Privacy Policy

1. Controller

This policy explains which personal data CSStats processes when you use csstats.xyz (the "Service"), why and on which legal basis, how long we keep it, who receives it and which rights you have. The controller is D.I-Solutions, David Ipekoglu, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany, e-mail [email protected] (see Imprint).

2. Hosting and Server Logs

The Service runs on servers we rent. Every request passes through Cloudflare (Cloudflare, Inc., USA), which delivers the pages and protects them against attacks. These providers process the data only on our instructions (Art. 28 GDPR). Cloudflare is certified under the EU-U.S. Data Privacy Framework.

When you open a page, our servers and Cloudflare process your IP address, the requested address, the time and your browser's user agent. We need this to deliver the pages, to keep the Service secure and to limit how many requests one address or account can send. These logs and counters are kept only as long as this requires and are then deleted. Legal basis: Art. 6(1)(f) GDPR (secure and reliable operation of the Service).

3. Cookies and Local Storage

We use only what the Service needs, and advertising cookies only with your consent:

• Necessary: a session cookie that keeps you signed in, a short-lived cookie while you sign in with Steam or FACEIT, and a cookie with the language you picked. Your browser's local storage keeps your cookie choice, your recent searches, your own leaderboards and the converter's last values; these stay in your browser.
• Advertising: cookies of Google AdSense and its partners (section 4), set only after you accept them in the cookie banner.

You can change or withdraw your choice at any time with "Cookie settings" at the bottom of every page; withdrawing does not affect the lawfulness of the processing before (Art. 7(3) GDPR). Legal basis: for the necessary cookies and storage § 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR; for advertising cookies your consent, § 25(1) TDDDG and Art. 6(1)(a) GDPR.

4. Advertising (Google AdSense)

If you consent, Google AdSense (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) shows ads on the Service. Google and its partners then use cookies and similar technologies, process your IP address and information about your device and your visits to this and other websites, and may personalize ads on that basis. Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework. Without your consent, the AdSense code is not loaded. You can manage personalized ads in Google Ads Settings; details are in Google's Privacy Policy. Legal basis: Art. 6(1)(a) GDPR.

5. Account and Sign-In with Steam or FACEIT

An account is optional: you only need one to post and vote on crosshairs, to create stream overlays and to show your setup and links on your profile. Your account is your Steam account. With each session we store its IP address and browser user agent to keep your account secure.

You sign in through Steam's own sign-in page (OpenID, Valve Corporation, USA). We never see your Steam password: Steam only confirms your SteamID64. We store it with your Steam persona name and avatar, which we refresh from Steam at every sign-in, so that your account leads to your profile.

You can also sign in with FACEIT (FACEIT Connect, FACE IT Limited, United Kingdom). FACEIT then gives us your FACEIT player ID and nickname; we do not ask for your e-mail address and keep no FACEIT tokens. We take the Steam account of your FACEIT account from FACEIT's public player data and sign you into the account of that Steam account. Of this sign-in we store only your FACEIT player ID, as the link to your account.

We also store what you add to your account yourself, such as social media usernames, crosshair codes and gear settings. Avatars are loaded from Steam's and FACEIT's servers, which then see your IP address. Legal basis: Art. 6(1)(b) GDPR (your account and signing in) and Art. 6(1)(f) GDPR (keeping it secure).

6. Public Game Data from Steam and FACEIT

Player profiles, matches and leaderboards show public data from the Steam Web API (Valve Corporation, USA) and the FACEIT Data API (FACEIT, United Kingdom). When you open such a page, our server requests the data it needs. We share with Steam and FACEIT only what the request requires: the SteamID64, FACEIT player ID or FACEIT nickname of the player being looked up, or a match ID. We never share any data about you as a visitor. Images such as avatars are loaded from these providers' servers, which then see your IP address.

This data concerns the players shown: their SteamID64, Steam persona name, avatar and country, and their FACEIT level, ELO, statistics, matches, league standing, bans, hubs, teams and tournaments as the sources publish them. Our server fetches it only when a page needs it and caches it briefly, for a few minutes. Data from FACEIT is never stored in our database; of the Steam data we keep only the SteamID64 and persona name for the view counts (section 7). A player who makes a profile private at the source no longer appears with that data once our short cache has expired. Legal basis: Art. 6(1)(f) GDPR (our and our visitors' interest in a statistics service for public game data).

7. Profile View Counts

We count how often each player profile is viewed, as totals per day, stored with the viewed player's SteamID64 and persona name. We do not record who viewed a profile: no IP address, cookie or account is stored with these counts. We use them to list popular profiles and for our sitemap. Legal basis: Art. 6(1)(f) GDPR.

8. Stream Overlays

When you create a stream overlay, we store its name, its settings and the Steam account it shows, together with a secret link. Anyone who has this link can open the overlay, so only give it to your streaming software. You can delete an overlay at any time. Legal basis: Art. 6(1)(b) GDPR.

9. Crosshair Posts and Votes

Crosshair codes you post are public, with their title, the time of posting and your Steam persona name and avatar. Votes are stored with your account, so that every account votes only once. Legal basis: Art. 6(1)(b) GDPR.

10. Retention

We keep your account data until you delete your account; this also deletes your FACEIT sign-in link, your overlays, your crosshair posts and your votes. Sessions expire on their own. Game data from Steam and FACEIT is cached for a few minutes, data from FACEIT is never stored in our database, and view counts are kept as daily totals without any data about visitors. E-mails to us are kept as long as we need them to handle your request.

11. Your Rights

If you are located in the European Economic Area (EEA), you have certain data protection rights under the General Data Protection Regulation (GDPR). These include the right to:

• Access: request a copy of the personal data we hold about you
• Rectification: request correction of inaccurate or incomplete data
• Erasure: request deletion of your personal data by deleting your account
• Restriction: request that we restrict the processing of your data
• Data Portability: request your data in a structured, machine-readable format
• Objection: object to the processing of your personal data
• Withdrawing consent: withdraw a consent you gave at any time with effect for the future, for cookies with "Cookie settings" at the bottom of every page
• Complaint: lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), for example the one where you live or the one responsible for us: the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg (LfDI BW), Lautenschlagerstraße 20, 70173 Stuttgart, Germany

To exercise any of these rights, contact us at [email protected]. We answer within one month.

12. Changes to This Policy

We update this Privacy Policy when our processing changes. The current version is always on this page, with the date of its last revision at the top.

13. Contact

If you have questions about this policy or want to exercise your rights, contact us at [email protected].