Privacy Policy

1. Data controller

The controller of the data is the developer of CS-FINANCE. For any question about this policy or the exercise of your rights, use the email listed in the contact section.

2. Data we process

Steam identifier (SteamID): when you sign in via Steam OpenID, Steam shares your public SteamID with us. It is the only identifier we receive from the authentication process.

CS2 profile and inventory: using your SteamID, the app queries the Steam Web API for your public profile (name, avatar) and the contents of your Counter-Strike 2 inventory, in order to compute and display its value.

Technical session data: to keep you signed in we issue an access token (JWT) that lives only in memory during use, and a refresh token stored in an HttpOnly cookie. These tokens are for internal use and are not shared with third parties.

Your portfolio history: the app stores a history of your inventory value in your own device’s local storage. This data never leaves your device, is never sent to our servers, and is removed when you uninstall the app.

Push notification token (Android only): if you allow notifications, we store in our database a device identifier provided by Firebase Cloud Messaging, linked to your SteamID. This is what lets us send an alert to your device and not someone else’s. If you decline the notification permission, this data is not collected.

Price alerts you create: if you set up an alert (“notify me if this skin drops below X”), we store the skin name, the threshold and the direction, linked to your SteamID, until you delete it or it triggers.

Assistant messages: if you use the built-in chat, the text of your messages is sent to the Gemini API (Google) to generate the reply. We do not store the conversation history on our servers: it lives on your device for the session.

3. Data we do NOT collect

We never receive or store your Steam password: authentication is performed by Steam, not by the app.

We do not collect your email address, phone number or payment data.

We do not sell or share your data with third parties for advertising purposes.

4. Purpose and legal basis

We process the above data for the sole purpose of providing the service: authenticating you and showing your inventory value, market information and news. The legal basis is the performance of the service you request by using the app.

5. Retention

Session tokens expire automatically (the access token after 30 minutes and the refresh token after 7 days) and are deleted when you sign out. Profile and inventory data fetched from Steam is held temporarily in memory (a cache of a few hours) to reduce calls to the Steam Web API, and does not constitute a permanent record.

We do retain in our database, linked to your SteamID and until you delete them: your device’s notification token and any price alerts you have created. We also record historical prices for the skins the app tracks, but that is market data, not yours: it cannot identify you and does not reveal what your inventory contains.

We do not create a password-based user account: your identity is your SteamID, issued by Steam.

All communications between the app and our servers, as well as with Steam services, are encrypted in transit using HTTPS (TLS).

6. Third parties

The app communicates with Steam services (Steam OpenID and the Steam Web API, by Valve Corporation) to authenticate you and retrieve your profile and inventory. Steam’s processing of your data is governed by its own privacy policy.

Firebase Cloud Messaging (Google) delivers push notifications to your Android device. It receives the device identifier and the contents of the notification.

Gemini (Google) generates the assistant’s replies. It receives the text of the messages you write to it.

Supabase hosts the database where notification tokens, price alerts and market price history are stored.

Render hosts the application server, and Steam (Valve) provides authentication, profile and inventory.

The app does not use third-party analytics, advertising or crash-reporting services, and we do not sell your data to anyone.

7. Your rights

You may exercise your rights of access, rectification, erasure, objection and portability over your data, and you can sign out at any time to revoke the app’s access to your Steam account. To exercise them, contact us at the email below.

How to delete your data: when you sign out, the app removes your device’s notification token from our database and revokes the refresh token immediately. You can delete price alerts individually from your profile. To remove data stored locally (such as your portfolio history), simply uninstall the app.

If you want us to erase everything linked to your SteamID at once, write to the contact email and we will do it.

8. Changes to this policy

We may update this policy to reflect changes in the app or in applicable law. The date of the last update appears at the top of this document.

9. Contact

For any question about this privacy policy or the processing of your data, write to us at:

privacy@csfinance.app