GDPR privacy information · Transparency & User Rights
This notice describes the categories of public and account data processed by CSRadar, the lawful bases and purposes of processing, data retention, and your rights under the EU General Data Protection Regulation (GDPR) and international privacy laws.
Last updated: 11 October 2026
Configure the controller's legal name, address and monitored privacy contact before public launch.
A person does not need a CSRadar account to appear in a report about a profile someone submitted. We may therefore process public profile information about non-users. Our sources are information you submit, Steam OpenID and documented public Steam endpoints, and public FACEIT endpoints only when that integration is enabled. We do not bypass profile privacy settings.
When you sign in, we receive your SteamID64 from a verified Steam OpenID response. We may read your public persona name and avatar from Steam and store these with account creation and last-login timestamps. We do not receive your Steam password.
If email sign-in is enabled and you register, we store your email address, a scrypt password hash, verification status, session records, one-time token hashes, and the Terms and Privacy versions you accepted. A keyed HMAC fingerprint of the last known sign-in IP is kept only to detect a new network location; it is replaced when another known address signs in, and the raw address is not stored for that alert. If you link Discord, we keep its account ID and display name, not its OAuth access token. Linking Steam is optional and is required before email-only accounts can use Steam profile features.
For a profile you submit, we process its SteamID/profile link, public Steam profile, ban and friend-graph data, and—when the FACEIT integration is enabled and returns data—public FACEIT identifiers, profile and game statistics. We store scan jobs, candidate links, scores and the evidence supporting them.
If you use them, we process watchlists, private notes, alerts and feedback. A feedback message may contain information you choose to type. Direct sponsor measurement can record a campaign, placement, event time, session identifier, and—when available—your SteamID, country and device class.
When you submit a contact or data-rights inquiry, we process the topic, email address, optional name, and message content to route and fulfill your request. Network telemetry and client IP data are evaluated ephemerally for DDoS and abuse rate-limiting. Email sign-in separately retains a keyed IP fingerprint as described above. Technical hosting and infrastructure providers operate under standard data protection agreements and security safeguards.
Steam sign-in, account access, scans and requested reports. The legal basis under GDPR is Article 6(1)(b) where processing is necessary to provide the service requested by the user.
Generate requested profile reports, protect the service from malicious abuse, and enforce rate limits. The legal basis is Article 6(1)(f) (legitimate interests), balanced against the rights of individuals whose public data appears in reports.
When CS2 demo files (.dem) or FACEIT match references are uploaded for coaching analysis, spatial telemetry and round events are parsed algorithmically to compute tactical self-improvement metrics. Processing is based on user request (Article 6(1)(b)) and legitimate interests in personal performance reflection.
The service calculates candidate correlation scores and link hypotheses algorithmically. Scores represent mathematical signal alignments, not conclusive identity verifications. CSRadar does not issue anti-cheat bans or administrative platform penalties. Individuals who believe public data has been inaccurately correlated may request review or suppression through the privacy contact channel configured for this deployment.
Some profile information may be obtained indirectly from public Steam or FACEIT sources. GDPR Article 14 can require information to be provided to the person concerned; any exception, including Article 14(5)(b), must be assessed for the particular processing and documented by the operator. Publishing this page does not by itself establish that an exception applies. Where the operator relies on legitimate interests, it must document the purpose-specific assessment and consider affected people's rights. Public availability alone does not establish a lawful basis for every use.
Optional email updates
If you separately opt in, CSRadar stores your email address and the date and version of that choice to send occasional product and service updates. Email is not required for a Steam account or profile scan, and the marketing checkbox is empty by default.
A one-time confirmation link must be used before the address becomes active. The confirmation message is sent only to verify the request; no product updates are sent while a request is pending. You can withdraw from Privacy choices at any time. On withdrawal or account erasure, the address is disabled and removed with the account.
Per-category data retention schedules govern historical profiles, telemetry snapshots, and cache persistence. Automated maintenance routines purge expired records and unreferenced graph snapshots.
You can submit an erasure or dispute request through the privacy contact channel configured for this deployment. Requests may require reasonable identity verification and are handled within the statutory period applicable to the request.
Depending on the circumstances, you can exercise these rights by contacting the data protection desk using the privacy details above. We may ask for reasonable proof that you control the Steam account or profile concerned so that we do not disclose data to the wrong person. If you are unsatisfied with our response, you may complain to the competent data protection supervisory authority.
Ask whether we process your personal data and request a copy, including the source and purposes where the data was obtained indirectly (GDPR Article 15).
Ask us to correct inaccurate data or erase data where the law provides that right (Articles 16 and 17). A deletion request can affect a report in which your profile appears.
You may request restriction or object to processing based on legitimate interests. We will assess the request against the applicable rules and explain the outcome (Articles 18 and 21).
Where Article 20 applies, you may request portable data. You may withdraw optional consent at any time; withdrawal does not change the lawfulness of earlier processing (Article 7(3)).
Public-source information can be refreshed from its source by a later scan. Deleting our copy does not change what Steam or FACEIT publishes on its own services.
After Steam sign-in, CSRadar sets a first-party, signed session cookie containing your SteamID64 and the public persona name/avatar used by the dashboard. It is HttpOnly, uses SameSite=Lax, is Secure in production, and expires after 30 days. It is used for authentication and is not a cross-site advertising identifier.
The csr_cookie_preferences first-party cookie stores whether you allowed sponsor measurement and country-based sponsor selection. It lasts up to 180 days and is used to remember these choices. Necessary session and security storage stays active either way.
Optional sponsor measurement records ad placements, rendered or viewable status, and clicks on CSRadar servers. It is off until you opt in. Country-based selection is a separate choice and uses an approximate country from the request only when enabled. These choices do not control core scans or sign-in. This build does not load third-party analytics or advertising-cookie scripts.
A scan may query public Steam API/community data and, when enabled, public FACEIT data. Private profile settings are respected. A missing or private source is reported as unavailable; the service does not treat missing data as evidence of a match.
CSRadar is an independent project and is not affiliated with, endorsed by, sponsored by or approved by Valve Corporation or FACEIT. Steam, VAC, CS2 and FACEIT are third-party marks used to identify the relevant services.
The live providers and transfer locations depend on the deployment. This repository does not verify the production host, data-center region, provider contracts, transfer mechanism, or active backup lifecycle. Before production processing begins, the operator must publish the actual recipients, purposes, locations, retention periods, and applicable transfer safeguards.
The codebase includes encrypted PostgreSQL backup support for a configurable Cloudflare R2 bucket. Its actual region, provider settings and retention are not established by the code. Steam and FACEIT are queried as public data sources when the relevant features are enabled; this notice must be updated if the live processing changes.
Your privacy choices
Necessary sign-in and security cookies stay on. Optional choices control sponsor measurement and country-based sponsor selection. You can change them any time in Cookie preferences. Read the privacy information.
