Privacy Policy

This policy describes how CSlytics (“we”, “us”) handles information when you use the CSlytics desktop app for Windows, the Cslytics Float Curves Chrome extension, the website at cslytics.com, and related services that support them.

The three are separate. Neither the desktop app nor the extension uses a CSlytics website account. If you only use one of them, the sections about the others do not apply to you.

CSlytics is not affiliated with, endorsed by, or sponsored by Valve Corporation, Steam, or CSFloat.

The desktop app signs in to your Steam accounts, reads your CS2 inventory and storage units, and manages your Steam Community Market listings and buy orders, trades between your own accounts, and, if you connect it, your CSFloat listings and buy orders. It does all of this from your computer. We do not run a server that receives your account data, so we have no copy of it.

Signing in to Steam

You sign in inside the app, either by scanning a QR code with the Steam Mobile app or with your username, password and Steam Guard code. Your password and Guard code are sent to Steam to complete sign-in. They are never stored and never sent to us. Steam then issues a sign-in token, which the app keeps so it can stay signed in.

The app never asks for, reads, or stores your Steam Guard secrets (the shared and identity secrets held by a mobile authenticator). Anything Steam requires you to confirm waits for you to confirm it in the Steam Mobile app.

What stays on your computer

The app keeps its records in your Windows profile, in %APPDATA%\CSlytics. They include:

• your accounts’ Steam IDs, login names, profile names and avatars;
• the inventory and storage-unit contents the app reads, with item details such as float, pattern and stickers;
• your Steam Market and CSFloat listings, buy orders, sales and purchases, and wallet balances;
• trade offers and trades, including the Steam IDs of the people you trade with and any message on the offer, and, for CSFloat sales, the buyer details CSFloat provides for delivering the item;
• a history of the actions the app took for you and the responses Steam or CSFloat returned;
• your settings, and cached item data and images.

Steam sign-in tokens and CSFloat API keys are kept in a separate file encrypted with Windows’ built-in data protection, which ties them to your Windows user account. The app refuses to save them if that protection is unavailable. The rest of the record is an ordinary local database that is not separately encrypted, so anyone who can use your Windows account can read it.

Who the app talks to

The app connects directly from your computer to:

• Steam, to sign in, to read your inventory, storage units, market listings, buy orders, wallet balance and trade offers, and to carry out what you ask. Steam sees these requests as coming from your account. It lists the sign-in as a device named “CSlytics”, and it sees the app connect to CS2’s Game Coordinator as the game itself does.
• CSFloat, only if you add your own CSFloat API key, to read your CSFloat account, listings, buy orders and trades and to carry out what you ask. The app checks that the key belongs to the same Steam account before saving it, and sends it only to CSFloat. Separately, it downloads CSFloat’s public list of supported item types, without your key.
• Steam’s image servers, to download item images and your accounts’ avatars. These requests do not carry your sign-in.
• Our servers, as described next.

What the app sends to us

The app contacts our servers only to:

• download public CS2 item data (names, collections and image references) from api.cslytics.com. When the app meets an item type that data does not cover yet, it asks for that item type alone, by a one-way code. It does not say which item or which account it saw it in;
• check downloads.cslytics.com for a new version when it starts and every four hours after that. Updates download automatically and install when you quit the app. The installer also downloads the app from there;
• read a small release notice from downloads.cslytics.com when it starts and hourly after that. It lets us stop an outdated version from placing listings or orders if a change at Steam or CSFloat makes that version unsafe. Reading your accounts and signing in are never blocked.

These requests carry your IP address and the app’s version, operating system and processor type. Update checks also carry a random install ID that the update component creates the first time it runs. It is not derived from your accounts or your computer, and we do not link it to you. None of these requests include your Steam ID, login name, inventory, listings, trades, sign-in tokens or CSFloat key. Our servers and hosting providers may keep ordinary access logs of them.

Actions on your accounts

The app changes your Steam or CSFloat accounts only when you ask it to: for example, listing or delisting an item, placing, changing or cancelling a buy order, moving items in or out of a storage unit, or moving items between your own accounts. In that last case it sends the trade offer from one account and accepts it on the other. Once you have asked, the app may finish that work in the background.

While an account is signed in, the app also re-reads it every so often to keep its record current, including while the window is hidden. In each account’s settings you can choose whether the app signs it in and connects it to CS2 when the app opens.

The extension reads item details already shown on Steam Community market and inventory pages (such as item name and float) so it can display a price estimate. That processing happens on your device.

To show an estimate, the extension requests public price-curve and exchange-rate data from our servers. Those requests identify the item, not you. We do not receive your float value, the price you type into Steam, your Steam ID, inventory contents, wallet balance, or login credentials.

The extension may cache downloaded public data on your device. That cache is not uploaded and is removed when you uninstall the extension or clear its storage.

Our servers may keep ordinary technical access logs for those requests (for example IP address, timestamp, requested URL, and User-Agent) for security, abuse prevention, and troubleshooting.

Without an account

You can use the Tradeup Calculator without signing in. In that case we may receive standard technical information about page requests through our hosting and analytics providers, as described below.

Website sign-in

Optional sign-in uses Steam OpenID. We never receive your Steam password. When you sign in, we store:

• your public Steam ID;
• your public Steam display name and avatar URLs;
• account metadata such as subscription tier and timestamps;
• a session record (session token, expiry, and the IP address used when the session was created);
• usage counters needed to enforce fair-use limits.

We do not request your Steam inventory, trade history, wallet balance, friends list, or email address from Steam.

Feedback

If you submit feedback through our form, we receive whatever you choose to include. Please do not send sensitive personal information in feedback.

We use information only to:

• provide and operate the desktop app, the extension and the website;
• deliver desktop app updates and item data, and stop outdated versions from trading when they are no longer safe;
• authenticate signed-in website users and keep sessions working;
• prevent abuse and enforce fair-use limits;
• understand aggregate website traffic;
• respond to feedback and support requests;
• maintain security and troubleshoot problems.

We do not use personal information for advertising, credit decisions, or any purpose unrelated to operating CSlytics.

We do not sell personal information. We share information only with service providers that help us host, deliver, store, or analyze the service, and only as needed for those functions. They are not permitted to use the data for their own advertising.

The desktop app sends your account data directly to Steam and, if you connect it, CSFloat, because that is how it does what you ask. We are not a party to those requests. Valve’s and CSFloat’s own privacy policies apply to them.

If you sign in to the website with Steam, Steam processes the authentication flow under Valve’s own privacy policy. Avatar images may be loaded from Steam’s servers.

Our providers may process data in countries other than your own.

The extension sets no cookies.

The desktop app sets no cookies for us. To act on Steam it uses Steam’s own session cookies, which it holds in memory and sends only to Steam. It keeps interface preferences, such as the last tab you used, in its local storage on your computer.

The website sets one strictly necessary session cookie after you sign in with Steam. It keeps you signed in, is not used for advertising or cross-site tracking, and ends when you sign out or the session expires. We do not use advertising or third-party tracking cookies.

Desktop app

• The app’s records stay on your computer until you remove the account in the app or delete them yourself.
• Removing an account in the app deletes its sign-in token, its CSFloat key, its settings, and every record about it. Before each app upgrade the app copies its database to a backups folder beside it and keeps the newest three, so an older copy may still hold a removed account until newer copies replace it.
• Removing an account does not sign the “CSlytics” device out of Steam or revoke your CSFloat key. To do that, remove the device from your Steam account’s authorized devices and delete the key on CSFloat.
• Uninstalling the app leaves its records in place so that a reinstall keeps your accounts. To delete everything, uninstall the app, then delete %APPDATA%\CSlytics, %LOCALAPPDATA%\cslytics-desktop-updater. Version 0.1.1 and earlier also wrote a small Steam connection cache to %LOCALAPPDATA%\doctormckay\node-steamuser. Delete it too, unless another app uses it.

Extension and website

• Extension cache stays on your device and is removed on uninstall or when you clear extension storage.
• Server access logs are kept only as long as needed for security, abuse prevention, and troubleshooting.
• Website sessions expire by default after 7 days and are deleted when you sign out.
• Website account records are kept while the account exists, and deleted on request as described below.

If you only use the desktop app or the extension, we do not hold an account about you. The desktop app’s records are on your computer and under your control, as described in section 8. You can stop the extension’s network requests by uninstalling it, and clear its local cache from Chrome’s extension settings.

If you have a website account, you may ask us to confirm what we hold, provide a copy, correct it, or delete your account and associated data. Depending on where you live, you may also have rights to restrict or object to processing, to data portability, and to complain to a data protection authority. Email xpar65@gmail.com and we will respond within 30 days.

Traffic to CSlytics uses HTTPS. We aim to collect only what we need to operate the product. No method of transmission or storage is perfectly secure.

The desktop app never sends us your Steam sign-in tokens or CSFloat key, and it encrypts them on your computer. Its other records are not separately encrypted, so keep your Windows account secure.

CSlytics is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

If we change how data is handled, we will update this page and the effective date above. Continued use after an update means you accept the revised policy.

Questions about this policy: xpar65@gmail.com.