

We set only cookies that are needed for the features you use (Art. 6(1)(f) GDPR, § 25(2) TDDDG):

• pc_session: keeps you signed in. 30 days, HttpOnly, removed when you sign out or delete your account.
• pc_oid_state: protects the Steam sign-in against forgery. 10 minutes.
• pc_discord, pc_discord_state, pc_discord_install: Discord sign-in, dashboard and bot installation. 12 hours, 10 minutes and 10 minutes.

Sign in with Steam

You sign in through Steam OpenID. Steam tells us only your SteamID64; your Steam password never reaches us. We then fetch your public profile through the Steam Web API and store it: SteamID64, profile name, avatar addresses, profile link and visibility, country (if public), account creation and last logoff time, CS2 playtime and equipped profile items. We also store your account record with its role, sign-in times, your age declaration and moderation status.

Public Steam profile data may also be shown as a card for players who have not signed in; you can opt out by deleting your account (see below).

Purpose: signing you in and showing your card. Legal basis: performance of the service you ask for (Art. 6(1)(b) GDPR) and, for public cards, our legitimate interest (Art. 6(1)(f)). Retention: until you delete your account.

Statistics from other services

To show statistics we send your SteamID64 to Leetify, FACEIT and csst.at (where these sources are switched on) and to Valve’s Steam Web API. These services receive that identifier and our server address, and have their own privacy policies.

Results are cached for a short time: in memory for one to ten minutes (Leetify, FACEIT), in Redis for up to two days (csst.at). Premier rating snapshots for the leaderboards are kept for 30 days, Elo points for stream widgets for 90 days.

Legal basis: Art. 6(1)(b) and (f) GDPR.

Match data from your PC (GSI)

If you turn on match data, the CS2 game on your PC sends game state to your personal token address. We keep only your own data: map, mode, round and match results, kills, assists, deaths, damage, money, equipment, scores, share code and a thinned position track per round. We never keep the raw payload; the token is stored only as a hash. Live state (including position, bomb and grenades) is held in Redis for 120 seconds. Per-round position tracks and events are deleted after 30 days. Match and round totals stay until you delete them or your account. You choose who can see your history and live data.

Your Valve match-history authentication code, if you add it, is stored encrypted.

Legal basis: your consent through setting it up (Art. 6(1)(a) GDPR); you can delete all match data any time in the settings.

Twitch

If you connect Twitch, we ask for the permissions channel:manage:predictions, channel:manage:redemptions and channel:read:redemptions, and channel:bot only if you add the chat bot. We store your Twitch user id and the access and refresh tokens, encrypted. We receive events (finished predictions, redeemed channel-point rewards) from Twitch for your channel. You can disconnect or delete the connection any time on /me/twitch/, which also revokes the tokens at Twitch.

The PlayerCards Twitch panel gets from Twitch your channel id, role and an opaque viewer id (and your Twitch user id if you share your identity). Viewers’ votes are stored under that opaque id; viewers who link their Steam account can have the link, collectibles and leaderboard entry removed with “Delete my data” in the panel.

Legal basis: Art. 6(1)(a) and (b) GDPR. Twitch is a separate controller for its own processing.

Discord

If you link Discord, we request the scopes identify (link), identify and guilds (dashboard) or identify and role_connections.write (linked roles). We store your Discord user id, username, the link to your SteamID64 and the access tokens, encrypted. The server list is cached for 60 seconds. When the bot is installed in a server, we store the server id, its settings, the linked members seen there and a log of dashboard changes with the acting Discord id. The Discord Activity uses a signed token valid for two hours.

You can unlink Discord in the settings; a server owner can remove the bot and its settings.

Legal basis: Art. 6(1)(a) and (b) GDPR. Discord is a separate controller for its own processing.

Stream Deck, panel and widgets

Pairing a Stream Deck or panel creates a device key. We store only hashes of the keys, a name you can set, and use times. Access tokens last one hour; a key expires after 90 idle days and can be revoked any time. Pairing codes last ten minutes. Widget links contain a secret token that we store only as a hash; anyone with the link sees that widget, so keep it private. Provider keys you enter for widgets are stored encrypted. Changes of your live-privacy setting are logged.

Legal basis: Art. 6(1)(b) GDPR.

Uploads and moderation

Images you upload (for example sponsor images) are stored at Cloudflare R2 together with a file hash, size and the result of an automatic image check. The check runs on our own server; images are not sent to a third party for it. Uploads may wait hidden until an admin approves them, and images we remove are kept as a hash so they cannot return. Cloudflare’s tool for detecting child sexual abuse material scans cached images.

Reports of uploads store the reason, an optional note and contact you give, and a hash of the reporter that cannot be reversed to an IP address.

Legal basis: our legitimate interest in protecting the service and others (Art. 6(1)(f) GDPR) and legal obligations (Art. 6(1)(c)).

Advertising

Sponsor placements are counted with a signed token. A recorded impression or click contains only the type, time, campaign, creative, placement, country, device class and page type, never an IP address, user agent or user id. To filter duplicates and abuse we hold a hash of IP address and user agent under a daily changing salt in Redis for at most a day. These events are deleted after 90 days; daily totals stay. Advertisers receive only totals.

When you click an ad, your browser goes directly to the advertiser, who may process data under its own policy. Some ads are embedded from clash.gg in a sandboxed frame; that provider then receives your IP address and browser data.

Legal basis: Art. 6(1)(f) GDPR (measuring and protecting the ad service).

Recipients and hosting

The service runs on a server managed with Coolify; Cloudflare provides DNS, TLS, protection, caching and R2 storage. Code is hosted at GitHub. Valve (Steam), Leetify, FACEIT, csst.at, Twitch and Discord receive data as described above. Where data goes to a country outside the EU, the safeguards of the respective provider (such as standard contractual clauses) apply. We do not sell personal data.

Deleting your data

You can delete your account yourself under “Delete account” in the card editor (/me/). This removes your login, card, badges, uploaded images, Pick’Em data, Twitch and Discord links, GSI data, device keys, guestbook entries and wall strokes, and caches. Public Steam profile data is not deleted but marked so that no card is shown. If an account is banned or has moderation pending, we keep the account record until the case is decided.

You can also delete only match data, unlink Discord and Twitch, or revoke devices separately. For anything else, ask on the Discord server linked in the footer.

Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Art. 15–21 GDPR), and the right to withdraw consent at any time with effect for the future. There is no automatic export yet; ask on the Discord server linked in the footer and we will send you your data. Where processing rests on legitimate interests you may object for reasons arising from your situation. You can complain to a data protection authority, for example the one where you live.