Privacy Policy

The controller responsible for your personal data on cs2.app is:

CS2APP LLC
c/o autorenglück.de
Franz-Mehring-Str. 15
01237 Dresden
Germany
Email: contact@cs2.app

CS2APP LLC is a limited liability company organized under the laws of the State of Illinois, USA. The address above is our service address for correspondence. In this policy, "CS2.APP", "we" and "us" refer to CS2APP LLC. See also our legal notice.

We only collect what a given feature needs:

• Account details. When you sign up with Google or with an email and password, we store your name, email address, and (for Google) your profile picture. Passwords are stored only in hashed form.
• Sign-in sessions and security data. While you are signed in, our authentication system keeps a session record that includes your IP address and browser user agent. To prevent abuse, we also keep short-lived rate-limit counters for sign-in, password reset and similar actions.
• Steam link (optional). If you link your Steam account, Steam confirms your identity via OpenID and we store your public SteamID64 so we can show a "verified" badge on your Team Finder post.
• Faceit stats. When your Steam account is linked, or when you add a Faceit profile to a Team Finder post, we fetch public data from Faceit (such as your Faceit nickname, skill level, ELO, recent match statistics, profile URL and, for team posts, ESEA league placement) and store it with your profile or post.
• Content you create. Team Finder posts (for example your in-game name, region, roles, languages, experience, age for player posts, free-text details, and Steam or Faceit links) and the lineups, POVs and settings you bookmark. Team Finder posts are public and can be seen by anyone visiting the site.
• Messages to us. If you email us or use the contact form, we receive your name, email address and whatever you write, and use it only to answer you.
• Technical data. Like any website, our hosting and backend providers process your IP address, the requested URL, date and time, and browser information to deliver pages and keep the service secure. This data is kept in their server logs.
• Usage analytics (only with consent). If you click "Accept" in the cookie banner, we use Google Analytics and Vercel Web Analytics to understand how the site is used (pages viewed, referring page, device type, operating system and browser, approximate location derived from your IP address). Without your consent, neither is loaded at all.

You do not have to provide any personal data to browse the site. An account is only needed for features like Team Finder and bookmarks, and we cannot provide those features without the account details listed above.

The Demo Viewer parses any .dem file you open entirely inside your browser and stores the result locally (in your browser's IndexedDB) so your recent demos are available on return visits. Your demo files are never uploaded to our servers. Clearing your browser storage removes them.

Under the EU and UK General Data Protection Regulation (GDPR), we rely on the following legal bases:

• Performing our contract with you (Art. 6(1)(b) GDPR): creating and running your account, signing you in, publishing your Team Finder posts, showing your verified badge and Faceit stats, saving bookmarks, and sending transactional emails such as email verification, password reset and account deletion confirmations.
• Our legitimate interests (Art. 6(1)(f) GDPR): operating, securing and improving the site, preventing abuse and fraud (session records, rate limiting, server logs), answering your messages, sending you to the right Amazon storefront for your country, and showing preview images for embedded YouTube videos. Our interest is providing a secure, working service; you can object to this processing at any time (see "Your rights").
• Your consent (Art. 6(1)(a) GDPR, together with the national rules on storing information on your device, such as § 25(1) TDDDG in Germany): Google Analytics and Vercel Web Analytics, and playing an embedded YouTube or X video, which only happens when you click play. You can withdraw your consent at any time with effect for the future.
• Legal obligations (Art. 6(1)(c) GDPR): where we must keep or disclose data by law.

We do not use your data for automated decision-making or profiling.

We use the following:

• Essential cookies (no consent needed): sign-in cookies that keep you logged in, a short-lived cookie that protects the Steam linking flow against forgery, and the cs2_consent cookie that remembers your cookie choice for 180 days.
• Local browser storage (no consent needed): the Demo Viewer keeps your parsed demos in IndexedDB on your device, as described above.
• Analytics cookies (only with consent): Google Analytics sets the _ga and _ga_<ID> cookies, which expire after up to 2 years. They are only set after you click "Accept".
• Cookieless analytics (only with consent): Vercel Web Analytics sets no cookies and stores nothing on your device. It recognizes repeat page views within a visit using a hash of the incoming request, which Vercel discards after 24 hours, and it does not store your IP address. It also only runs after you click "Accept".
• Embedded videos (only when you click play): videos are click-to-play previews. Clicking play is your consent to load that video from YouTube or X, which may then store or read information on your device (see YouTube and X below). The video player does not load before you click, and each click applies only to the video you start. Some YouTube previews show an image loaded from YouTube's image server before you click (see YouTube below); X videos load nothing from X before you click.

Your choice. On your first visit a banner asks whether you allow analytics (Google Analytics and Vercel Web Analytics). "Accept" and "Decline" are equally easy, and nothing non-essential loads before you accept. Google Analytics runs in Consent Mode with advertising storage and ad signals always switched off, and neither tool sends page views from sign-in, sign-up or password reset pages. You can change or withdraw your choice at any time via "Cookie settings" in the site footer. If you withdraw, both stop immediately and we delete the Google Analytics cookies from your browser. You can also block or delete cookies in your browser settings; the sign-in cookie is required to stay logged in.

We do not sell your data or share it for advertising. We use the following service providers, which process data on our behalf (as processors) or, where noted, as independent recipients under their own privacy policies:

• Convex (Convex, Inc., USA): backend and database hosting. Stores your account, profile, posts and bookmarks.
• Vercel (Vercel Inc., USA): website hosting and content delivery; processes technical data such as your IP address to serve pages. Only with your consent, Vercel Web Analytics.
• Google (Google LLC, USA, and Google Ireland Limited): sign-in with Google (OAuth), if you choose it, and, only with your consent, Google Analytics.
• Valve / Steam (Valve Corporation, USA): optional account linking via Steam OpenID. You sign in on Steam's own site; we only receive your SteamID64.
• Faceit (FACEIT Limited): we look up public player and team statistics for Team Finder through the Faceit API using your SteamID64 or the Faceit profile you provide.
• Resend (Resend, Inc., USA): delivery of transactional emails (email verification, password reset, account deletion). Resend receives your email address and the email content.
• Cloudflare (Cloudflare, Inc., USA): R2 storage for images shown on the site. When an image is delivered directly from storage, Cloudflare processes your IP address to deliver it.
• YouTube (Google Ireland Limited and Google LLC, USA): nade, POV, tactic and some blog pages include YouTube videos. They are shown as a click-to-play preview. Where we have no preview image of our own (for example on nade pages), the preview image is loaded from YouTube's image server (i.ytimg.com) when the page opens. To deliver it, Google receives your IP address and technical data about your browser; this image request sets no cookies. The legal basis is our legitimate interest in showing what a video contains (Art. 6(1)(f) GDPR). Only when you click play does the video player load from YouTube in privacy-enhanced mode (youtube-nocookie.com). From then on, YouTube receives your IP address and technical data about your device, and may store or read information on your device (such as cookies or local storage) and use it under its own responsibility. The legal basis is your consent, given by clicking play (Art. 6(1)(a) GDPR and § 25(1) TDDDG). If you do not click play, the player never loads. Google's own privacy policy applies to that processing.
• X (Twitter) (X Corp., USA, and Twitter International Unlimited Company, Ireland): some nade pages play videos posted on X. They are shown as a click-to-play preview: until you click play, your browser does not connect to X. Only when you click play does the video load in X's own video player (x.com). From then on, X receives your IP address and technical data about your device, and may store or read information on your device (such as cookies) and use it under its own responsibility. The legal basis is your consent, given by clicking play (Art. 6(1)(a) GDPR and § 25(1) TDDDG). X's own privacy policy applies to that processing. Separately, some blog articles embed posts from X: their text is fetched through a proxy, and images in those posts load from X's servers, which receive your IP address.
• Amazon: see "Affiliate links" below.

We may also disclose data where required by law or to protect our rights, for example to respond to a valid legal request.

As an Amazon Associate we earn from qualifying purchases, and we are a MaxGaming affiliate (MaxFPS partner program). When you follow a gear link, for example on a pro settings page, it goes through our /go/amazon or /go/maxgaming redirect. To offer the retailer and storefront that serve your country, pro settings pages ask our server for the country code that our hosting platform derives from your IP address, and the Amazon redirect reads the same code; neither the country nor your IP address is stored by us (your browser keeps the country code for the current session only). The retailer then receives a referral identifier so a purchase can be credited to us. We do not send retailers your account details. Once you are on a retailer's site, that retailer's privacy notice applies, including any cookies it sets to attribute the referral.

We do not run third-party advertising on CS2.APP and do not use advertising cookies.

CS2APP LLC is based in the United States, and most of our service providers (including Convex, Vercel, Google, Resend and Cloudflare) process data in the United States. The United States does not offer the same level of data protection as the EU or UK. Where personal data from the EEA, UK or Switzerland is transferred to a recipient in the United States, the transfer relies, where applicable, on the recipient's certification under the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) or on the European Commission's Standard Contractual Clauses. You can ask us for more information about these safeguards at contact@cs2.app.

• Account data is kept for as long as your account exists. When you delete your account, your profile, linked Steam and Faceit data, bookmarks and Team Finder posts are removed.
• Sign-in sessions expire automatically and are deleted when you sign out, when they expire, or when your account is deleted. Rate-limit counters are kept only for their short time window.
• Server logs at our hosting providers are kept only for a limited period according to their retention settings.
• Analytics data is kept in Google Analytics for no longer than the retention period set in our Analytics property (at most 14 months). Vercel Web Analytics keeps aggregated page view statistics for the reporting period of our Vercel plan. Analytics cookies are deleted when you withdraw consent.
• Messages to us are kept for as long as needed to handle your request.

We may keep data longer where the law requires it or where it is needed to establish, exercise or defend legal claims.

Under the GDPR and similar laws you have the right to:

• Access a copy of your personal data.
• Rectify inaccurate data.
• Erase your data.
• Restrict processing.
• Object to processing based on our legitimate interests, on grounds relating to your particular situation.
• Port your data to another service.
• Withdraw consent at any time, for example via "Cookie settings" in the footer. This does not affect processing that happened before you withdrew.
• Lodge a complaint with a data protection supervisory authority, in particular in the country where you live, work, or where you believe an infringement took place.

You can delete your account and its data yourself from your dashboard, or email us at contact@cs2.app to exercise any of these rights. We may ask you to confirm your identity before acting on a request.

All traffic to cs2.app is encrypted with HTTPS, passwords are stored only as hashes, and access to our systems is restricted. No online service can be perfectly secure, but we work to protect your data against loss and misuse.

CS2.APP is not directed to children under 13, and we do not knowingly collect their data. If you believe a child has provided us personal data, contact us and we will delete it.

We may update this policy as the service evolves. Material changes will be reflected here with a new "last updated" date.

Questions about this policy or your data? Email contact@cs2.app or use our contact form.