Privacy Policy
Last updated: 2026-10-26
This policy describes what data the CS-FINANCE application ("the app", identifier com.csfinance.app) processes, for what purpose, who receives it, and what rights you have over it. By signing in with Steam and using the app, you accept what is described here.
1. Data controller
Data controller: Marc Serra, Spain. Contact: privacy@csfinance.app.
2. Data we process
Steam identifier (SteamID): when you sign in via Steam OpenID, Steam shares your public SteamID with us. It is the only piece of data we receive from the authentication process and the key everything else is linked to.
CS2 profile and inventory: using your SteamID, we query steamwebapi.com, a commercial provider independent of Valve, for your public Steam profile (name, avatar, profile URL and online status) and the contents of your public Counter-Strike 2 inventory, in order to compute and display its value. Steam (Valve) is only involved in authentication.
Names of the skins in your inventory: the item names from the inventories we query are added, without your SteamID or anything else linking them to you, to the list of skins whose market price we track. That is market data, not yours.
Session data: we issue an access token that lasts 30 minutes and lives only in memory, and a 7-day refresh token that on the web is stored in an HttpOnly cookie and in the Android app in the application’s private storage. Neither is shared with third parties.
IP address: we keep it in memory for 60 seconds to limit the number of requests per client. It also appears in the server’s technical logs, which the hosting provider retains for a limited period.
Push notification token (Android only): if you grant the notification permission, we store in our database the device identifier issued by Firebase Cloud Messaging, linked to your SteamID. We use it to deliver your price alerts and for general notices sent to every registered device (CS2 news and app announcements). If you decline the permission, this data is not collected.
Crash reports (Android only): if the app crashes or hits an unexpected error, it sends a report to Firebase Crashlytics (Google) with the technical error trace, the device model, the Android and app versions and the app state at that moment. Server errors (5xx) received by the app are also reported, with only the request method and path, without parameters or content. As the identifier we use a cryptographic digest (SHA-256) of your SteamID, never the SteamID itself, to group crashes from the same user; your name and avatar are not sent. Google logs the connection’s IP address in order to deliver the report. No reports are sent from the website.
Price alerts you create: we store your SteamID, the skin name, the threshold and the direction. When an alert triggers, we keep it marked as triggered, together with the price that fired it, so you can review it; it is deleted when you remove it from your profile.
Your portfolio value over time: linked to your SteamID, we store the total value of your inventory once a day, for each price market you use. It is what draws your portfolio evolution chart. We store only the total figure and the date, never which items make it up. This series used to live only on your device, but was lost when you signed out or reinstalled the app.
Assistant chat: if you use the built-in chat, we send the Gemini API (Google) the text of your message, the previous turns of that same conversation and, if you ask about your inventory, the list of names and prices of your skins; never your SteamID. Your message is also converted into a vector (embedding) through Google’s API to look up related news; that vector is not stored. The conversation history is not kept on our servers: it lives on your device for the session.
Gameplay statistics (Leetify): when you open the Profile tab, our server sends your SteamID to the Leetify API to retrieve your public Counter-Strike 2 performance statistics (ratings, recent matches). The request is made by the server, not your device, so Leetify does not receive your IP address. We keep the response in server memory for 5 minutes to avoid repeated lookups; it is not stored in a database.
Data stored on your device: the app keeps a local cache of your inventory, profile and market data (up to 24 hours), your portfolio value history, the last 50 notifications received and the IDs of the news items you have read. This data does not leave the device: it is cleared when you sign out and when you uninstall the app.
3. Data we do NOT collect
We never receive or store your Steam password: authentication is performed by Steam, not by the app.
We do not collect your email address, phone number or payment data.
We use no analytics or advertising services, and no third-party SDKs beyond Firebase Cloud Messaging and Firebase Crashlytics (crash reports, described in section 2). We do not sell or share your data for advertising purposes.
4. Purpose and legal basis
Performance of the service you request by using the app (GDPR art. 6(1)(b)): authenticating you, showing your inventory and its value and your gameplay statistics, and providing market information and news.
Your consent (GDPR art. 6(1)(a)): push notifications (system permission), the price alerts you create and the use of the assistant chat. You can withdraw it at any time by revoking the permission, deleting the alerts or no longer using the chat.
Our legitimate interest (GDPR art. 6(1)(f)) in keeping the service secure and available: the per-IP request limit, technical security logs and crash reports from the Android app, which we use to detect and fix errors.
5. Retention and security
Session tokens expire on their own (30 minutes for access, 7 days for refresh) and are revoked when you sign out. The profile and inventory fetched from steamwebapi.com are held in a server cache for up to 23 hours to reduce lookups, not as a permanent record.
We retain in our database, linked to your SteamID: your device’s notification token (until you sign out, delete your data or Firebase reports that the device no longer exists) your price alerts, active or triggered (until you delete them), and your daily portfolio value, for as long as your account exists and until you delete your data.
Market price history and the names of tracked skins carry no SteamID: they cannot identify you or reveal what is in your inventory, and are kept indefinitely as market data.
Firebase Crashlytics keeps crash reports for 90 days and then deletes them.
We do not create a password-based account: your identity is your SteamID. All communications between the app, our servers and the providers listed here are encrypted in transit using HTTPS (TLS). The assistant only has access to public CS2 news, never to other users’ data.
6. Third parties
Steam (Valve Corporation): authentication via Steam OpenID. It receives the sign-in request and returns your SteamID to us.
steamwebapi.com: an independent commercial provider to which we send your SteamID to retrieve your public profile and inventory. It keeps a temporary copy of the public inventory it looks up.
Firebase Cloud Messaging (Google): delivers push notifications on Android. It receives the device identifier and the contents of the notification.
Firebase Crashlytics (Google): collects crash reports from the Android app. It receives what is described in section 2: the error trace, technical device data and the SHA-256 digest of your SteamID.
Gemini (Google): generates the assistant’s replies and the search embeddings. It receives what is described in section 2.
Leetify (Leetify AB, Sweden, European Union): a Counter-Strike 2 statistics service. Our server sends it your SteamID to show your statistics on your profile; it receives none of your other data.
frankfurter.dev: a service publishing the European Central Bank’s reference exchange rates. Our server queries it once a day for the euro-dollar rate so that prices can be shown in euros. The request is made by the server, not your device, and contains none of your data.
Supabase: the database holding notification tokens, alerts, market price history and your daily portfolio value, hosted in the European Union (Ireland).
Render hosts the application server. Vercel serves this website and logs the requests it receives.
Each provider processes data under its own privacy policy. We do not sell your data to anyone.
7. International transfers
The database is located in the European Union (Ireland). The server (Render), notifications and crash reports (Firebase) and the assistant (Gemini) are operated by companies in the United States, so your SteamID, your device token, crash reports and the chat contents may be processed outside the European Economic Area. These transfers rely on the European Commission’s Standard Contractual Clauses and, where the provider is certified, on the EU-US Data Privacy Framework.
8. Children
The app is not intended for children under 13, the minimum age for a Steam account. In Spain, users under 14 need the consent of a parent or guardian to use services like this one. If you believe a child has provided us with data without that consent, write to us and we will delete it.
9. Your rights
You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to the contact email and stating your SteamID. We reply within one month at most.
If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or the supervisory authority in your country.
10. Deleting your account and data
From the Profile tab in the app, the "Delete my data" button immediately removes your device token and your price alerts, revokes the session and clears the data stored on the device. You can also request it by email, stating your SteamID; we handle it within 30 days at most.
Market price history and the names of tracked skins are not deleted, because they carry no SteamID or any other data that could link them to you.
11. Changes to this policy
We may update this policy to reflect changes in the app or in applicable law. The date of the last update appears at the top of this document.
12. Contact
For any question about this privacy policy or the processing of your data, write to us at: