Privacy policy
SteamPlayerBase is a Steam game stats site. You can use it without an account. This page says what we keep when you do sign in, how we protect it, and what you can do about it. We don't sell or share your data, and we don't track you across other sites.
Who is responsible
The person responsible for your data (the “controller”) can be reached at [email protected]. You can also delete your account and download your data yourself, any time, in Privacy & security. We answer privacy requests within one month (45 days for California requests), free of charge.
What we keep
Without an account
We store nothing about you on our servers. A few settings are saved in your own browser (see Cookies below).
With an account
- How you sign in: your Steam ID. You sign in on Steam's own page; we never see or store a password.
- Discord (only if you link it): your Discord user ID and name, so you get the Verified role in our Discord server and moderation can follow one account. Unlinking deletes them.
- Profile: display name, avatar link, username, bio, social links, country (for store prices) and, if you pick one in Settings, your time zone (for the calendar), as you set them or as Steam provides.
- What you do here: your lists, watchlist and alert settings, followed studios, webhooks you add, devices you turn notifications on for, and recent alerts (kept 90 days).
- Security: sign-in sessions (as long as you choose in Settings: 1 hour to 30 days), your two-factor authentication secret if you turn it on, and a list of security changes with the browser and system used (for example “Chrome on Windows”).
- From Steam, when you link it: we read your public library, playtime, wishlist and inventory to show them to you and to pick deals. Your games, hours and wishlist are kept encrypted for up to 12 hours before we ask Steam again, and deleted 7 days after the last refresh or with your account. Your inventory itself stays in memory for a few hours, not in our database. We do keep one number a day, its total market value, filed under a one-way code made from your Steam ID (not the ID itself), so we can show how it changed since last week; it goes with your account. Market prices are about items, not people, and are shared by everyone. Items you choose to watch, and the price you want, are kept until you stop watching them.
- Friends and follows: who you follow, who follows you, your friends and friend requests are kept until you remove them or delete your account. When you sign in with Steam we read your Steam friends list (only if it's public on Steam) so your Steam friends become friends here; for friends who aren't members we keep only a one-way code made from their Steam ID, never the ID, so you're connected if they join. Removing a friend here stays removed.
Reports
If you report content, we keep the report and, if you give it, your email (encrypted) to tell you the outcome. Reports are kept for 1 year after a decision.
We never store your IP address or location. To slow down abuse and report spam, your IP address is held in memory for up to an hour, then forgotten.
People who aren't members
Anyone can look up a public Steam profile here by its link or Steam ID. We then read what Steam makes public (name, picture, level, account age, and the game list and playtime if those are public), show it, and keep it in memory for a few hours. We don't save it in our database, and these pages are hidden from search engines. A private Steam profile shows only its name and picture. We do this in our legitimate interest in letting players find and compare profiles, which only covers what the owner already made public on Steam. If it's your profile and you object, make it private on Steam, claim it here and make it private, or report it (pick “my personal data”) and we'll hide it.
How it's protected
- Every member has their own random encryption key. Your personal details are encrypted with it (AES-256-GCM), so our database can't be read on its own. We keep only one-way hashes of what we look people up by (Steam ID, username).
- Your key is itself locked. In Standard mode the site's master key (kept outside the database) opens it, so alerts and your public profile work while you're away. In Private vault mode, 10 random words that only you hold open it: even with our master key, nobody can read your details. See Privacy & security.
- Webhook links, notification devices and two-factor secrets are encrypted too. Sign-in tokens are stored only as hashes.
- Security changes need proof it's you from the last few minutes, and every change is logged and announced to your devices.
Why we use it (legal basis)
- To provide the service you asked for (contract): signing in, lists, watchlist, alerts, profiles.
- Legitimate interest: keeping accounts secure (rate limits, security activity), and showing public Steam profiles looked up by link (see above).
- Legal obligation: handling reports of illegal content.
- Consent: notifications on your devices, anything optional you turn on, and, in the EU/EEA, UK and Switzerland, ad cookies and personalized ads. You can withdraw it any time.
Cookies and browser storage
Our own cookies are only the ones the site needs to work, listed below. We use no analytics or tracking cookies of our own.
Ads. The ads are served by Google AdSense. Google uses cookies and similar technology to show ads, limit how often you see them, measure them and, where allowed, personalize them based on your visits to this and other sites. Adult, dating, gambling, alcohol and similar ads are blocked here.
- EU/EEA, UK and Switzerland: Google's consent message asks you before any ad cookies or personalized ads. You can accept, decline or pick options, and change your choice any time with the privacy and cookie settings link it adds to the page.
- US states with privacy laws: a “Do Not Sell or Share My Personal Information” link on the page opts you out of personalized ads.
- Global Privacy Control: if your browser sends it, you only get non-personalized ads, everywhere.
- Everyone: the switch at the bottom of every page turns ads off completely on your device. You can also manage Google's ad personalization at adssettings.google.com.
- Sign-in session: keeps you signed in. Lasts 1 hour to 30 days, as you choose in Settings.
- Two-factor step: remembers a sign-in that's waiting for your two-factor code. Lasts 5 minutes.
- Sign-in protection: a one-time check that the Steam (or Discord linking) sign-in coming back is the one you started, so another site can't sign you in to someone else's account. Lasts 10 minutes.
- Suspension notice: only when a suspended account tries to sign in, to show why and until when. Lasts 10 minutes.
- Store country: the country whose store prices you see. Lasts 1 year.
- Ad switch: whether you turned ads off with the switch at the bottom of the page. Lasts 1 year.
- Google ad cookies: set by Google when ads show (and your consent choice, where it's asked). See how Google uses cookies in advertising.
- Time zone: so the release calendar starts each day at your midnight. Lasts 1 year.
- Saved in your browser only: recently viewed games, your Browse settings, whether Steam links open in the app or browser, and saved copies of site files so pages load faster. Kept until you clear your browser data.
Who else is involved
- Steam (Valve): when you sign in with Steam, and to read your public Steam profile, library and inventory.
- Google: as our ad provider (Google AdSense): your browser loads ads from Google, so Google receives your IP address and browser details and uses cookies as described above. See how Google uses information from sites that use its services.
- Notification services (Google, Mozilla, Apple or Microsoft, depending on your browser): only if you turn on notifications for a device. They receive the alert text.
- Discord or your own server: alerts you choose to send to a webhook you added.
- Our hosting and network provider (Cloudflare): carries the traffic to the site, so it handles your IP address to deliver pages.
- Steam's image servers: game pictures and avatars load straight from Steam, so Steam sees a normal request from your browser, as on any page with Steam images.
Some of these are outside your country, including in the United States. Where GDPR applies, data goes there only as needed to give you the service you asked for (such as signing in with Steam) or under the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.
Game data (player counts, prices, reviews) comes from public sources. We send them no personal data.
How long we keep it
- Your account: until you delete it. When you ask us to delete it, it's deactivated immediately (hidden from everyone, signed out everywhere, no alerts), and everything (your details, lists, watchlist, alerts and your key) is permanently deleted after 21 days. Sign in before then to restore it, or choose to delete it right away.
- Backups: if we keep database backups, they're never used to bring deleted accounts back and are deleted within 30 days, so a deleted account is gone from them within 30 days too.
- Sign-in sessions: as long as you choose (1 hour to 30 days). Recent alerts: 90 days. Backup copies of a Private vault key (used to undo it): 7 days. Reports: 1 year after a decision.
Your rights
- Access and download your data: Download my data gives you everything as a file.
- Correct it: change your details in Settings and on your profile.
- Delete it: Delete account removes everything within 21 days (or immediately, if you choose).
- Object or restrict: hide your profile, library or inventory in Settings, turn alerts and notifications off, or switch to a Private vault.
- Complain: you can contact your data protection authority. In California, the California Privacy Protection Agency.
California residents
This covers the California Consumer Privacy Act (as amended by the CPRA) and CalOPPA.
- What we collect (in the last 12 months): identifiers (Steam ID, Discord ID if you link it, username), profile details you add, your activity on this site (lists, watchlist, alerts) and security logs, as listed above. Sources: you, Steam when you sign in, and Discord if you link it. Purposes: running the site and your account, and keeping it secure. Through ads: online identifiers (cookies, IP address) and activity on this site, collected by Google to show and measure ads.
- Selling and sharing: we never sell your account details (Steam ID, lists, activity) to anyone. Google AdSense may use cookies and your IP address for personalized ads, which California law can count as “sharing” for cross-site advertising. To opt out, use the “Do Not Sell or Share My Personal Information” link on the page, send a Global Privacy Control signal (you then get only non-personalized ads), or turn ads off with the switch at the bottom of any page. We don't use sensitive personal information to infer anything about you.
- Your rights: to know what we hold and get a copy, to correct it, to delete it, and not to be treated differently for using these rights. Use the links above, or contact us at [email protected]. An authorized agent can ask for you; we'll check it's really you by having you sign in to your account.
- Do Not Track: browsers don't agree on what it means, so we follow Global Privacy Control instead (see above).
Children
Accounts are for people aged 13 or older. In the EU and UK, people under 16 (or the lower age their country sets) need a parent's or guardian's permission. We don't knowingly keep data about children under 13; if you think we do, contact us and we'll delete it.
If something goes wrong
If a breach ever puts your personal data at risk, we'll tell the data protection authority within 72 hours where GDPR requires it, and tell you without undue delay, as GDPR and California law require.
We'll update this page if anything changes and note the date at the top. See also the terms of use.