Privacy Policy

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:

2. The short version

• Optional Sign in with Steam for account features (no password, no email address — see section 7); no analytics, no advertising, no tracking pixels, no social media plugins.
• Fonts and all scripts are served from our own server — no Google Fonts or third-party CDNs in your browser, with one exception: item images are loaded from Steam's content delivery servers (see section 6).
• Price tables link out to third-party marketplaces; nothing is transmitted to them until you actively click such a link (see section 10).
• The only cookies are functional preference cookies that are set when you actively choose a currency or marketplace — plus, if you sign in with Steam, the session cookies needed to keep you signed in.
• The inventory tool processes Steam IDs to value publicly visible CS2 inventories; results are cached briefly (at most 20 minutes) and are not stored permanently — unless you are signed in and save a snapshot to your own account (see sections 5 and 7).
• Everything is hosted in the EU (Paris, France), and our web server keeps no persistent access logs of visitor IP addresses.

3. Hosting and server logs

FragStash is hosted on a server operated by Scaleway SAS, 8 rue de la Ville l’Evêque, 75008 Paris, France, in the Paris (PAR 1) data center region. Scaleway processes data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Data is not transferred outside the EU for hosting purposes.

Our web server is configured without access logging: we keep no persistent log files of your IP address or of the pages you visit. Connection data (IP address, request headers) is processed transiently in memory only as technically required to deliver the requested page, and is discarded afterwards. The application writes technical event logs (errors and warnings) to the system journal; these do not record visitor IP addresses, may in rare error cases contain request details such as a queried Steam ID, and are size-capped and overwritten automatically.

To guard against data loss, our database is backed up once per night to Scaleway Object Storage in the same Paris region (again under the Art. 28 GDPR data processing agreement; no transfer outside the EU). We keep the last 7 daily and 6 monthly backups; older ones are deleted automatically. Backups are used solely for disaster recovery and are never processed for any other purpose. One consequence worth knowing: data you delete — for example by deleting your account — may persist inside these backups for up to six months before the last backup containing it is rotated out. It is never restored unless a recovery becomes necessary, in which case we would re-delete affected records.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in the secure and reliable operation of the site and in being able to recover from data loss.

4. Cookies and local storage

FragStash uses only first-party, functional cookies. None of them track you, none are shared with third parties, and none are set until you actively use the corresponding feature. In our assessment they are strictly necessary within the meaning of Section 25(2) No. 2 of the German TDDDG, which is why no consent banner is required; we show a one-time informational notice instead.

Legal basis: Art. 6(1)(f) GDPR (provision of a feature you explicitly requested); for the sign-in cookies, Art. 6(1)(b) GDPR (providing the account you asked for). You can delete these cookies at any time in your browser; the site keeps working with default settings.

5. Inventory valuation tool

The Inventory tool values the publicly visible CS2 inventory of a Steam profile. When a Steam ID, vanity name, or profile URL is submitted, we process the following data:

• Steam identifiers: the submitted input and the resolved SteamID64. Vanity names are resolved via a request to steamcommunity.com.
• Public inventory contents: the item list of the inventory as published by Steam (item names, quantities, rarity, and — where Steam includes them in the public inventory data — float values, stickers, and charms), retrieved from steamcommunity.com.
• Valuation results: computed item and total values based on our own market price data.

This data is only held in a short-lived server cache so that repeated requests do not hammer Steam. For lookups without an account, nothing is written to a database and no valuation history is kept:

The one exception is deliberate: signed-in users can save daily snapshots of their own inventory to their account — that stored history is described in section 7. Looking up someone else’s inventory never stores anything beyond the short-lived caches above.

Share links and preview images

After a valuation, the page URL contains the queried Steam ID (/inventory/?steam=…). Anyone you share this link with can run the same valuation, and messengers or social platforms may render a preview image showing the inventory’s total value and top items. These preview images are generated on our server and cached for the short periods listed above. Share pages are marked noindex so that search engines do not index them.

If someone looks up your inventory

Visitors can look up any Steam profile, so we may briefly process data about you without you using FragStash yourself (Art. 14 GDPR notice). This is only possible if you yourself have set your Steam inventory to public — we retrieve nothing that Steam does not already publish to everyone. Legal basis: Art. 6(1)(f) GDPR — the legitimate interest of our users in valuing publicly visible game inventories, weighed against your rights, given that the data is already public, the processing is transient (see the retention table above), and you control its visibility.

To prevent your inventory from being looked up here or anywhere else, set it to private in your Steam privacy settings. Cached copies on our server expire within the periods listed above (at most 24 hours for the name mapping, 20 minutes for inventory contents). You can also contact us at any time at [email protected].

6. Item images from Steam servers

Item images on the start page, Armory and Inventory pages are loaded by your browser directly from Valve’s content delivery servers (community.cloudflare.steamstatic.com, community.akamai.steamstatic.com, cdn.steamstatic.com). So that the start page’s price ticker renders without delay, your browser already opens the connection to community.akamai.steamstatic.com while the page is loading. When that connection is opened and when these images load, your IP address and standard request headers are transmitted to Valve Corporation (Bellevue, WA, USA) and its CDN providers. We do not control this processing; Valve states in its privacy policy that it complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), for which the European Commission has issued an adequacy decision.

Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in displaying the official item imagery without proxying every image through our own server.

7. User accounts (Sign in with Steam)

You can optionally sign in with your Steam account to use account features such as saved inventories, watchlists and price alerts. When you click “Sign in through Steam”, your browser is redirected to steamcommunity.com, where you sign in directly with Valve Corporation (Bellevue, WA, USA) — from that point until you are redirected back, Valve’s privacy policy applies (see section 6 regarding Valve and international transfers). Your Steam credentials never reach FragStash: the OpenID procedure only confirms your identity to us.

When you sign in, we store: your public SteamID64, your public Steam persona name, the URL of your public Steam avatar image, and the timestamps of account creation and your last sign-in. Persona name and avatar URL originate from your public Steam profile (information pursuant to Art. 14 GDPR). We store no password and no email address. While you are signed in, your avatar image is loaded from Valve’s content delivery servers (see section 6).

If you use the account features, we additionally store the data those features exist to keep — all of it entered or requested by you, visible only to you, and never shared:

• Inventory snapshots: when you save a snapshot, the item list of your own inventory and its prices on that day. Detailed per-item lists are trimmed from snapshots older than 90 days (one per month is kept); daily total values are kept until you delete them. If you enable nightly automatic snapshots in your account settings, our server records one snapshot per night even while you are not visiting the site — you can turn this off at any time, and it is off by default.
• Investment journal: entries you create or confirm (item names, quantities, purchase and sale prices with their dates and currencies), the investment groups you set up, and any notes you type into them.
• Watchlist: the items you watch and the target prices you set.
• Settings: your feature preferences (for example whether automatic snapshots or inventory tracking are enabled).

You can delete individual snapshots, journal entries and watchlist items at any time, reset your entire portfolio under Account settings, or export your journal as CSV. Note that deleted data may persist in our disaster-recovery backups for a limited time (see section 3).

Legal basis: Art. 6(1)(b) GDPR — providing the account features you request. Your account data is stored until you delete your account, which you can do yourself at any time under Account settings; deletion is immediate and removes your identity record together with all data linked to the account.

8. Contact by email

If you email us, we process your email address, the message content, and any data you include, solely to handle your inquiry. Messages are deleted once the matter is resolved, unless a statutory retention obligation applies. Legal basis: Art. 6(1)(f) GDPR (responding to inquiries).

9. Server-side data sources

To provide market prices and item metadata, our server (not your browser) fetches data from our own pricing API, from the open-source ByMykel/CSGO-API project (via GitHub and jsDelivr), and daily reference exchange rates from the European Central Bank. These are server-to-server requests: no data about you is transmitted to any of these services.

10. Links to third-party marketplaces

Price comparison tables link to the listing or search pages of third-party marketplaces (for example Steam, Skinport, CSFloat or DMarket). These are plain links: while you browse FragStash, no data about you is transmitted to any marketplace and nothing is loaded from their servers. Only when you actively click such a link do you leave FragStash — from that point on, the privacy policy of the respective marketplace applies. We have no control over and take no responsibility for their data processing. The links currently contain no affiliate or tracking parameters.

11. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Apart from optional account data — which you can view and delete yourself under Account settings — FragStash stores practically no personal data beyond short-lived caches, so most requests resolve themselves through automatic expiry; you can always contact us at [email protected].

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

12. Final notes

We do not use automated decision-making or profiling. Providing personal data is neither legally nor contractually required; all features except the optional user account work without it, and you can delete your account yourself at any time. We may update this policy when the site changes — the date at the top reflects the current version. Legal disclosure and contact details are in the imprint.